Windows Analysis Report
PO_OCF 408.xls

Overview

General Information

Sample name: PO_OCF 408.xls
Analysis ID: 1416056
MD5: b1b6a921c32d375e2bc145aabc5590ed
SHA1: df721ea78886ba9fa47e0b4ff172cff71d3eac65
SHA256: 6d0082a6aaeb5d47a2083d5b416c7b7e906c9e25e0f1f1c92a9ae44ae6f38b9f
Tags: HUNxls
Infos:

Detection

Score: 88
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Microsoft Office drops suspicious files
Office drops RTF file
Office viewer loads remote template
Yara detected MalDoc
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Uses a known web browser user agent for HTTP communication
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\9926F9FC.doc Avira: detection malicious, Label: HEUR/Rtf.Malformed
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\decloverkissingeverygirlwholoverhimtrulyfromthehearttounderstanhowmuchloverkisss___uwanttofhugmeanddoallthingswithmeiwat[1].doc Avira: detection malicious, Label: HEUR/Rtf.Malformed
Multi AV Scanner detection for submitted file
Source: PO_OCF 408.xls ReversingLabs: Detection: 23%
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 13.107.213.40:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.213.40:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.213.40:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.4:49771 version: TLS 1.2

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: 2s.gg
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49775 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49776 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49773 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49777 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49778 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49771 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49751 -> 13.107.213.40:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49771 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49771 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49773 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49773 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49775 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49775 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49771 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49775 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49773 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49775 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49775 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49775 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49776 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49776 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49776 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49775 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49775 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49775 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49777 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49777 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49777 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49778 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49778 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49778 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49776 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49776 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49773 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49773 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49773 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49777 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49777 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49778 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49778 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49776 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49776 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49776 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49777 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49777 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49777 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49778 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49778 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49778 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49773 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49773 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49771 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49771 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49771 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49771 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49771 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49771 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.4:49751 -> 13.107.213.40:80
Source: global traffic TCP traffic: 13.107.213.40:80 -> 192.168.2.4:49751
Source: global traffic TCP traffic: 192.168.2.4:49751 -> 13.107.213.40:80
Source: global traffic TCP traffic: 192.168.2.4:49751 -> 13.107.213.40:80
Source: global traffic TCP traffic: 13.107.213.40:80 -> 192.168.2.4:49751
Source: global traffic TCP traffic: 13.107.213.40:80 -> 192.168.2.4:49751
Source: global traffic TCP traffic: 192.168.2.4:49751 -> 13.107.213.40:80
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49752
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49752
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49752
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49752
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49752
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49752
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49752
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49752
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49752
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49752
Source: global traffic TCP traffic: 192.168.2.4:49752 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.213.40:80
Source: global traffic TCP traffic: 13.107.213.40:80 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.213.40:80
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.213.40:80
Source: global traffic TCP traffic: 13.107.213.40:80 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 13.107.213.40:80 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.213.40:80
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.213.40:80
Source: global traffic TCP traffic: 13.107.213.40:80 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.213.40:80
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.213.40:80
Source: global traffic TCP traffic: 13.107.213.40:80 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 13.107.213.40:80 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.213.40:80
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.213.40:80
Source: global traffic TCP traffic: 13.107.213.40:80 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.213.40:80
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.213.40:80
Source: global traffic TCP traffic: 13.107.213.40:80 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.213.40:80
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.213.40:80
Source: global traffic TCP traffic: 13.107.213.40:80 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.213.40:80
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.213.40:80
Source: global traffic TCP traffic: 13.107.213.40:80 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.213.40:80
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.213.40:80
Source: global traffic TCP traffic: 13.107.213.40:80 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.213.40:443
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.213.40:443
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.213.40:80
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.213.40:443
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.213.40:443
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.213.40:443
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.213.40:443
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.213.40:80
Source: global traffic TCP traffic: 13.107.213.40:80 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.213.40:80
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 13.107.213.40:443 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.213.40:443
Source: global traffic TCP traffic: 198.46.173.145:80 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 198.46.173.145:80
Source: global traffic TCP traffic: 192.168.2.4:49771 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49771
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49772
Source: global traffic TCP traffic: 192.168.2.4:49771 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49773 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49773
Source: global traffic TCP traffic: 192.168.2.4:49773 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49775 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49775
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49774
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49775 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49771 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49771
Source: global traffic TCP traffic: 192.168.2.4:49775 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49775
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49772
Source: global traffic TCP traffic: 192.168.2.4:49773 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49773
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49774
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49774
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49774
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49774
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49774
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49775
Source: global traffic TCP traffic: 192.168.2.4:49775 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49775 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49775
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49775
Source: global traffic TCP traffic: 192.168.2.4:49775 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49772
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49772
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49772
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49775
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49772
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49774
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49774
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49774 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49774
Source: global traffic TCP traffic: 192.168.2.4:49776 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49776
Source: global traffic TCP traffic: 192.168.2.4:49776 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49776 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49776
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49775
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49775
Source: global traffic TCP traffic: 192.168.2.4:49775 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49775 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49775 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49775
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49775
Source: global traffic TCP traffic: 192.168.2.4:49777 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49777
Source: global traffic TCP traffic: 192.168.2.4:49777 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49777 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49777
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49772
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49772
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49772
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49772
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49772
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49772
Source: global traffic TCP traffic: 192.168.2.4:49778 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49778
Source: global traffic TCP traffic: 192.168.2.4:49778 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49778 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49778
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49776
Source: global traffic TCP traffic: 192.168.2.4:49776 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49776
Source: global traffic TCP traffic: 192.168.2.4:49776 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49776
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49773
Source: global traffic TCP traffic: 192.168.2.4:49773 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49773 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49773
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49773
Source: global traffic TCP traffic: 192.168.2.4:49773 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49773
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49777
Source: global traffic TCP traffic: 192.168.2.4:49777 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49777
Source: global traffic TCP traffic: 192.168.2.4:49777 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49777
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49778
Source: global traffic TCP traffic: 192.168.2.4:49778 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49778
Source: global traffic TCP traffic: 192.168.2.4:49778 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49778
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49776
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49776
Source: global traffic TCP traffic: 192.168.2.4:49776 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49776 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49776
Source: global traffic TCP traffic: 192.168.2.4:49776 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49776
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49779
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49779
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49777
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49777
Source: global traffic TCP traffic: 192.168.2.4:49777 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49777 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49777
Source: global traffic TCP traffic: 192.168.2.4:49777 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49777
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49780
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49780
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49778
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49778
Source: global traffic TCP traffic: 192.168.2.4:49778 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49778 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49778
Source: global traffic TCP traffic: 192.168.2.4:49778 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49778
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49773
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49773
Source: global traffic TCP traffic: 192.168.2.4:49773 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49773 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49773
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49779
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49779
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49779
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49780
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49780
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49780
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49779
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49779
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49779
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49779
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49780
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49780
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49780
Source: global traffic TCP traffic: 192.168.2.4:49780 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49780
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49771
Source: global traffic TCP traffic: 192.168.2.4:49771 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49771 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49771
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49771
Source: global traffic TCP traffic: 192.168.2.4:49771 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49771
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49771
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49771
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49771
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49771
Source: global traffic TCP traffic: 192.168.2.4:49771 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49771 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.4:49771 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49771
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.4:49771
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49838
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49838
Source: global traffic TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49838
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49838
Source: global traffic TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49838
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49838
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49838
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49839
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49839
Source: global traffic TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49838
Source: global traffic TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49838
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49839
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49839
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49839
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49839
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49839
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49839
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49838 -> 23.48.8.182:443
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49839
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49839
Source: global traffic TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49838
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49839 -> 34.237.241.83:443
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49839
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49840
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49840
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49840
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49840
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49840
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49840
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49840
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49840
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49840
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49840
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49840
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 192.168.2.4:49840 -> 34.237.241.83:443
Source: global traffic TCP traffic: 34.237.241.83:443 -> 192.168.2.4:49840
Source: excel.exe Memory has grown: Private usage: 2MB later: 87MB
Source: winword.exe Memory has grown: Private usage: 6MB later: 90MB

Networking
barindex
Yara detected MalDoc
Source: Yara match File source: PO_OCF 408.xls, type: SAMPLE
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View IP Address: 23.48.8.182 23.48.8.182
Source: Joe Sandbox View IP Address: 13.107.213.40 13.107.213.40
Source: Joe Sandbox View IP Address: 34.237.241.83 34.237.241.83
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /42Q HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: 2s.gg
Source: global traffic HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic HTTP traffic detected: OPTIONS /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-aliveAccept: */*Access-Control-Request-Method: GETAccess-Control-Request-Headers: x-adobe-uuid,x-adobe-uuid-type,x-api-keyOrigin: https://rna-resource.acrobat.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, */*; q=0.01x-adobe-uuid: a4ecfc44-3976-4051-8c45-0a7e26b55a37x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic HTTP traffic detected: GET /42Q HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 2s.ggConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /uhh/decloverkissingeverygirlwholoverhimtrulyfromthehearttounderstanhowmuchloverkisss___uwanttofhugmeanddoallthingswithmeiwat.doc HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.173.145
Source: global traffic HTTP traffic detected: GET /42Q HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: 2s.gg
Source: global traffic HTTP traffic detected: GET /rules/rule324002v5s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324001v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule170012v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324003v5s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule490016v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324004v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324005v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324006v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324007v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule63067v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, */*; q=0.01x-adobe-uuid: a4ecfc44-3976-4051-8c45-0a7e26b55a37x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic HTTP traffic detected: GET /42Q HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 2s.ggConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /uhh/decloverkissingeverygirlwholoverhimtrulyfromthehearttounderstanhowmuchloverkisss___uwanttofhugmeanddoallthingswithmeiwat.doc HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: 198.46.173.145
Source: unknown DNS traffic detected: queries for: 2s.gg
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 26 Mar 2024 18:47:22 GMTConnection: closeRequest-Context: appId=cid-v1:0bb8aee4-4d8f-4288-aeeb-9e507a8e16a0set-cookie: ASLBSA=0003da390de5eb0bbb0673bfe55fc10c1a87b259cd1fdb79892b42ace0b34d2f5724; Path=/; HttpOnly;set-cookie: ASLBSACORS=0003da390de5eb0bbb0673bfe55fc10c1a87b259cd1fdb79892b42ace0b34d2f5724; SameSite=none; Path=/; Secure; HttpOnly;x-azure-ref: 20240326T184722Z-p0xkymecrd0p592mkmuameu7y8000000066g00000000aztmx-fd-int-roxy-purgeid: 0X-Cache: TCP_MISS
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 26 Mar 2024 18:47:23 GMTConnection: closeRequest-Context: appId=cid-v1:0bb8aee4-4d8f-4288-aeeb-9e507a8e16a0x-azure-ref: 20240326T184723Z-kpa2qyfm7h4zzee0m0847vqhtc00000005ug00000000x98cx-fd-int-roxy-purgeid: 0X-Cache: TCP_MISS
Source: PO_OCF 408.xls String found in binary or memory: http://2s.gg/42Q
Source: A2E30000.0.dr String found in binary or memory: http://2s.gg/42QyX
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.0.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown HTTPS traffic detected: 13.107.213.40:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.213.40:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.213.40:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.4:49771 version: TLS 1.2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\9926F9FC.doc, type: DROPPED Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\decloverkissingeverygirlwholoverhimtrulyfromthehearttounderstanhowmuchloverkisss___uwanttofhugmeanddoallthingswithmeiwat[1].doc, type: DROPPED Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Excel sheet contains many unusual embedded objects
Source: PO_OCF 408.xls OLE: Microsoft Excel 2007+
Source: ~DFAE5F8EC769A893FF.TMP.0.dr OLE: Microsoft Excel 2007+
Source: A2E30000.0.dr OLE: Microsoft Excel 2007+
Microsoft Office drops suspicious files
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\42Q.url Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\2s.gg.url Jump to behavior
Document contains embedded VBA macros
Source: PO_OCF 408.xls OLE indicator, VBA macros: true
Source: gostname.xsl.5.dr OLE indicator, VBA macros: true
Source: mlaseventheditionofficeonline.xsl.5.dr OLE indicator, VBA macros: true
Source: ieee2006officeonline.xsl.5.dr OLE indicator, VBA macros: true
Source: gosttitle.xsl.5.dr OLE indicator, VBA macros: true
Source: iso690nmerical.xsl.5.dr OLE indicator, VBA macros: true
Source: turabian.xsl.5.dr OLE indicator, VBA macros: true
Source: iso690.xsl.5.dr OLE indicator, VBA macros: true
Source: CatalogCacheMetaData.xml.5.dr OLE indicator, VBA macros: true
Source: APASixthEditionOfficeOnline.xsl.5.dr OLE indicator, VBA macros: true
Source: gb.xsl.5.dr OLE indicator, VBA macros: true
Source: harvardanglia2008officeonline.xsl.5.dr OLE indicator, VBA macros: true
Source: chicago.xsl.5.dr OLE indicator, VBA macros: true
Source: sist02.xsl.5.dr OLE indicator, VBA macros: true
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~DFAE5F8EC769A893FF.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gostname.xsl.5.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: mlaseventheditionofficeonline.xsl.5.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ieee2006officeonline.xsl.5.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gosttitle.xsl.5.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690nmerical.xsl.5.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: turabian.xsl.5.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690.xsl.5.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: CatalogCacheMetaData.xml.5.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: APASixthEditionOfficeOnline.xsl.5.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{A660A4ED-24EC-48F4-80ED-856333681C2C}.tmp.5.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gb.xsl.5.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: harvardanglia2008officeonline.xsl.5.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: chicago.xsl.5.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: sist02.xsl.5.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Yara signature match
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\9926F9FC.doc, type: DROPPED Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\decloverkissingeverygirlwholoverhimtrulyfromthehearttounderstanhowmuchloverkisss___uwanttofhugmeanddoallthingswithmeiwat[1].doc, type: DROPPED Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: classification engine Classification label: mal88.troj.expl.evad.winXLS@20/331@1/5
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B9A86F15.emf Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\{77834CAE-D31F-4E4A-8748-2F30596B26B8} - OProcSessId.dat Jump to behavior
Source: Insight design set.dotx.5.dr OLE indicator, Word Document stream: true
Source: Equations.dotx.5.dr OLE indicator, Word Document stream: true
Source: Text Sidebar (Annual Report Red and Black design).docx.5.dr OLE indicator, Word Document stream: true
Source: Element design set.dotx.5.dr OLE indicator, Word Document stream: true
Source: ~WRD0000.tmp.5.dr OLE indicator, Word Document stream: true
Source: PO_OCF 408.xls OLE indicator, Workbook stream: true
Source: A2E30000.0.dr OLE indicator, Workbook stream: true
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA
Source: PO_OCF 408.xls ReversingLabs: Detection: 23%
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" -Embedding
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1380,i,8862981173125426309,5489403799526869993,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Desktop\PO_OCF 408.xls"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1380,i,8862981173125426309,5489403799526869993,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: Templates.LNK.5.dr LNK file: ..\..\Templates
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Insight design set.dotx.5.dr Initial sample: OLE zip file path = word/media/image2.jpg
Source: Insight design set.dotx.5.dr Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Insight design set.dotx.5.dr Initial sample: OLE zip file path = word/glossary/document.xml
Source: Insight design set.dotx.5.dr Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Insight design set.dotx.5.dr Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Insight design set.dotx.5.dr Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Insight design set.dotx.5.dr Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.5.dr Initial sample: OLE zip file path = word/media/image10.jpeg
Source: Insight design set.dotx.5.dr Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Insight design set.dotx.5.dr Initial sample: OLE zip file path = customXml/item2.xml
Source: Insight design set.dotx.5.dr Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Insight design set.dotx.5.dr Initial sample: OLE zip file path = [trash]/0000.dat
Source: Insight design set.dotx.5.dr Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.5.dr Initial sample: OLE zip file path = word/glossary/document.xml
Source: Equations.dotx.5.dr Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Equations.dotx.5.dr Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Equations.dotx.5.dr Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Equations.dotx.5.dr Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.5.dr Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Equations.dotx.5.dr Initial sample: OLE zip file path = customXml/item2.xml
Source: Equations.dotx.5.dr Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Equations.dotx.5.dr Initial sample: OLE zip file path = [trash]/0000.dat
Source: Equations.dotx.5.dr Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Equations.dotx.5.dr Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Equations.dotx.5.dr Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.5.dr Initial sample: OLE zip file path = word/theme/_rels/theme1.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.5.dr Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.5.dr Initial sample: OLE zip file path = word/glossary/document.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.5.dr Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.5.dr Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.5.dr Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.5.dr Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.5.dr Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.5.dr Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.5.dr Initial sample: OLE zip file path = customXml/item2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.5.dr Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.5.dr Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.5.dr Initial sample: OLE zip file path = customXml/item3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.5.dr Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.5.dr Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.5.dr Initial sample: OLE zip file path = [trash]/0000.dat
Source: Text Sidebar (Annual Report Red and Black design).docx.5.dr Initial sample: OLE zip file path = docProps/custom.xml
Source: Element design set.dotx.5.dr Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Element design set.dotx.5.dr Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Element design set.dotx.5.dr Initial sample: OLE zip file path = word/glossary/document.xml
Source: Element design set.dotx.5.dr Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Element design set.dotx.5.dr Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Element design set.dotx.5.dr Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Element design set.dotx.5.dr Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Element design set.dotx.5.dr Initial sample: OLE zip file path = customXml/item2.xml
Source: Element design set.dotx.5.dr Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Element design set.dotx.5.dr Initial sample: OLE zip file path = [trash]/0000.dat
Source: Element design set.dotx.5.dr Initial sample: OLE zip file path = docProps/custom.xml
Source: ~WRD0000.tmp.5.dr Initial sample: OLE zip file path = word/glossary/document.xml
Source: ~WRD0000.tmp.5.dr Initial sample: OLE zip file path = word/glossary/settings.xml
Source: ~WRD0000.tmp.5.dr Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: ~WRD0000.tmp.5.dr Initial sample: OLE zip file path = word/glossary/styles.xml
Source: ~WRD0000.tmp.5.dr Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: ~WRD0000.tmp.5.dr Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll Jump to behavior
Source: ~DFAE5F8EC769A893FF.TMP.0.dr Initial sample: OLE indicators vbamacros = False
Source: PO_OCF 408.xls Initial sample: OLE indicators encrypted = True

Persistence and Installation Behavior
barindex
Office drops RTF file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File dump: decloverkissingeverygirlwholoverhimtrulyfromthehearttounderstanhowmuchloverkisss___uwanttofhugmeanddoallthingswithmeiwat[1].doc.0.dr Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE File dump: 9926F9FC.doc.5.dr Jump to dropped file
Office viewer loads remote template
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Section loaded: netapi32.dll and davhlpr.dll loaded Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: PO_OCF 408.xls Stream path 'MBD000A282D/CONTENTS' entropy: 7.9671168067 (max. 8.0)
Source: PO_OCF 408.xls Stream path 'Workbook' entropy: 7.99543645219 (max. 8.0)
Source: A2E30000.0.dr Stream path 'MBD000A282D/CONTENTS' entropy: 7.9671168067 (max. 8.0)
Source: A2E30000.0.dr Stream path 'Workbook' entropy: 7.99775916358 (max. 8.0)
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\splwow64.exe Window / User API: threadDelayed 591 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\splwow64.exe Last function: Thread delayed
Source: C:\Windows\splwow64.exe Last function: Thread delayed
Source: C:\Windows\splwow64.exe Thread delayed: delay time: 120000 Jump to behavior
Source: C:\Windows\splwow64.exe Thread delayed: delay time: 120000 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information queried: ProcessInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1416056 Sample: PO_OCF 408.xls Startdate: 26/03/2024 Architecture: WINDOWS Score: 88 36 2s.gg 2->36 38 templatesmetadata.office.net 2->38 40 2 other IPs or domains 2->40 56 Malicious sample detected (through community Yara rule) 2->56 58 Antivirus detection for dropped file 2->58 60 Multi AV Scanner detection for submitted file 2->60 62 4 other signatures 2->62 9 EXCEL.EXE 148 85 2->9         started        13 EXCEL.EXE 2->13         started        signatures3 process4 dnsIp5 42 2s.gg 13.107.213.40, 443, 49751, 49752 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 9->42 44 part-0012.t-0009.t-msedge.net 13.107.246.40, 443, 49771, 49772 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 9->44 46 198.46.173.145, 49754, 80 AS-COLOCROSSINGUS United States 9->46 28 decloverkissingeve...gswithmeiwat[1].doc, Rich 9->28 dropped 15 WINWORD.EXE 166 492 9->15         started        19 Acrobat.exe 9->19         started        file6 process7 file8 30 C:\Users\user\AppData\Roaming\...\42Q.url, MS 15->30 dropped 32 C:\Users\user\AppData\Roaming\...\2s.gg.url, MS 15->32 dropped 34 C:\Users\user\AppData\Local\...\9926F9FC.doc, Rich 15->34 dropped 52 Office viewer loads remote template 15->52 54 Microsoft Office drops suspicious files 15->54 21 splwow64.exe 15->21         started        23 AcroCEF.exe 19->23         started        signatures9 process10 process11 25 AcroCEF.exe 23->25         started        dnsIp12 48 34.237.241.83, 443, 49839, 49840 AMAZON-AESUS United States 25->48 50 23.48.8.182, 443, 49838 AKAMAI-ASN1EU United States 25->50
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.107.246.40
 part-0012.t-0009.t-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
23.48.8.182
 unknown United States
20940 AKAMAI-ASN1EU false
198.46.173.145
 unknown United States
36352 AS-COLOCROSSINGUS false
13.107.213.40
 2s.gg United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS true
34.237.241.83
 unknown United States
14618 AMAZON-AESUS false

Contacted Domains

Name IP Active
2s.gg 13.107.213.40 true
part-0012.t-0009.t-msedge.net 13.107.246.40 true
windowsupdatebg.s.llnwi.net 69.164.0.0 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://198.46.173.145/uhh/decloverkissingeverygirlwholoverhimtrulyfromthehearttounderstanhowmuchloverkisss___uwanttofhugmeanddoallthingswithmeiwat.doc false
  • Avira URL Cloud: safe
 unknown
https://2s.gg/42Q false
  • Avira URL Cloud: safe
 unknown
http://2s.gg/42Q false
  • Avira URL Cloud: safe
 unknown