Edit tour

Windows Analysis Report
Invoice#0036473 .xlsx

Overview

General Information

Sample Name:	Invoice#0036473 .xlsx
Analysis ID:	655755
MD5:	c93e6dcf32928e1da7346b6ca3a1dc85
SHA1:	b90d66412b4d6669a175fd30e32bbe44428bd245
SHA256:	3ffe69c9e2e2f8a350f7d2ff6e64acf8cffbf390489807b81cf8e4eec87d4047
Infos:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish10

Antivirus detection for URL or domain

Yara detected HtmlPhish7

Multi AV Scanner detection for domain / URL

Document exploit detected (process start blacklist hit)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Potential document exploit detected (unknown TCP traffic)

No HTML title found

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

HTML body contains low number of good links

Potential document exploit detected (performs HTTP gets)

Suspicious form URL found

IP address seen in connection with other malware

Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

Process Tree

System is w10x64

EXCEL.EXE (PID: 6356 cmdline: "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)

splwow64.exe (PID: 6548 cmdline: C:\Windows\splwow64.exe 12288 MD5: 8D59B31FF375059E3C32B17BF31A76D5)

chrome.exe (PID: 6864 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation -- "https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 4944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1492,14547596045636120040,8967704105705094900,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1932 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 1828 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 4908 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1572,2584016860965793630,9285400582768245070,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\index[1].htm	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\index[1].htm	JoeSecurity_HtmlPhish_7	Yara detected HtmlPhish_7	Joe Security

HTML

Source	Rule	Description	Author	Strings
91064.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
91064.0.pages.csv	JoeSecurity_HtmlPhish_7	Yara detected HtmlPhish_7	Joe Security

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	SlashNext: Label: Credential Stealing type: Phishing & Social Engineering
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/images/office3651.png	Avira URL Cloud: Label: phishing
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/images/gmail.png	Avira URL Cloud: Label: phishing
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html2	Avira URL Cloud: Label: phishing

Source: Yara match	File source: 91064.0.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\index[1].htm, type: DROPPED

Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: HTML title missing
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: HTML title missing

Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: Number of links: 0
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: Number of links: 0

Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: Form action: azn.php
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: Form action: azn.php

Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: No <meta name="author".. found
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: No <meta name="author".. found

Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: No <meta name="copyright".. found
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown	HTTPS traffic detected: 172.217.16.161:443 -> 192.168.2.3:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.49.244.155:443 -> 192.168.2.3:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.49.244.155:443 -> 192.168.2.3:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.49.244.155:443 -> 192.168.2.3:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.49.244.155:443 -> 192.168.2.3:49897 version: TLS 1.2

Source: Joe Sandbox View	JA3 fingerprint: ce5f3254611a8c095a3d821d44539877
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 01 Jul 2022 14:30:00 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=UTF-8X-Content-Type-Options: nosniffDate: Fri, 01 Jul 2022 14:30:02 GMTServer: fifeCache-Control: privateX-XSS-Protection: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Accept-Ranges: noneVary: Accept-EncodingConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=UTF-8X-Content-Type-Options: nosniffDate: Fri, 01 Jul 2022 14:30:04 GMTServer: fifeCache-Control: privateX-XSS-Protection: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Accept-Ranges: noneVary: Accept-EncodingConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 01 Jul 2022 14:30:03 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 01 Jul 2022 14:30:43 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 01 Jul 2022 14:30:46 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 01 Jul 2022 14:30:46 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: pnacl_public_x86_64_pnacl_sz_nexe.19.dr, pnacl_public_x86_64_pnacl_llc_nexe.19.dr	String found in binary or memory: http://llvm.org/):
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: splwow64.exe, 00000001.00000003.274869798.0000000002E72000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.277516468.0000000002E72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mic
Source: splwow64.exe, 00000001.00000003.273848040.000000000397D000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.273927054.0000000003984000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.287184725.000000000397D000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.274073249.0000000003989000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.289654276.0000000003984000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.290112416.0000000003989000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.289717601.0000000003988000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.micro_
Source: splwow64.exe, 00000001.00000003.283753202.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.277683100.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.272474325.0000000002E95000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.273848040.000000000397D000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.278650127.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.273927054.0000000003984000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.273448542.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.269980300.0000000002EA3000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.287184725.000000000397D000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.269103306.0000000002EA3000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000002.639688445.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.278038847.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.269711890.0000000002E9F000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.274073249.0000000003989000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.275038745.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.289654276.0000000003984000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.290112416.0000000003989000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.273030293.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.286151322.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.270225205.0000000002EA6000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.269614889.0000000002E95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.
Source: splwow64.exe, 00000001.00000003.271415857.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.271136883.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.271110685.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.cA.
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: index[1].htm.0.dr	String found in binary or memory: http://www.gmail.com
Source: splwow64.exe, 00000001.00000003.264411903.0000000002E95000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.264135446.0000000002E95000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.265089957.0000000002E95000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.264761149.0000000002E95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.o
Source: splwow64.exe, 00000001.00000003.276970217.0000000003A67000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.277087241.0000000003A6E000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.277056508.0000000003A6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.or
Source: c78cfa55-e1b4-4010-b1c1-a509d5123b73.tmp.20.dr, 71b843c2-4b70-4ce2-95c8-13f810853f15.tmp.20.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.19.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 71b843c2-4b70-4ce2-95c8-13f810853f15.tmp.20.dr	String found in binary or memory: https://ajax.googleapis.com
Source: index[1].htm.0.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://api.aadrm.com
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback

Source: ~DF3005FED378034CC9.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: 1A5C2F1B.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: Joe Sandbox View	IP Address: 104.17.24.14 104.17.24.14
Source: Joe Sandbox View	IP Address: 104.18.10.207 104.18.10.207

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/index.html HTTP/1.1Host: eyecandylashcompany.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/css/hover.css HTTP/1.1Host: eyecandylashcompany.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://eyecandylashcompany.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://eyecandylashcompany.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://eyecandylashcompany.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icon/free/png-512/microsoft-sharepoint-3-599372.png HTTP/1.1Host: cdn.iconscout.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/images/office3651.png HTTP/1.1Host: eyecandylashcompany.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/images/gmail.png HTTP/1.1Host: eyecandylashcompany.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /photo/2018/03/10/12/00/paper-3213924_1280.jpg HTTP/1.1Host: cdn.pixabay.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /proxy/bATQDWurvLlY3z2KTwUlb1gMxwLZoCk7CvqzrLqN1JioLU4nXkElVj-rMrvNZjuUXh3c1WhNOGX5_Cg18Wmltm3vvna-uZDqOkUISXU4XOYsUyt-4962tq2u0WiI358gef4ewWcVp0PA6YiTnICV2Cg7wLzdb0DlXw HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /proxy/bATQDWurvLlY3z2KTwUlb1gMxwLZoCk7CvqzrLqN1JioLU4nXkElVj-rMrvNZjuUXh3c1WhNOGX5_Cg18Wmltm3vvna-uZDqOkUISXU4XOYsUyt-4962tq2u0WiI358gef4ewWcVp0PA6YiTnICV2Cg7wLzdb0DlXw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/images/office3651.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: eyecandylashcompany.com
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/images/gmail.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: eyecandylashcompany.com
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/index.html HTTP/1.1Accept: /X-IDCRL_ACCEPTED: tUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; ms-office)Accept-Encoding: gzip, deflateHost: eyecandylashcompany.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/images/gmail.png HTTP/1.1Host: eyecandylashcompany.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/images/gmail.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: eyecandylashcompany.com
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/images/office3651.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: eyecandylashcompany.comIf-Modified-Since: Sat, 18 Jan 2020 17:50:20 GMT
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/images/office3651.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: eyecandylashcompany.comIf-Modified-Since: Sat, 18 Jan 2020 17:50:20 GMT
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/images/gmail.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: eyecandylashcompany.com

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1572,2584016860965793630,9285400582768245070,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation -- "https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1492,14547596045636120040,8967704105705094900,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1932 /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation -- "https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1572,2584016860965793630,9285400582768245070,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1492,14547596045636120040,8967704105705094900,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1932 /prefetch:8	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	13 Exploitation for Client Execution	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	1 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	5 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Source	Detection	Scanner	Label	Link
Invoice#0036473 .xlsx	5%	Virustotal		Browse
Invoice#0036473 .xlsx	8%	ReversingLabs	Document-Excel.Trojan.Heuristic

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\1828_1378596767\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\1828_1378596767\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1828_1378596767\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\1828_1378596767\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1828_1378596767\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\1828_1378596767\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://cdn.entity.	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://eyecandylashcompany.com/payment/frontend_paper_lantern/images/office3651.png	100%	Avira URL Cloud	phishing
https://api.aadrm.com/	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
http://www.w3.or	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://eyecandylashcompany.com/payment/frontend_paper_lantern/images/gmail.png	100%	Avira URL Cloud	phishing
http://www.w3.o	0%	URL Reputation	safe
http://schemas.microsoft.cA.	0%	Avira URL Cloud	safe
https://skyapi.live.net/Activity/	0%	URL Reputation	safe
https://api.cortana.ai	0%	URL Reputation	safe
https://staging.cortana.ai	0%	URL Reputation	safe
http://schemas.microsoft.	0%	URL Reputation	safe
https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html2	100%	Avira URL Cloud	phishing
https://wus2.pagecontentsync.	0%	URL Reputation	safe
https://cortana.ai/api	0%	URL Reputation	safe
http://schemas.mic	0%	URL Reputation	safe
https://roaming.edog.	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
eyecandylashcompany.com	69.49.244.155	true	true	6%, Virustotal, Browse	unknown
gstaticadssl.l.google.com	142.251.36.227	true	false		high
stackpath.bootstrapcdn.com	104.18.10.207	true	false		high
accounts.google.com	142.251.36.205	true	false		high
cdnjs.cloudflare.com	104.17.24.14	true	false		high
maxcdn.bootstrapcdn.com	104.18.10.207	true	false		high
clients.l.google.com	142.251.36.238	true	false		high
cdn.iconscout.com	104.18.28.243	true	false		high
cdn.pixabay.com	172.64.150.12	true	false		high
googlehosted.l.googleusercontent.com	172.217.16.161	true	false		high
clients2.google.com	unknown	unknown	false		high
ka-f.fontawesome.com	unknown	unknown	false		high
code.jquery.com	unknown	unknown	false		high
kit.fontawesome.com	unknown	unknown	false		high
lh3.googleusercontent.com	unknown	unknown	false		high

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Invoice#0036473 .xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\1aa1e2ae-a008-48f2-9a00-950f13de6f16.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\25f44532-3c2e-40b6-b226-70d49123bf36.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\426d4312-aea0-4881-af65-3e2d056b80e7.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\645b6acd-32ef-46c5-b04e-45becdcbdc09.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\7ba9cb53-984a-4699-8353-58f189a93a72.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\81c675b7-7c7a-479c-ac72-9efc226a8ad9.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\8a1a20b3-f5e6-4fe3-9a63-ad9192746343.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\95b1abdd-d52f-4cbc-b086-3ae19d1e8029.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\2bb8be48-7e72-4290-bb6b-6ab5f3a98207.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\4071c3c0-9bab-4e09-96cb-097a690243fb.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\71b843c2-4b70-4ce2-95c8-13f810853f15.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\85ab7ce1-3258-4e9b-a0e3-3e50db926871.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\93422060-12de-434b-bf87-254d0ffca119.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\962ced69-1c12-40da-8cbb-f3f48e7b42c7.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

Windows Analysis Report
Invoice#0036473 .xlsx

Name	Malicious	Antivirus Detection	Reputation
https://eyecandylashcompany.com/payment/frontend_paper_lantern/images/office3651.png	true	Avira URL Cloud: phishing	unknown
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://eyecandylashcompany.com/payment/frontend_paper_lantern/images/gmail.png	true	Avira URL Cloud: phishing	unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	true	SlashNext: Credential Stealing type: Phishing & Social Engineering	unknown
https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	true	SlashNext: Credential Stealing type: Phishing & Social Engineering	unknown
https://cdn.pixabay.com/photo/2018/03/10/12/00/paper-3213924_1280.jpg	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://shell.suite.office.com:1443	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://autodiscover-s.outlook.com/	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://code.jquery.com/jquery-3.2.1.slim.min.js	index[1].htm.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://cdn.entity.	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://rpsticket.partnerservices.getmicrosoftkey.com	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://api.aadrm.com/	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false	URL Reputation: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://api.microsoftstream.com/api/	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://cr.office.com	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://kit.fontawesome.com/585b051251.js	index[1].htm.0.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.19.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://officeci.azurewebsites.net/api/	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.19.dr, craw_background.js.19.dr	false		high
https://store.office.cn/addinstemplate	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false	URL Reputation: safe	unknown
https://messaging.engagement.office.com/	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.19.dr, manifest.json.19.dr	false		high
https://lh3.googleusercontent.com	71b843c2-4b70-4ce2-95c8-13f810853f15.tmp.20.dr	false		high
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
http://www.w3.or	splwow64.exe, 00000001.00000003.276970217.0000000003A67000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.277087241.0000000003A6E000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.277056508.0000000003A6D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/groups	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://web.microsoftstream.com/video/	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://api.addins.store.officeppe.com/addinstemplate	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.19.dr	false		high
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://ncus.contentsync.	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false	URL Reputation: safe	unknown
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
http://weather.service.msn.com/data.aspx	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://wus2.contentsync.	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/ios	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.19.dr	false		high
https://play.google.com	c78cfa55-e1b4-4010-b1c1-a509d5123b73.tmp.20.dr, 71b843c2-4b70-4ce2-95c8-13f810853f15.tmp.20.dr	false		high
https://o365auditrealtimeingestion.manage.office.com	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://outlook.office365.com/api/v1.0/me/Activities	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://clients.config.office.net/user/v1.0/android/policies	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://entitlement.diagnostics.office.com	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://outlook.office.com/	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.19.dr	false		high
https://storage.live.com/clientlogs/uploadlocation	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://substrate.office.com/search/api/v1/SearchHistory	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
http://www.w3.o	splwow64.exe, 00000001.00000003.264411903.0000000002E95000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.264135446.0000000002E95000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.265089957.0000000002E95000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.264761149.0000000002E95000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://clients.config.office.net/c2r/v1.0/InteractiveInstallation	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://graph.windows.net/	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://apis.google.com	c78cfa55-e1b4-4010-b1c1-a509d5123b73.tmp.20.dr, 71b843c2-4b70-4ce2-95c8-13f810853f15.tmp.20.dr	false		high
https://devnull.onenote.com	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
http://schemas.microsoft.cA.	splwow64.exe, 00000001.00000003.271415857.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.271136883.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.271110685.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://messaging.office.com/	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://skyapi.live.net/Activity/	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.19.dr	false		high
https://api.cortana.ai	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false	URL Reputation: safe	unknown
https://messaging.action.office.com/setcampaignaction	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://visio.uservoice.com/forums/368202-visio-on-devices	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://code.jquery.com/jquery-3.1.1.min.js	index[1].htm.0.dr	false		high
https://staging.cortana.ai	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/embed?	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://augloop.office.com	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
http://schemas.microsoft.	splwow64.exe, 00000001.00000003.283753202.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.277683100.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.272474325.0000000002E95000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.273848040.000000000397D000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.278650127.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.273927054.0000000003984000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.273448542.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.269980300.0000000002EA3000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.287184725.000000000397D000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.269103306.0000000002EA3000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000002.639688445.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.278038847.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.269711890.0000000002E9F000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.274073249.0000000003989000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.275038745.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.289654276.0000000003984000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.290112416.0000000003989000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.273030293.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.286151322.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.270225205.0000000002EA6000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.269614889.0000000002E95000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_libgcc_a.19.dr, pnacl_public_x86_64_pnacl_llc_nexe.19.dr	false		high
https://api.diagnosticssdf.office.com/v2/file	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://code.jquery.com/jquery-3.3.1.js	index[1].htm.0.dr	false		high
https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://api.diagnostics.office.com	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://store.office.de/addinstemplate	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html2	History Provider Cache.19.dr	true	Avira URL Cloud: phishing	unknown
https://wus2.pagecontentsync.	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/datasets	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://cortana.ai/api	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com	c78cfa55-e1b4-4010-b1c1-a509d5123b73.tmp.20.dr, 71b843c2-4b70-4ce2-95c8-13f810853f15.tmp.20.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_libgcc_a.19.dr, pnacl_public_x86_64_pnacl_llc_nexe.19.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json1.19.dr, manifest.json.19.dr	false		high
https://api.diagnosticssdf.office.com	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://login.microsoftonline.com/	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
http://schemas.mic	splwow64.exe, 00000001.00000003.274869798.0000000002E72000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000001.00000003.277516468.0000000002E72000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://roaming.edog.	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://clients.config.office.net/user/v1.0/tenantassociationkey	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false		high
https://powerlift.acompli.net	231C2286-1237-4321-A2E6-258BBA83D8CD.0.dr	false	URL Reputation: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.18.10.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
142.251.36.205	accounts.google.com	United States	15169	GOOGLEUS	false
142.251.36.238	clients.l.google.com	United States	15169	GOOGLEUS	false
142.251.36.227	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.18.28.243	cdn.iconscout.com	United States	13335	CLOUDFLARENETUS	false
172.64.150.12	cdn.pixabay.com	United States	13335	CLOUDFLARENETUS	false
69.49.244.155	eyecandylashcompany.com	United States	46606	UNIFIEDLAYER-AS-1US	true
172.217.16.161	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	655755
Start date and time: 01/07/202216:27:35	2022-07-01 16:27:35 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Invoice#0036473 .xlsx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.phis.expl.winXLSX@38/128@18/12
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xlsx Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Browse link: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html Scroll down Close Viewer

Match	Associated Sample Name / URL	SHA 256	Detection	Link
104.17.24.14	test@somewhere.com.html	Get hash	malicious	Browse
	Invoice#0036473 .xlsx	Get hash	malicious	Browse
	https://huhulihu.com/	Get hash	malicious	Browse
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#peter.boyd@southside.com	Get hash	malicious	Browse
	https://bip.so/@cvpk/Comp-ZbQsc/Comp-GF67/	Get hash	malicious	Browse
	https://typeyournamehereueuee.zyrosite.com/	Get hash	malicious	Browse
	https://theunfused.be/reactivate/index2.html	Get hash	malicious	Browse
	https://t.co/xvLS8NTzBo	Get hash	malicious	Browse
	https://u27352119.ct.sendgrid.net/ls/click?upn=wmyrTikp4cU6UIreToLK5apa3UVWzls5i-2FnivdzqxJDXieeYhuAfDPrkrYAXhWjT05v1DliJzvFZ-2FrXdWWTtQJtar7d5f45LKMUDkQsF-2FhCOZ1yqNe3s6XzNjygGMsgA5GocRr6RXqtxW4PVFk-2Fpd4dvCNbIBWK4BuFppc8wj6wYdWWkKWGexqKkSDY9kS1UfXnqeVFTSWVDo5tEXEx0GIw-2BcXzdvgg3OprL-2Fex9yzxOPbw1GIMw2f2mk3htVwXnNkUGvjTCdqmdU7LukpDPVR53kuZ-2F7LiipfcsxReKBGQ-3D6ToV_AELWtZjInQuuwQQi428pxLeMEKB6ACloON6bXLSJPk6x1Rv5IRZqeoiu2AIdYoTabUi4-2BVj2BH66zn-2FG9M3s3vQV85T3GkdCn7MTAgY11UdHC5lpqBui4-2BhRM9-2FU2NhMbDfP1ThNXVSMy7-2FODBB0Yct9bvAuZ7ww8xxUmuvx-2BoIFMa-2BmLdFyh3XDDxXMba6nNz7ZJmxt8ZM-2F-2FupIag6Levet5r6l76sorlP5myLYrcSHhAV0Yc-2BcPhmEBFrwkY0W	Get hash	malicious	Browse
	https://5a5edz2o3ugnqdrsidauf23pm3td4wqmlnuq5l7qnu-ipfs-nftstorage-link.translate.goog/?_x_tr_hp=bafkreigasd7iihvg&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp#	Get hash	malicious	Browse
	https://gsuite-dadmomcare.cloud/5rhKVd8%22;//Enter	Get hash	malicious	Browse
	MAERSK##SHIPPING_DOCUMENTS.html	Get hash	malicious	Browse
	https://rebrand.ly/4r2pc8v/#batie@slmlaw.co.za	Get hash	malicious	Browse
	Ach_instructions.hTm	Get hash	malicious	Browse
	https://employmentas-my.sharepoint.com/:o:/g/personal/roxy_employerprotect_com_au/Ek2R_hZAFkJNsMTTpTIyUIIB6QxcToCUDU2EYLrzeglOrA?e=sSX1Ih	Get hash	malicious	Browse
	https://redvector.com	Get hash	malicious	Browse
	https://infograph.venngage.com/pl/62Ho0n746Ag	Get hash	malicious	Browse
	https://krytoninternationalinc-my.sharepoint.com/:f:/g/personal/bnami_kryton_com/EhDLdLgQrLxCn66if43sGLsBf6Ij5ihiOcxREvaqxt_nug?e=jVDghv	Get hash	malicious	Browse
	Overdue Invoice.xlsx	Get hash	malicious	Browse
	https://juanperezu.com/Log%20in/	Get hash	malicious	Browse
104.18.10.207	Invoice#0036473 .xlsx	Get hash	malicious	Browse
	test@somewhere.com.html	Get hash	malicious	Browse
	test@barclays.com.html	Get hash	malicious	Browse
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#giangaddo.prati@barilla.com	Get hash	malicious	Browse
	Invoice#0036473 .xlsx	Get hash	malicious	Browse
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#peter.boyd@southside.com	Get hash	malicious	Browse
	https://www.trekkdesigngroup.online	Get hash	malicious	Browse
	INVOICE SOA 6302022.html	Get hash	malicious	Browse
	https://typeyournamehereueuee.zyrosite.com/	Get hash	malicious	Browse
	https://u27682479.ct.sendgrid.net/ls/click?upn=cvn9ZJclWWM77Z1KQ7AGNLTvG6cbD4GX8IMOUAv7Il0CScb6ZYT3Okqv8ttKWjhV61bU7wZVg-2BRwpPEz5BxnlpZAXxWZhwu4A5T7Xmub5i4-3D8kdN_BQTHDHIGBY8bVXALtPGM7gO667eXi0Rxjw6Ja5tIhIHl4jbBM8FcsT0sDPhrKTJuPA8c0hJbJUedqDm0dZ1N5q6HFPXMyNiqLMnaTKX-2BjvxEQqKmS9AIBthNPL271WvH8x6O0192ihJ9vhKUW-2B1WIoITJImLF7rC2kCSY-2FOeXXbB54AsMvKkV7xrJUut0RtOJ0YkHUdgPc7qyyqcpC6RYNpOh5HCDF73R1mUOTiYID4-3D	Get hash	malicious	Browse
	Statement06292022.html	Get hash	malicious	Browse
	https://theunfused.be/reactivate/index2.html	Get hash	malicious	Browse
	https://sharepdf.info/vs/ab/004bk.shtml?sjones@pfeiffer-vacuum.com+&_x__tr_hl=97	Get hash	malicious	Browse
	https://5a5edz2o3ugnqdrsidauf23pm3td4wqmlnuq5l7qnu-ipfs-nftstorage-link.translate.goog/?_x_tr_hp=bafkreigasd7iihvg&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp#	Get hash	malicious	Browse
	https://62bc10e82f39dc00752b3f25--jocular-speculoos-88b519.netlify.app/#anika@khk.co.za	Get hash	malicious	Browse
	https://gcp.olympus.io/api/v1/share/file/download-via-public-link?linkId=bdaa6e3d-aab8-4e16-8d04-3c7d34d3871c&responseType=file	Get hash	malicious	Browse
	ACH-paymentDetails.htm	Get hash	malicious	Browse
	https://employmentas-my.sharepoint.com/:o:/g/personal/roxy_employerprotect_com_au/Ek2R_hZAFkJNsMTTpTIyUIIB6QxcToCUDU2EYLrzeglOrA?e=sSX1Ih	Get hash	malicious	Browse
	https://infograph.venngage.com/pl/62Ho0n746Ag	Get hash	malicious	Browse
	https://krytoninternationalinc-my.sharepoint.com/:f:/g/personal/bnami_kryton_com/EhDLdLgQrLxCn66if43sGLsBf6Ij5ihiOcxREvaqxt_nug?e=jVDghv	Get hash	malicious	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	ussfe3.exe	Get hash	malicious	Browse	188.114.97.14
	Invoice#0036473 .xlsx	Get hash	malicious	Browse	104.17.25.14
	https://access-payment-request.com	Get hash	malicious	Browse	104.20.185.68
	DATA-5695696.xls	Get hash	malicious	Browse	188.114.96.3
	ukYq0S6e1m	Get hash	malicious	Browse	172.67.211.35
	http://rdpolo.xyz/xLXTqRmT?	Get hash	malicious	Browse	104.21.55.18
	ARCHIVO_86.xls	Get hash	malicious	Browse	188.114.97.3
	https://officesharepoint-microsoft.nimbusweb.me/share/7180759/nrwc6k8nkclqdtv309ot	Get hash	malicious	Browse	104.16.125.175
	https://plate.seamonkey.es/gotodate/go%20seamonkey.es/gotodate/	Get hash	malicious	Browse	172.67.162.247
	Jvcfjyquhiqpaeumsljfzajfmzhrlkhzot.exe	Get hash	malicious	Browse	104.21.15.66
	test@somewhere.com.html	Get hash	malicious	Browse	172.67.38.66
	#U03a4#U0399#U039c#U039f#U039b#U039f#U0393#U0399#U0391 608595.exe	Get hash	malicious	Browse	23.227.38.74
	test@barclays.com.html	Get hash	malicious	Browse	104.17.25.14
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#giangaddo.prati@barilla.com	Get hash	malicious	Browse	104.17.25.14
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#giangaddo.prati@barilla.com	Get hash	malicious	Browse	104.17.25.14
	SecuriteInfo.com.Variant.Zusy.427939.15383.exe	Get hash	malicious	Browse	162.159.134.233
	SecuriteInfo.com.Variant.Zusy.427939.774.exe	Get hash	malicious	Browse	162.159.134.233
	SecuriteInfo.com.Variant.Zusy.427939.11600.exe	Get hash	malicious	Browse	162.159.133.233
	Invoice#0036473 .xlsx	Get hash	malicious	Browse	172.64.150.12
	Invoice#0036473 .xlsx	Get hash	malicious	Browse	104.17.25.14
CLOUDFLARENETUS	ussfe3.exe	Get hash	malicious	Browse	188.114.97.14
	Invoice#0036473 .xlsx	Get hash	malicious	Browse	104.17.25.14
	https://access-payment-request.com	Get hash	malicious	Browse	104.20.185.68
	DATA-5695696.xls	Get hash	malicious	Browse	188.114.96.3
	ukYq0S6e1m	Get hash	malicious	Browse	172.67.211.35
	http://rdpolo.xyz/xLXTqRmT?	Get hash	malicious	Browse	104.21.55.18
	ARCHIVO_86.xls	Get hash	malicious	Browse	188.114.97.3
	https://officesharepoint-microsoft.nimbusweb.me/share/7180759/nrwc6k8nkclqdtv309ot	Get hash	malicious	Browse	104.16.125.175
	https://plate.seamonkey.es/gotodate/go%20seamonkey.es/gotodate/	Get hash	malicious	Browse	172.67.162.247
	Jvcfjyquhiqpaeumsljfzajfmzhrlkhzot.exe	Get hash	malicious	Browse	104.21.15.66
	test@somewhere.com.html	Get hash	malicious	Browse	172.67.38.66
	#U03a4#U0399#U039c#U039f#U039b#U039f#U0393#U0399#U0391 608595.exe	Get hash	malicious	Browse	23.227.38.74
	test@barclays.com.html	Get hash	malicious	Browse	104.17.25.14
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#giangaddo.prati@barilla.com	Get hash	malicious	Browse	104.17.25.14
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#giangaddo.prati@barilla.com	Get hash	malicious	Browse	104.17.25.14
	SecuriteInfo.com.Variant.Zusy.427939.15383.exe	Get hash	malicious	Browse	162.159.134.233
	SecuriteInfo.com.Variant.Zusy.427939.774.exe	Get hash	malicious	Browse	162.159.134.233
	SecuriteInfo.com.Variant.Zusy.427939.11600.exe	Get hash	malicious	Browse	162.159.133.233
	Invoice#0036473 .xlsx	Get hash	malicious	Browse	172.64.150.12
	Invoice#0036473 .xlsx	Get hash	malicious	Browse	104.17.25.14

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	Invoice#0036473 .xlsx	Get hash	malicious	Browse	69.49.244.155
	Overdue Invoice.xlsx	Get hash	malicious	Browse	69.49.244.155
	hOdgEiePTe.exe	Get hash	malicious	Browse	69.49.244.155
	5DCF34F35A1874D190C81C7197785C4F4F9305842918F.exe	Get hash	malicious	Browse	69.49.244.155
	55M44d3Fux.exe	Get hash	malicious	Browse	69.49.244.155
	d8tlgwSs5C.exe	Get hash	malicious	Browse	69.49.244.155
	8800-confirmation.docx	Get hash	malicious	Browse	69.49.244.155
	Overdue Invoice.xlsx	Get hash	malicious	Browse	69.49.244.155
	PelicanPipeline Gathering 28.06.2022.xlsx	Get hash	malicious	Browse	69.49.244.155
	Magniber10.msi	Get hash	malicious	Browse	69.49.244.155
	windows_update.exe	Get hash	malicious	Browse	69.49.244.155
	Setup_L3100_x64_261JAHomeExportAsiaML.exe	Get hash	malicious	Browse	69.49.244.155
	eVoucher.js	Get hash	malicious	Browse	69.49.244.155
	ibew_local_30_contract_negotiations (mj).js	Get hash	malicious	Browse	69.49.244.155
	ibew_local_30_contract_negotiations (mj).js	Get hash	malicious	Browse	69.49.244.155
	ibew_local_30_contract_negotiations (mj).js	Get hash	malicious	Browse	69.49.244.155
	ibew_local_30_contract_negotiations (mj).js	Get hash	malicious	Browse	69.49.244.155
	Nordre Follo_MomSmartClient_x64.msi	Get hash	malicious	Browse	69.49.244.155
	SecuriteInfo.com.W32.AIDetectNet.01.16376.exe	Get hash	malicious	Browse	69.49.244.155
	graphic.vbs	Get hash	malicious	Browse	69.49.244.155
37f463bf4616ecd445d4a1937da06e19	kCOumBbsqj.exe	Get hash	malicious	Browse	172.217.16.161 69.49.244.155
	kCOumBbsqj.exe	Get hash	malicious	Browse	172.217.16.161 69.49.244.155
	Jvcfjyquhiqpaeumsljfzajfmzhrlkhzot.exe	Get hash	malicious	Browse	172.217.16.161 69.49.244.155
	fUw7YerT47.exe	Get hash	malicious	Browse	172.217.16.161 69.49.244.155
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#giangaddo.prati@barilla.com	Get hash	malicious	Browse	172.217.16.161 69.49.244.155
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#giangaddo.prati@barilla.com	Get hash	malicious	Browse	172.217.16.161 69.49.244.155
	SecuriteInfo.com.Variant.Zusy.427939.15383.exe	Get hash	malicious	Browse	172.217.16.161 69.49.244.155
	SecuriteInfo.com.Variant.Zusy.427939.774.exe	Get hash	malicious	Browse	172.217.16.161 69.49.244.155
	SecuriteInfo.com.Variant.Zusy.427939.11600.exe	Get hash	malicious	Browse	172.217.16.161 69.49.244.155
	Invoice#0036473 .xlsx	Get hash	malicious	Browse	172.217.16.161 69.49.244.155
	VbB5NfogWg.exe	Get hash	malicious	Browse	172.217.16.161 69.49.244.155
	COA_PL_INV_BL_098765432123456789098765.exe	Get hash	malicious	Browse	172.217.16.161 69.49.244.155
	https://huhulihu.com/	Get hash	malicious	Browse	172.217.16.161 69.49.244.155
	https://url.us.downloadthisdoc.com/VMbMGuQw	Get hash	malicious	Browse	172.217.16.161 69.49.244.155
	2.exe	Get hash	malicious	Browse	172.217.16.161 69.49.244.155
	auth.dll	Get hash	malicious	Browse	172.217.16.161 69.49.244.155
	auth.dll	Get hash	malicious	Browse	172.217.16.161 69.49.244.155
	https://avlaw.knorish.com/page/index-new	Get hash	malicious	Browse	172.217.16.161 69.49.244.155
	http://littlebohemialodge.com	Get hash	malicious	Browse	172.217.16.161 69.49.244.155
	SecuriteInfo.com.IL.Trojan.MSILMamut.4668.22121.exe	Get hash	malicious	Browse	172.217.16.161 69.49.244.155

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\1828_1378596767\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	http://185.220.101.42	Get hash	malicious	Browse
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#giangaddo.prati@barilla.com	Get hash	malicious	Browse
	http://go6shde9nj2itle.com	Get hash	malicious	Browse
	https://onedrive.live.com/download?cid=37A36B3E00F60E1D&resid=37A36B3E00F60E1D%21113&authkey=ABug1-ZXu03Es0Q	Get hash	malicious	Browse
	https://url.us.downloadthisdoc.com/VMbMGuQw	Get hash	malicious	Browse
	office365 Validation.html	Get hash	malicious	Browse
	Imax_SUMMARY.html	Get hash	malicious	Browse
	INVOICE SOA 6302022.html	Get hash	malicious	Browse
	Payee_Request_form.htm	Get hash	malicious	Browse
	EmergReport_864544.html	Get hash	malicious	Browse
	https://forms.gle/UUWec3HjgemxRctM9	Get hash	malicious	Browse
	http://www.pvdhe.hshtmd.com/__;!!A7Wh3DodPb6TU6U!xwTrd98gWq2kFIzEuKyoPx7ZC2UqLh5Y-uFQvvPxftYIjEHCbZJZRblCLReGN63mr5x_sNBPIeM082M9_MxR$	Get hash	malicious	Browse
	https://gcp.olympus.io/api/v1/share/file/download-via-public-link?linkId=bdaa6e3d-aab8-4e16-8d04-3c7d34d3871c&responseType=file	Get hash	malicious	Browse
	ACH-paymentDetails.htm	Get hash	malicious	Browse
	Sales Invoice.html	Get hash	malicious	Browse
	blog.html	Get hash	malicious	Browse
	message 4479067490.htm	Get hash	malicious	Browse
	#A002.html	Get hash	malicious	Browse
	Ach_instructions.hTm	Get hash	malicious	Browse
	message.html	Get hash	malicious	Browse

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	high, very likely benign file
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	149155
Entropy (8bit):	5.356510256155895
Encrypted:	false
SSDEEP:	1536:9cQW/gxgB5BQguw5/Q9DQC+zQWk4F77nXmvid3Xx5ETLKz6e:sJQ9DQC+zPXwI
MD5:	BD30738058D1BB89A9729682E2BC0925
SHA1:	02B8BD201128A288DAFB06A2E772685EA2A3388B
SHA-256:	2F749FD024D6222D14096E5E079FD1A34B3431573A2C9E2AC7797D7F44E2F3BB
SHA-512:	7BA656472EDD5AE092781D47DE985BCEA4C98EB7B3494ADE9FA18B2D4BFDB64B8D1D69DC90BB91F9D39146F0217023AC2985ED0803E8D904FEE7BD8CA3371000
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2022-07-01T14:28:43">.. Build: 16.0.15427.30526-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o: