Windows Analysis Report
The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm

Overview

General Information

Sample name: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm
Analysis ID: 1436902
MD5: 6c86ceb49a516016dda2a9961e338994
SHA1: afc1ae869d80ea4308d8baadffeef20bde1ae8d8
SHA256: b03ebac15936db789a07a893e975adb2612ca07877d04d540871e54c9d9169f0
Infos:

Detection

Score: 5
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Signatures

Abnormal high CPU Usage
Document contains embedded VBA macros
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections

Classification

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.6:49738 version: TLS 1.2
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49739 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49741 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49738 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49742 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49743 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49745 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49744 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49746 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49738 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49738 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49739 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49739 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49741 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49741 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49738 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49739 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49741 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49741 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49741 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49739 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49739 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49738 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49738 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49739 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49741 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49738 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49738 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49741 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49741 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49741 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49738 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49738 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49739 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49739 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49739 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49742 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49742 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49742 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49743 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49743 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49743 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49744 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49744 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49744 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49745 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49745 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49745 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49746 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49746 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49746 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49742 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49742 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49743 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49743 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49745 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49745 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49744 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49744 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49742 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49742 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49742 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49746 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49746 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49743 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49743 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49743 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49745 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49745 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49745 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49744 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49744 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49744 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49746 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49746 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49746 -> 13.107.246.41:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49738 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49738
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49737
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49738 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49739 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49739
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49740
Source: global traffic TCP traffic: 192.168.2.6:49739 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49741 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49741
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49737
Source: global traffic TCP traffic: 192.168.2.6:49741 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49740
Source: global traffic TCP traffic: 192.168.2.6:49738 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49738
Source: global traffic TCP traffic: 192.168.2.6:49739 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49739
Source: global traffic TCP traffic: 192.168.2.6:49741 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49741
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49741
Source: global traffic TCP traffic: 192.168.2.6:49741 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49740
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49741 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49741
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49741
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49740
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49740
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49739
Source: global traffic TCP traffic: 192.168.2.6:49739 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49739 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49739
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49739
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49737
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49737
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49737
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49738
Source: global traffic TCP traffic: 192.168.2.6:49738 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49738 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49738
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49738
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49739 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49741 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49738 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49739
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49740
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49738
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49741
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49737
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49738
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49738
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49738
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49740
Source: global traffic TCP traffic: 192.168.2.6:49738 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49740
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49741
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49741
Source: global traffic TCP traffic: 192.168.2.6:49741 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49741 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49741 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49741
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49740
Source: global traffic TCP traffic: 192.168.2.6:49740 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49740
Source: global traffic TCP traffic: 192.168.2.6:49738 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49738 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49738
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49738
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49739
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49739
Source: global traffic TCP traffic: 192.168.2.6:49739 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49739 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49739
Source: global traffic TCP traffic: 192.168.2.6:49739 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49739
Source: global traffic TCP traffic: 192.168.2.6:49742 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49742
Source: global traffic TCP traffic: 192.168.2.6:49742 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49742 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49742
Source: global traffic TCP traffic: 192.168.2.6:49743 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49743
Source: global traffic TCP traffic: 192.168.2.6:49743 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49743 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49743
Source: global traffic TCP traffic: 192.168.2.6:49744 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49744
Source: global traffic TCP traffic: 192.168.2.6:49744 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49744 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49744
Source: global traffic TCP traffic: 192.168.2.6:49745 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49745
Source: global traffic TCP traffic: 192.168.2.6:49745 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49745 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49745
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49737
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49737
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49737
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49737
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49737
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49737
Source: global traffic TCP traffic: 192.168.2.6:49737 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49746 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49746
Source: global traffic TCP traffic: 192.168.2.6:49746 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49746 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49746
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49742
Source: global traffic TCP traffic: 192.168.2.6:49742 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49742
Source: global traffic TCP traffic: 192.168.2.6:49742 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49742
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49743
Source: global traffic TCP traffic: 192.168.2.6:49743 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49743
Source: global traffic TCP traffic: 192.168.2.6:49743 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49743
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49745
Source: global traffic TCP traffic: 192.168.2.6:49745 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49745
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49744
Source: global traffic TCP traffic: 192.168.2.6:49745 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49745
Source: global traffic TCP traffic: 192.168.2.6:49744 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49744
Source: global traffic TCP traffic: 192.168.2.6:49744 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49744
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49742
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49742
Source: global traffic TCP traffic: 192.168.2.6:49742 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49742 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49742
Source: global traffic TCP traffic: 192.168.2.6:49742 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49742
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49746
Source: global traffic TCP traffic: 192.168.2.6:49746 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49746
Source: global traffic TCP traffic: 192.168.2.6:49746 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49746
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49743
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49743
Source: global traffic TCP traffic: 192.168.2.6:49743 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49743 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49743
Source: global traffic TCP traffic: 192.168.2.6:49743 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49743
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49745
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49745
Source: global traffic TCP traffic: 192.168.2.6:49745 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49745 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49745 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49745
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49745
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49744
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49744
Source: global traffic TCP traffic: 192.168.2.6:49744 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49744 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49744
Source: global traffic TCP traffic: 192.168.2.6:49744 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49744
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49746
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49746
Source: global traffic TCP traffic: 192.168.2.6:49746 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.6:49746 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49746
Source: global traffic TCP traffic: 192.168.2.6:49746 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.6:49746
Source: excel.exe Memory has grown: Private usage: 2MB later: 158MB
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 13.107.246.41 13.107.246.41
Source: Joe Sandbox View IP Address: 13.107.246.41 13.107.246.41
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: global traffic HTTP traffic detected: GET /rules/rule63067v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324001v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule490016v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324002v5s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule170012v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324003v5s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324004v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324006v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324005v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324007v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.6:49738 version: TLS 1.2
Abnormal high CPU Usage
Source: C:\Windows\splwow64.exe Process Stats: CPU usage > 49%
Document contains embedded VBA macros
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm OLE indicator, VBA macros: true
Source: classification engine Classification label: clean5.winXLSM@3/1@0/1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File created: C:\Users\user\Desktop\~$The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\{7F2A23D7-C6AA-46B8-8A02-29330A9CC105} - OProcSessId.dat Jump to behavior
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm OLE indicator, Workbook stream: true
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{AC9F2F90-E877-11CE-9F68-00AA00574A4F}\InprocServer32 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Window found: window name: SysTabControl32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet4.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet5.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet6.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet7.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet8.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet9.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet10.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet11.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet12.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet13.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet14.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet15.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet16.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet17.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet18.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet19.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet20.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet21.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet22.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet23.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet24.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet25.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet26.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet27.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet28.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet29.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet30.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet31.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet32.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet33.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet34.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet35.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet36.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet37.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet38.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet39.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet40.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet41.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet42.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/_rels/drawing6.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/_rels/chart1.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/_rels/chart2.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing2.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/_rels/chart6.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing3.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/media/image2.png
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/media/image4.png
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/_rels/chart7.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/_rels/chart8.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/_rels/chart9.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing4.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing5.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing6.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/chart1.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/style1.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/colors1.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/chart2.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/style2.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/colors2.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/chart3.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/chart4.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/chart5.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/chart6.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/chart7.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/chart8.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/chart9.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/chart10.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/chart11.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/chart12.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/chart13.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/chart14.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/charts/chart15.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing7.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing8.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing9.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet35.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing10.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing11.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing12.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet3.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing13.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing14.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing15.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing16.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing17.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing18.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing19.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing20.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing21.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing22.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing23.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing24.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing25.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing26.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing27.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing28.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing29.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing30.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing31.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing32.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing33.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing34.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing35.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing36.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/drawing37.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet4.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet5.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet6.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet7.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet8.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet9.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet10.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet11.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet12.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet13.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet14.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet15.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet16.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet17.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet18.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet19.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet20.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet21.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet22.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet23.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet24.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet25.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet26.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet27.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet28.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet29.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet30.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet31.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet32.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet33.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet34.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet36.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet37.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet38.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet39.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet40.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet41.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet42.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/drawings/_rels/drawing3.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/externalLinks/externalLink1.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/externalLinks/externalLink2.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/externalLinks/externalLink3.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/metadata.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings4.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings5.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings6.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings7.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings8.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings9.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings10.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings11.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings12.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings13.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings41.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings19.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings42.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/calcChain.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = customXml/item2.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = customXml/item3.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings30.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings17.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = docProps/custom.xml
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings16.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings15.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings24.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings31.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings14.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/externalLinks/_rels/externalLink1.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/externalLinks/_rels/externalLink2.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/externalLinks/_rels/externalLink3.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings21.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings32.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings25.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings33.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings18.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings34.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings26.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings35.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings22.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings36.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings27.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings37.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings20.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings38.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings28.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings39.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings23.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings40.bin
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings29.bin
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common Jump to behavior
Source: The_Statutory_Biodiversity_Metric_Calculation_Tool_-_Macro_enabled_02.24.xlsm Static file information: File size 4303145 > 1048576
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\splwow64.exe Window / User API: threadDelayed 1846 Jump to behavior
Source: C:\Windows\splwow64.exe Window / User API: threadDelayed 8127 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\splwow64.exe Last function: Thread delayed
Source: C:\Windows\splwow64.exe Last function: Thread delayed
Source: C:\Windows\splwow64.exe Thread delayed: delay time: 120000 Jump to behavior
Source: C:\Windows\splwow64.exe Thread delayed: delay time: 120000 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information queried: ProcessInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1436902 Sample: The_Statutory_Biodiversity_... Startdate: 06/05/2024 Architecture: WINDOWS Score: 5 5 EXCEL.EXE 252 81 2->5         started        dnsIp3 10 part-0013.t-0009.t-msedge.net 13.107.246.41, 443, 49737, 49738 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 5->10 8 splwow64.exe 1 5->8         started        process4
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.107.246.41
 part-0013.t-0009.t-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false

Contacted Domains

Name IP Active
part-0013.t-0009.t-msedge.net 13.107.246.41 true