Edit tour

Windows Analysis Report
IBM_PAfE_x86_2.0.91.10.xll

Overview

General Information

Sample name:	IBM_PAfE_x86_2.0.91.10.xll
Analysis ID:	1649560
MD5:	723533fb01fcfbd0efe35a60565d7476
SHA1:	9deb47b7edd59febd3967c908ee704cc09888423
SHA256:	365d809aa3889e3e4b11f63da513df84af27ef6ed074f7a0c9f3e38d6afd3d90
Infos:

Detection

Score:	76
Range:	0 - 100
Confidence:	100%

Compliance

Score:	33
Range:	0 - 100

Signatures

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Document exploit detected (process start blacklist hit)

Office process drops PE file

Sigma detected: File With Uncommon Extension Created By An Office Application

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Sigma detected: Suspicious Microsoft Office Child Process

Allocates memory with a write watch (potentially for evading sandboxes)

Creates a process in suspended mode (likely to inject code)

Dropped file seen in connection with other malware

Drops PE files

EXE planting / hijacking vulnerabilities found

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Excel Network Connections

Sigma detected: Office Autorun Keys Modification

Sigma detected: Suspicious Office Outbound Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7668 cmdline: cmd /C "C:\Users\user\Desktop\IBM_PAfE_x86_2.0.91.10.xll" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

EXCEL.EXE (PID: 7748 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" -xlls "C:\Users\user\Desktop\IBM_PAfE_x86_2.0.91.10.xll" MD5: 4A871771235598812032C822E6F68F19)

CognosSessionMonitor.exe (PID: 8176 cmdline: "C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe" 7748 MD5: 0614D83EE1D82EC45B85A5F2D4AF3F3B)

conhost.exe (PID: 8184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

splwow64.exe (PID: 2140 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

cleanup

Sigma Signatures

System Summary

Sigma detected: File With Uncommon Extension Created By An Office Application

Source: File created

Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, ProcessId: 7748, TargetFilename: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Source: Process started

Author: Jason Lynch: Data: Command: "C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe" 7748, CommandLine: "C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe" 7748, CommandLine|base64offset|contains: <, Image: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe, NewProcessName: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe, OriginalFileName: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" -xlls "C:\Users\user\Desktop\IBM_PAfE_x86_2.0.91.10.xll", ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, ParentProcessId: 7748, ParentProcessName: EXCEL.EXE, ProcessCommandLine: "C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe" 7748, ProcessId: 8176, ProcessName: CognosSessionMonitor.exe

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe" 7748, CommandLine: "C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe" 7748, CommandLine|base64offset|contains: <, Image: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe, NewProcessName: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe, OriginalFileName: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" -xlls "C:\Users\user\Desktop\IBM_PAfE_x86_2.0.91.10.xll", ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, ParentProcessId: 7748, ParentProcessName: EXCEL.EXE, ProcessCommandLine: "C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe" 7748, ProcessId: 8176, ProcessName: CognosSessionMonitor.exe

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 13.107.246.41, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 7748, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49739

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, ProcessId: 7748, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Excel\Addins\CognosOffice12.Connect\LoadBehavior

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.4, DestinationIsIpv6: false, DestinationPort: 49739, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 7748, Protocol: tcp, SourceIp: 13.107.246.41, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-26T22:31:58.400093+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	13.107.246.41	443	TCP
2025-03-26T22:32:05.408500+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	13.107.246.41	443	TCP
2025-03-26T22:32:05.416947+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	13.107.246.41	443	TCP

Joe Sandbox Signatures

• Privilege Escalation
• Compliance
• Spreading
• Software Vulnerabilities
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

EXE: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe

Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

EXE: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe

Jump to behavior

Uses 32bit PE files

Source: IBM_PAfE_x86_2.0.91.10.xll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

PE / OLE file has a valid certificate

Source: IBM_PAfE_x86_2.0.91.10.xll

Static PE information: certificate valid

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.4:49739 version: TLS 1.2

Binary contains paths to debug symbols

Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\coi\prod\JSON\obj\Release Signed\JSON.pdb source: CognosSessionMonitor.exe, 00000004.00000002.2419272508.000001E5FEA32000.00000002.00000001.01000000.0000000A.sdmp, JSON.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\coi\prod\ExcelDna\bin\ExcelDna.vs2010.pdb source: IBM_PAfE_x86_2.0.91.10.xll
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\coi\prod\ExcelDna.Loader\obj\Release Signed\ExcelDna.Loader.pdb source: IBM_PAfE_x86_2.0.91.10.xll
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\coi\prod\JSON\obj\Release Signed\JSON.pdbXwrw dw_CorDllMainmscoree.dll source: CognosSessionMonitor.exe, 00000004.00000002.2419272508.000001E5FEA32000.00000002.00000001.01000000.0000000A.sdmp, JSON.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\coi\prod\Framework\obj\Release Signed\Framework.pdb source: CognosSessionMonitor.exe, 00000004.00000002.2420348525.000001E5FF722000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\cor\prod\Edm\obj\Release Signed\Edm.pdb0vJv <v_CorDllMainmscoree.dll source: Edm.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\coi\prod\C8\obj\Release Signed\Framework.Provider.Cognos8.pdbD source: Framework.Provider.Cognos8.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\coi\prod\C8\obj\Release Signed\Framework.Provider.Cognos8.pdb source: Framework.Provider.Cognos8.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\cor\prod\TM1Rest\obj\Release Signed\Framework.Provider.TM1Rest.pdb source: Framework.Provider.TM1Rest.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\cor\prod\TM1OData\obj\Release Signed\Framework.TM1.OData.pdb source: Framework.TM1.OData.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\cor\prod\Edm\obj\Release Signed\Edm.pdb source: Edm.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\cor\prod\BIReporting\obj\Release Signed\Framework.Provider.BIReporting.pdb source: Framework.Provider.BIReporting.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\cor\prod\BIReporting\obj\Release Signed\Framework.Provider.BIReporting.pdbX source: Framework.Provider.BIReporting.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\cor\prod\TM1Rest\obj\Release Signed\Framework.Provider.TM1Rest.pdb4 source: Framework.Provider.TM1Rest.dll.2.dr
Source:	Binary string: WebView2Loader.dll.pdb source: WebView2Loader.dll.2.dr, WebView2Loader.dll0.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\coi\prod\CognosSessionMonitor\obj\Release Signed\CognosSessionMonitor.pdb source: CognosSessionMonitor.exe, 00000004.00000000.1260464047.000001E5FE6A2000.00000002.00000001.01000000.00000006.sdmp, CognosSessionMonitor.exe.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\cor\prod\TM1Common\obj\Release Signed\TM1.Common.pdb source: TM1.Common.dll.2.dr

Spreading

Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	File opened: C:\Users\user\AppData\Local\Cognos\	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	File opened: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	File opened: C:\Users\user\AppData\Local\Cognos\Office Connection\	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	File opened: C:\Users\user\	Jump to behavior

Software Vulnerabilities

Document exploit detected (creates forbidden files)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Edm.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\PAfE_Browser\runtimes\win-arm64\native\WebView2Loader.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.Office.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.Provider.BIReporting.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\PAfE_Browser\runtimes\win-x64\native\WebView2Loader.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.Provider.Cognos8.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\PAfE_Browser\runtimes\win-x86\native\WebView2Loader.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.Provider.TM1Rest.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.TM1.OData.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.UI.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\JSON.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\TM1.Common.dll	Jump to behavior

Document exploit detected (drops PE files)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: CognosSessionMonitor.exe.2.dr

Jump to dropped file

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: otelrules.svc.static.microsoft

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 13.107.246.41:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 13.107.246.41:443
Source: global traffic	TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49740

Source: excel.exe

Memory has grown: Private usage: 1MB later: 109MB

Networking

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 13.107.246.41 13.107.246.41
Source: Joe Sandbox View	IP Address: 13.107.246.41 13.107.246.41

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 13.107.246.41:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 13.107.246.41:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 13.107.246.41:443

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.svc.static.microsoft

Source: global traffic

DNS traffic detected: DNS query: otelrules.svc.static.microsoft

Source: IBM_PAfE_x86_2.0.91.10.xll, Framework.TM1.OData.dll.2.dr, CognosSessionMonitor.exe.2.dr, Framework.Provider.BIReporting.dll.2.dr, Framework.Provider.Cognos8.dll.2.dr, JSON.dll.2.dr, Edm.dll.2.dr, Framework.Provider.TM1Rest.dll.2.dr, TM1.Common.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: IBM_PAfE_x86_2.0.91.10.xll, Framework.TM1.OData.dll.2.dr, CognosSessionMonitor.exe.2.dr, Framework.Provider.BIReporting.dll.2.dr, Framework.Provider.Cognos8.dll.2.dr, JSON.dll.2.dr, Edm.dll.2.dr, Framework.Provider.TM1Rest.dll.2.dr, TM1.Common.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: IBM_PAfE_x86_2.0.91.10.xll, Framework.TM1.OData.dll.2.dr, CognosSessionMonitor.exe.2.dr, Framework.Provider.BIReporting.dll.2.dr, Framework.Provider.Cognos8.dll.2.dr, JSON.dll.2.dr, Edm.dll.2.dr, Framework.Provider.TM1Rest.dll.2.dr, TM1.Common.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: IBM_PAfE_x86_2.0.91.10.xll, Framework.TM1.OData.dll.2.dr, CognosSessionMonitor.exe.2.dr, Framework.Provider.BIReporting.dll.2.dr, Framework.Provider.Cognos8.dll.2.dr, JSON.dll.2.dr, Edm.dll.2.dr, Framework.Provider.TM1Rest.dll.2.dr, TM1.Common.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: CognosSessionMonitor.exe, 00000004.00000002.2420348525.000001E5FF722000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: IBM_PAfE_x86_2.0.91.10.xll, Framework.TM1.OData.dll.2.dr, CognosSessionMonitor.exe.2.dr, Framework.Provider.BIReporting.dll.2.dr, Framework.Provider.Cognos8.dll.2.dr, JSON.dll.2.dr, Edm.dll.2.dr, Framework.Provider.TM1Rest.dll.2.dr, TM1.Common.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: IBM_PAfE_x86_2.0.91.10.xll, Framework.TM1.OData.dll.2.dr, CognosSessionMonitor.exe.2.dr, Framework.Provider.BIReporting.dll.2.dr, Framework.Provider.Cognos8.dll.2.dr, JSON.dll.2.dr, Edm.dll.2.dr, Framework.Provider.TM1Rest.dll.2.dr, TM1.Common.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: IBM_PAfE_x86_2.0.91.10.xll, Framework.TM1.OData.dll.2.dr, CognosSessionMonitor.exe.2.dr, Framework.Provider.BIReporting.dll.2.dr, Framework.Provider.Cognos8.dll.2.dr, JSON.dll.2.dr, Edm.dll.2.dr, Framework.Provider.TM1Rest.dll.2.dr, TM1.Common.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: TM1.Common.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: IBM_PAfE_x86_2.0.91.10.xll, Framework.TM1.OData.dll.2.dr, CognosSessionMonitor.exe.2.dr, Framework.Provider.BIReporting.dll.2.dr, Framework.Provider.Cognos8.dll.2.dr, JSON.dll.2.dr, Edm.dll.2.dr, Framework.Provider.TM1Rest.dll.2.dr, TM1.Common.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Framework.Provider.Cognos8.dll.2.dr	String found in binary or memory: http://developer.cognos.com/schemas/bibus/3/
Source: Framework.Provider.Cognos8.dll.2.dr	String found in binary or memory: http://developer.cognos.com/schemas/bibus/3/encodedTypes
Source: Framework.Provider.Cognos8.dll.2.dr	String found in binary or memory: http://developer.cognos.com/schemas/contentManagerService/1
Source: Framework.Provider.Cognos8.dll.2.dr	String found in binary or memory: http://developer.cognos.com/schemas/contentManagerService/1y//soapenv:Body/bus:queryResponse/queryRe
Source: Framework.Provider.Cognos8.dll.2.dr	String found in binary or memory: http://developer.cognos.com/schemas/cps/navigation/1/
Source: Framework.Provider.BIReporting.dll.2.dr	String found in binary or memory: http://developer.cognos.com/schemas/rawxml/2/
Source: Framework.Provider.BIReporting.dll.2.dr, Framework.Provider.Cognos8.dll.2.dr	String found in binary or memory: http://developer.cognos.com/schemas/report/
Source: Framework.Provider.BIReporting.dll.2.dr	String found in binary or memory: http://developer.cognos.com/schemas/report/4.0/
Source: Framework.Provider.BIReporting.dll.2.dr	String found in binary or memory: http://developer.cognos.com/schemas/report/5.0/-//sc:report/sc:queries=sc:selection/sc:dataItemMembe
Source: Framework.Provider.Cognos8.dll.2.dr	String found in binary or memory: http://developer.cognos.com/schemas/reportService/1
Source: Framework.Provider.Cognos8.dll.2.dr	String found in binary or memory: http://developer.cognos.com/schemas/reportService/1.session
Source: IBM_PAfE_x86_2.0.91.10.xll, Framework.TM1.OData.dll.2.dr, CognosSessionMonitor.exe.2.dr, Framework.Provider.BIReporting.dll.2.dr, Framework.Provider.Cognos8.dll.2.dr, JSON.dll.2.dr, Edm.dll.2.dr, Framework.Provider.TM1Rest.dll.2.dr, TM1.Common.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: IBM_PAfE_x86_2.0.91.10.xll, Framework.TM1.OData.dll.2.dr, CognosSessionMonitor.exe.2.dr, Framework.Provider.BIReporting.dll.2.dr, Framework.Provider.Cognos8.dll.2.dr, JSON.dll.2.dr, Edm.dll.2.dr, Framework.Provider.TM1Rest.dll.2.dr, TM1.Common.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: IBM_PAfE_x86_2.0.91.10.xll, Framework.TM1.OData.dll.2.dr, CognosSessionMonitor.exe.2.dr, Framework.Provider.BIReporting.dll.2.dr, Framework.Provider.Cognos8.dll.2.dr, JSON.dll.2.dr, Edm.dll.2.dr, Framework.Provider.TM1Rest.dll.2.dr, TM1.Common.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: IBM_PAfE_x86_2.0.91.10.xll, Framework.TM1.OData.dll.2.dr, CognosSessionMonitor.exe.2.dr, Framework.Provider.BIReporting.dll.2.dr, Framework.Provider.Cognos8.dll.2.dr, JSON.dll.2.dr, Edm.dll.2.dr, Framework.Provider.TM1Rest.dll.2.dr, TM1.Common.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: CognosSessionMonitor.exe, 00000004.00000002.2420348525.000001E5FF722000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: Framework.Provider.Cognos8.dll.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: Framework.Provider.Cognos8.dll.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Framework.Provider.BIReporting.dll.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/Shttp://schemas.xmlsoap.org/soap/encoding/qhttp://developer
Source: CognosSessionMonitor.exe, 00000004.00000002.2420348525.000001E5FF722000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: CognosSessionMonitor.exe, 00000004.00000002.2420348525.000001E5FF722000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: CognosSessionMonitor.exe, 00000004.00000002.2420348525.000001E5FF722000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: CognosSessionMonitor.exe, 00000004.00000002.2420348525.000001E5FF722000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www-01.ibm.com/software/data/cognos/
Source: Cognos.Office.Reporting.Resource.EULA.EULA.sl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ko.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.tr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.it.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.fr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.cs.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.zh.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.el.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.en.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pt.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ja.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.lt.resources.2.dr	String found in binary or memory: http://www.apache.org/).
Source: Cognos.Office.Reporting.Resource.EULA.EULA.sl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ko.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.tr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.it.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.fr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.cs.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.zh.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.el.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.en.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pt.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ja.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.lt.resources.2.dr	String found in binary or memory: http://www.apache.org/.
Source: Cognos.Office.Reporting.Resource.EULA.EULA.sl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ko.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.tr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.it.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.fr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.cs.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.zh.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.el.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.en.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pt.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ja.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.lt.resources.2.dr	String found in binary or memory: http://www.apache.org/licenses/
Source: Cognos.Office.Reporting.Resource.EULA.EULA.lt.resources.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: IBM_PAfE_x86_2.0.91.10.xll, Framework.TM1.OData.dll.2.dr, CognosSessionMonitor.exe.2.dr, Framework.Provider.BIReporting.dll.2.dr, Framework.Provider.Cognos8.dll.2.dr, JSON.dll.2.dr, Edm.dll.2.dr, Framework.Provider.TM1Rest.dll.2.dr, TM1.Common.dll.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: Cognos.Office.Reporting.Resource.EULA.EULA.sl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ko.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.tr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.it.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.fr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.cs.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.zh.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.el.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.en.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pt.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ja.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.lt.resources.2.dr	String found in binary or memory: http://www.dom4j.org
Source: Cognos.Office.Reporting.Resource.EULA.EULA.sl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ko.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.tr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.it.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.fr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.cs.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.zh.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.el.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.en.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pt.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ja.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.lt.resources.2.dr	String found in binary or memory: http://www.ibm.com.
Source: Cognos.Office.Reporting.Resource.msgs.cormsgs.es.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.th.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.ko.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.de.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.ro.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.hr.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.zh-cn.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.kk.resources.2.dr	String found in binary or memory: http://www.ibm.com/support/knowledgecenter/SSD29G
Source: Cognos.Office.Reporting.Resource.msgs.cormsgs.it.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.tr.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.fi.resources.2.dr	String found in binary or memory: http://www.ibm.com/support/knowledgecenter/SSD29G.
Source: Framework.Provider.Cognos8.dll.2.dr	String found in binary or memory: http://www.ibm.com/xmlns/prod/cognos/contentManagerService/201101/
Source: Framework.Provider.Cognos8.dll.2.dr	String found in binary or memory: http://www.ibm.com/xmlns/prod/cognos/contentManagerService/201109/
Source: Framework.Provider.Cognos8.dll.2.dr	String found in binary or memory: http://www.ibm.com/xmlns/prod/cognos/contentManagerService/201301/
Source: Framework.Provider.Cognos8.dll.2.dr	String found in binary or memory: http://www.ibm.com/xmlns/prod/cognos/contentManagerService/201301/vhttp://developer.cognos.com/schem
Source: Framework.Provider.Cognos8.dll.2.dr	String found in binary or memory: http://www.ibm.com/xmlns/prod/cognos/reportService/201109/.session
Source: Framework.Provider.Cognos8.dll.2.dr	String found in binary or memory: http://www.ibm.com/xmlns/prod/cognos/reportService/201301/.session
Source: Cognos.Office.Reporting.Resource.EULA.EULA.sl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ko.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.tr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.it.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.fr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.cs.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.zh.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.el.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.en.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pt.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ja.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.lt.resources.2.dr	String found in binary or memory: http://www.stylusstudio.com/jd.xslt/
Source: Cognos.Office.Reporting.Resource.EULA.EULA.sl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ko.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.tr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.it.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.fr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.cs.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.zh.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.el.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.en.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pt.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ja.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.lt.resources.2.dr	String found in binary or memory: http://www.sun.com.
Source: Cognos.Office.Reporting.Resource.msgs.cormsgs.de.resources.2.dr	String found in binary or memory: https://www.ibm.com/docs/de/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan
Source: Cognos.Office.Reporting.Resource.msgs.cormsgs.th.resources.2.dr	String found in binary or memory: https://www.ibm.com/docs/en/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan
Source: Cognos.Office.Reporting.Resource.msgs.cormsgs.en.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.resources.2.dr	String found in binary or memory: https://www.ibm.com/docs/en/planning-analytics/latest?topic=configuration-installing-configuring-pla
Source: Cognos.Office.Reporting.Resource.msgs.cormsgs.es.resources.2.dr	String found in binary or memory: https://www.ibm.com/docs/es/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan
Source: Cognos.Office.Reporting.Resource.msgs.cormsgs.fi.resources.2.dr	String found in binary or memory: https://www.ibm.com/docs/fi/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan
Source: Cognos.Office.Reporting.Resource.msgs.cormsgs.fr.resources.2.dr	String found in binary or memory: https://www.ibm.com/docs/fr/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan
Source: Cognos.Office.Reporting.Resource.msgs.cormsgs.hr.resources.2.dr	String found in binary or memory: https://www.ibm.com/docs/hr/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan
Source: Cognos.Office.Reporting.Resource.msgs.cormsgs.hu.resources.2.dr	String found in binary or memory: https://www.ibm.com/docs/hu/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan
Source: Cognos.Office.Reporting.Resource.msgs.cormsgs.it.resources.2.dr	String found in binary or memory: https://www.ibm.com/docs/it/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan
Source: Cognos.Office.Reporting.Resource.msgs.cormsgs.kk.resources.2.dr	String found in binary or memory: https://www.ibm.com/docs/kk/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan
Source: Cognos.Office.Reporting.Resource.msgs.cormsgs.ko.resources.2.dr	String found in binary or memory: https://www.ibm.com/docs/ko/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan
Source: Cognos.Office.Reporting.Resource.msgs.cormsgs.pl.resources.2.dr	String found in binary or memory: https://www.ibm.com/docs/pl/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan
Source: Cognos.Office.Reporting.Resource.msgs.cormsgs.pt.resources.2.dr	String found in binary or memory: https://www.ibm.com/docs/pt-br/planning-analytics/2.0.0?topic=configuration-installing-configuring-p
Source: Cognos.Office.Reporting.Resource.msgs.cormsgs.ro.resources.2.dr	String found in binary or memory: https://www.ibm.com/docs/ro/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan
Source: Cognos.Office.Reporting.Resource.msgs.cormsgs.tr.resources.2.dr	String found in binary or memory: https://www.ibm.com/docs/tr/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan
Source: Cognos.Office.Reporting.Resource.msgs.cormsgs.zh-cn.resources.2.dr	String found in binary or memory: https://www.ibm.com/docs/zh/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan
Source: Cognos.Office.Reporting.Resource.EULA.EULA.ko.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.zh.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ja.resources.2.dr	String found in binary or memory: https://www.ibm.com/products/exporting/
Source: Cognos.Office.Reporting.Resource.EULA.EULA.sl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.tr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.it.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.fr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.cs.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.el.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.en.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pt.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.lt.resources.2.dr	String found in binary or memory: https://www.ibm.com/products/exporting/.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.4:49739 version: TLS 1.2

System Summary

Office process drops PE file

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\PAfE_Browser\runtimes\win-x64\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.Provider.TM1Rest.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.Office.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.TM1.OData.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\PAfE_Browser\runtimes\win-x86\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\JSON.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Edm.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.UI.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.Provider.BIReporting.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\TM1.Common.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.Provider.Cognos8.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\PAfE_Browser\runtimes\win-arm64\native\WebView2Loader.dll	Jump to dropped file

Dropped file seen in connection with other malware

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Cognos\Office Connection\PAfE_Browser\runtimes\win-x64\native\WebView2Loader.dll AD8BB426A8E438493DB4D703242F373D9CB36D8C13E88B6647CD083716E09BEF

PE file contains executable resources (Code or Archives)

Source: IBM_PAfE_x86_2.0.91.10.xll

Static PE information: Resource name: ASSEMBLY type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

Sample file is different than original file name gathered from version info

Source: IBM_PAfE_x86_2.0.91.10.xll	Binary or memory string: OriginalFilenameExcelDna.Loader.dll~/ vs IBM_PAfE_x86_2.0.91.10.xll
Source: IBM_PAfE_x86_2.0.91.10.xll	Binary or memory string: OriginalFilenameExcelDna.xll vs IBM_PAfE_x86_2.0.91.10.xll

Uses 32bit PE files

Source: IBM_PAfE_x86_2.0.91.10.xll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: classification engine

Classification label: mal76.expl.winXLL@10/97@1/1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Cognos

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8184:120:WilError_03
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7676:120:WilError_03
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Mutant created: \Sessions\1\BaseNamedObjects\CognosOfficeLog_8176

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{553B1FA2-0B44-47CE-AF57-A83529E63B6A} - OProcSessId.dat

Jump to behavior

Source: IBM_PAfE_x86_2.0.91.10.xll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /C "C:\Users\user\Desktop\IBM_PAfE_x86_2.0.91.10.xll"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" -xlls "C:\Users\user\Desktop\IBM_PAfE_x86_2.0.91.10.xll"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe "C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe" 7748
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" -xlls "C:\Users\user\Desktop\IBM_PAfE_x86_2.0.91.10.xll"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe "C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe" 7748	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F39D01F3-69C1-45E1-93B2-7BF0BC6EB63E}\InprocServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Checks if Microsoft Office is installed

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

PE / OLE file has a valid certificate

Source: IBM_PAfE_x86_2.0.91.10.xll

Static PE information: certificate valid

PE file exports many functions

Source: IBM_PAfE_x86_2.0.91.10.xll

Static PE information: More than 5014 > 100 exports found

Submission file is bigger than most known malware samples

Source: IBM_PAfE_x86_2.0.91.10.xll

Static file information: File size 7890792 > 1048576

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

PE file has a big raw section

Source: IBM_PAfE_x86_2.0.91.10.xll

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x73aa00

PE file contains a mix of data directories often seen in goodware

Source: IBM_PAfE_x86_2.0.91.10.xll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: IBM_PAfE_x86_2.0.91.10.xll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: IBM_PAfE_x86_2.0.91.10.xll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: IBM_PAfE_x86_2.0.91.10.xll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: IBM_PAfE_x86_2.0.91.10.xll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: IBM_PAfE_x86_2.0.91.10.xll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

PE file contains a debug data directory

Source: IBM_PAfE_x86_2.0.91.10.xll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\coi\prod\JSON\obj\Release Signed\JSON.pdb source: CognosSessionMonitor.exe, 00000004.00000002.2419272508.000001E5FEA32000.00000002.00000001.01000000.0000000A.sdmp, JSON.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\coi\prod\ExcelDna\bin\ExcelDna.vs2010.pdb source: IBM_PAfE_x86_2.0.91.10.xll
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\coi\prod\ExcelDna.Loader\obj\Release Signed\ExcelDna.Loader.pdb source: IBM_PAfE_x86_2.0.91.10.xll
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\coi\prod\JSON\obj\Release Signed\JSON.pdbXwrw dw_CorDllMainmscoree.dll source: CognosSessionMonitor.exe, 00000004.00000002.2419272508.000001E5FEA32000.00000002.00000001.01000000.0000000A.sdmp, JSON.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\coi\prod\Framework\obj\Release Signed\Framework.pdb source: CognosSessionMonitor.exe, 00000004.00000002.2420348525.000001E5FF722000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\cor\prod\Edm\obj\Release Signed\Edm.pdb0vJv <v_CorDllMainmscoree.dll source: Edm.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\coi\prod\C8\obj\Release Signed\Framework.Provider.Cognos8.pdbD source: Framework.Provider.Cognos8.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\coi\prod\C8\obj\Release Signed\Framework.Provider.Cognos8.pdb source: Framework.Provider.Cognos8.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\cor\prod\TM1Rest\obj\Release Signed\Framework.Provider.TM1Rest.pdb source: Framework.Provider.TM1Rest.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\cor\prod\TM1OData\obj\Release Signed\Framework.TM1.OData.pdb source: Framework.TM1.OData.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\cor\prod\Edm\obj\Release Signed\Edm.pdb source: Edm.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\cor\prod\BIReporting\obj\Release Signed\Framework.Provider.BIReporting.pdb source: Framework.Provider.BIReporting.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\cor\prod\BIReporting\obj\Release Signed\Framework.Provider.BIReporting.pdbX source: Framework.Provider.BIReporting.dll.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\cor\prod\TM1Rest\obj\Release Signed\Framework.Provider.TM1Rest.pdb4 source: Framework.Provider.TM1Rest.dll.2.dr
Source:	Binary string: WebView2Loader.dll.pdb source: WebView2Loader.dll.2.dr, WebView2Loader.dll0.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\coi\prod\CognosSessionMonitor\obj\Release Signed\CognosSessionMonitor.pdb source: CognosSessionMonitor.exe, 00000004.00000000.1260464047.000001E5FE6A2000.00000002.00000001.01000000.00000006.sdmp, CognosSessionMonitor.exe.2.dr
Source:	Binary string: c:\local\builds\pm\hyc_pax\workspace\PAfE_release\src\cor\prod\TM1Common\obj\Release Signed\TM1.Common.pdb source: TM1.Common.dll.2.dr

PE file contains a valid data directory to section mapping

Source: IBM_PAfE_x86_2.0.91.10.xll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: IBM_PAfE_x86_2.0.91.10.xll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: IBM_PAfE_x86_2.0.91.10.xll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: IBM_PAfE_x86_2.0.91.10.xll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: IBM_PAfE_x86_2.0.91.10.xll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

PE file contains sections with non-standard names

Source: WebView2Loader.dll.2.dr	Static PE information: section name: .00cfg
Source: WebView2Loader.dll0.2.dr	Static PE information: section name: .00cfg
Source: WebView2Loader.dll0.2.dr	Static PE information: section name: .voltbl
Source: WebView2Loader.dll0.2.dr	Static PE information: section name: _RDATA
Source: WebView2Loader.dll1.2.dr	Static PE information: section name: .00cfg
Source: WebView2Loader.dll1.2.dr	Static PE information: section name: .voltbl

Persistence and Installation Behavior

Drops PE files

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\PAfE_Browser\runtimes\win-x64\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.Provider.TM1Rest.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.Office.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.TM1.OData.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\PAfE_Browser\runtimes\win-x86\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\JSON.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Edm.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.UI.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.Provider.BIReporting.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\TM1.Common.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.Provider.Cognos8.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Cognos\Office Connection\PAfE_Browser\runtimes\win-arm64\native\WebView2Loader.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Memory allocated: 1E5FE9E0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Memory allocated: 1E5FEF80000 memory reserve \| memory write watch			Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\splwow64.exe

Window / User API: threadDelayed 580

Found dropped PE file which has not been started or loaded

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Cognos\Office Connection\PAfE_Browser\runtimes\win-x64\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.Provider.TM1Rest.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.Office.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.TM1.OData.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Cognos\Office Connection\PAfE_Browser\runtimes\win-x86\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\JSON.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Edm.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.UI.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.Provider.BIReporting.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\TM1.Common.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.Provider.Cognos8.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Cognos\Office Connection\PAfE_Browser\runtimes\win-arm64\native\WebView2Loader.dll	Jump to dropped file

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000

Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	File opened: C:\Users\user\AppData\Local\Cognos\	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	File opened: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	File opened: C:\Users\user\AppData\Local\Cognos\Office Connection\	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	File opened: C:\Users\user\	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Enables debug privileges

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" -xlls "C:\Users\user\Desktop\IBM_PAfE_x86_2.0.91.10.xll"

Jump to behavior

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Queries volume information: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Queries volume information: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\Framework.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe	Queries volume information: C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\JSON.dll VolumeInformation	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	33 Exploitation for Client Execution	1 DLL Side-Loading	11 Process Injection	2 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Search Order Hijacking	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Search Order Hijacking	11 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	11 Process Injection	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Search Order Hijacking	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
IBM_PAfE_x86_2.0.91.10.xll	9%	ReversingLabs
IBM_PAfE_x86_2.0.91.10.xll	4%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Cognos\Office Connection\PAfE_Browser\runtimes\win-arm64\native\WebView2Loader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Cognos\Office Connection\PAfE_Browser\runtimes\win-x64\native\WebView2Loader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Cognos\Office Connection\PAfE_Browser\runtimes\win-x86\native\WebView2Loader.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.stylusstudio.com/jd.xslt/	0%	Avira URL Cloud	safe
http://developer.cognos.com/schemas/cps/navigation/1/	0%	Avira URL Cloud	safe
http://developer.cognos.com/schemas/bibus/3/encodedTypes	0%	Avira URL Cloud	safe
http://developer.cognos.com/schemas/rawxml/2/	0%	Avira URL Cloud	safe
http://developer.cognos.com/schemas/report/	0%	Avira URL Cloud	safe
http://developer.cognos.com/schemas/report/5.0/-//sc:report/sc:queries=sc:selection/sc:dataItemMembe	0%	Avira URL Cloud	safe
http://developer.cognos.com/schemas/contentManagerService/1y//soapenv:Body/bus:queryResponse/queryRe	0%	Avira URL Cloud	safe
http://developer.cognos.com/schemas/report/4.0/	0%	Avira URL Cloud	safe
http://developer.cognos.com/schemas/reportService/1.session	0%	Avira URL Cloud	safe
http://developer.cognos.com/schemas/reportService/1	0%	Avira URL Cloud	safe
http://www.dom4j.org	0%	Avira URL Cloud	safe
http://developer.cognos.com/schemas/bibus/3/	0%	Avira URL Cloud	safe
http://developer.cognos.com/schemas/contentManagerService/1	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0013.t-0009.t-msedge.net	13.107.246.41	true	false	high
s-0005.dual-s-msedge.net	52.123.128.14	true	false	high
otelrules.svc.static.microsoft	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://otelrules.svc.static.microsoft/rules/excel.exe-Production-v19.bundle	false	high
https://otelrules.svc.static.microsoft/rules/rule120607v1s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule120603v8s19.xml	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.ibm.com/docs/tr/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan	Cognos.Office.Reporting.Resource.msgs.cormsgs.tr.resources.2.dr	false		high
https://www.ibm.com/docs/de/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan	Cognos.Office.Reporting.Resource.msgs.cormsgs.de.resources.2.dr	false		high
http://www.apache.org/.	Cognos.Office.Reporting.Resource.EULA.EULA.sl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ko.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.tr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.it.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.fr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.cs.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.zh.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.el.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.en.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pt.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ja.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.lt.resources.2.dr	false		high
http://www.sun.com.	Cognos.Office.Reporting.Resource.EULA.EULA.sl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ko.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.tr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.it.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.fr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.cs.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.zh.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.el.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.en.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pt.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ja.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.lt.resources.2.dr	false		high
http://schemas.xmlsoap.org/soap/envelope/	Framework.Provider.Cognos8.dll.2.dr	false		high
http://www.ibm.com.	Cognos.Office.Reporting.Resource.EULA.EULA.sl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ko.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.tr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.it.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.fr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.cs.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.zh.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.el.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.en.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pt.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ja.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.lt.resources.2.dr	false		high
http://www.ibm.com/support/knowledgecenter/SSD29G.	Cognos.Office.Reporting.Resource.msgs.cormsgs.it.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.tr.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.fi.resources.2.dr	false		high
https://www.ibm.com/docs/kk/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan	Cognos.Office.Reporting.Resource.msgs.cormsgs.kk.resources.2.dr	false		high
http://www.stylusstudio.com/jd.xslt/	Cognos.Office.Reporting.Resource.EULA.EULA.sl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ko.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.tr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.it.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.fr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.cs.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.zh.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.el.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.en.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pt.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ja.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.lt.resources.2.dr	false	Avira URL Cloud: safe	unknown
https://www.ibm.com/docs/it/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan	Cognos.Office.Reporting.Resource.msgs.cormsgs.it.resources.2.dr	false		high
https://www.ibm.com/docs/en/planning-analytics/latest?topic=configuration-installing-configuring-pla	Cognos.Office.Reporting.Resource.msgs.cormsgs.en.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.resources.2.dr	false		high
https://www.ibm.com/docs/fr/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan	Cognos.Office.Reporting.Resource.msgs.cormsgs.fr.resources.2.dr	false		high
http://developer.cognos.com/schemas/cps/navigation/1/	Framework.Provider.Cognos8.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://www-01.ibm.com/software/data/cognos/	CognosSessionMonitor.exe, 00000004.00000002.2420348525.000001E5FF722000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://www.ibm.com/docs/pl/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan	Cognos.Office.Reporting.Resource.msgs.cormsgs.pl.resources.2.dr	false		high
http://www.apache.org/).	Cognos.Office.Reporting.Resource.EULA.EULA.sl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ko.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.tr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.it.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.fr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.cs.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.zh.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.el.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.en.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pt.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ja.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.lt.resources.2.dr	false		high
http://www.ibm.com/xmlns/prod/cognos/contentManagerService/201109/	Framework.Provider.Cognos8.dll.2.dr	false		high
https://www.ibm.com/docs/hr/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan	Cognos.Office.Reporting.Resource.msgs.cormsgs.hr.resources.2.dr	false		high
http://www.ibm.com/xmlns/prod/cognos/reportService/201109/.session	Framework.Provider.Cognos8.dll.2.dr	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	CognosSessionMonitor.exe, 00000004.00000002.2420348525.000001E5FF722000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://www.ibm.com/docs/fi/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan	Cognos.Office.Reporting.Resource.msgs.cormsgs.fi.resources.2.dr	false		high
http://www.ibm.com/xmlns/prod/cognos/contentManagerService/201101/	Framework.Provider.Cognos8.dll.2.dr	false		high
http://developer.cognos.com/schemas/bibus/3/encodedTypes	Framework.Provider.Cognos8.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://developer.cognos.com/schemas/rawxml/2/	Framework.Provider.BIReporting.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/Shttp://schemas.xmlsoap.org/soap/encoding/qhttp://developer	Framework.Provider.BIReporting.dll.2.dr	false		high
http://www.ibm.com/xmlns/prod/cognos/contentManagerService/201301/vhttp://developer.cognos.com/schem	Framework.Provider.Cognos8.dll.2.dr	false		high
http://www.ibm.com/xmlns/prod/cognos/reportService/201301/.session	Framework.Provider.Cognos8.dll.2.dr	false		high
https://www.ibm.com/docs/en/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan	Cognos.Office.Reporting.Resource.msgs.cormsgs.th.resources.2.dr	false		high
http://www.ibm.com/support/knowledgecenter/SSD29G	Cognos.Office.Reporting.Resource.msgs.cormsgs.es.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.th.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.ko.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.de.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.ro.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.hr.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.zh-cn.resources.2.dr, Cognos.Office.Reporting.Resource.msgs.cormsgs.kk.resources.2.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	Cognos.Office.Reporting.Resource.EULA.EULA.lt.resources.2.dr	false		high
http://schemas.xmlsoap.org/soap/encoding/	Framework.Provider.Cognos8.dll.2.dr	false		high
http://www.apache.org/licenses/	Cognos.Office.Reporting.Resource.EULA.EULA.sl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ko.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.tr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.it.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.fr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.cs.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.zh.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.el.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.en.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pt.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ja.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.lt.resources.2.dr	false		high
http://ocsp.thawte.com0	CognosSessionMonitor.exe, 00000004.00000002.2420348525.000001E5FF722000.00000002.00000001.01000000.0000000B.sdmp	false		high
http://developer.cognos.com/schemas/report/4.0/	Framework.Provider.BIReporting.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://developer.cognos.com/schemas/contentManagerService/1y//soapenv:Body/bus:queryResponse/queryRe	Framework.Provider.Cognos8.dll.2.dr	false	Avira URL Cloud: safe	unknown
https://www.ibm.com/docs/ro/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan	Cognos.Office.Reporting.Resource.msgs.cormsgs.ro.resources.2.dr	false		high
https://www.ibm.com/docs/ko/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan	Cognos.Office.Reporting.Resource.msgs.cormsgs.ko.resources.2.dr	false		high
https://www.ibm.com/docs/zh/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan	Cognos.Office.Reporting.Resource.msgs.cormsgs.zh-cn.resources.2.dr	false		high
http://developer.cognos.com/schemas/report/	Framework.Provider.BIReporting.dll.2.dr, Framework.Provider.Cognos8.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://developer.cognos.com/schemas/report/5.0/-//sc:report/sc:queries=sc:selection/sc:dataItemMembe	Framework.Provider.BIReporting.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://developer.cognos.com/schemas/reportService/1	Framework.Provider.Cognos8.dll.2.dr	false	Avira URL Cloud: safe	unknown
https://www.ibm.com/docs/hu/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan	Cognos.Office.Reporting.Resource.msgs.cormsgs.hu.resources.2.dr	false		high
http://www.ibm.com/xmlns/prod/cognos/contentManagerService/201301/	Framework.Provider.Cognos8.dll.2.dr	false		high
https://www.ibm.com/docs/pt-br/planning-analytics/2.0.0?topic=configuration-installing-configuring-p	Cognos.Office.Reporting.Resource.msgs.cormsgs.pt.resources.2.dr	false		high
http://developer.cognos.com/schemas/reportService/1.session	Framework.Provider.Cognos8.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://www.dom4j.org	Cognos.Office.Reporting.Resource.EULA.EULA.sl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ko.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pl.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.tr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.it.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.fr.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.cs.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.zh.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.el.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.en.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.pt.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.ja.resources.2.dr, Cognos.Office.Reporting.Resource.EULA.EULA.lt.resources.2.dr	false	Avira URL Cloud: safe	unknown
http://developer.cognos.com/schemas/contentManagerService/1	Framework.Provider.Cognos8.dll.2.dr	false	Avira URL Cloud: safe	unknown
https://www.ibm.com/docs/es/planning-analytics/2.0.0?topic=configuration-installing-configuring-plan	Cognos.Office.Reporting.Resource.msgs.cormsgs.es.resources.2.dr	false		high
http://developer.cognos.com/schemas/bibus/3/	Framework.Provider.Cognos8.dll.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
13.107.246.41	s-part-0013.t-0009.t-msedge.net	United States		8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1649560
Start date and time:	2025-03-26 22:29:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	IBM_PAfE_x86_2.0.91.10.xll
Detection:	MAL
Classification:	mal76.expl.winXLL@10/97@1/1
Cookbook Comments:	Found application associated with file extension: .xll Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.6.53, 52.109.16.112, 23.204.23.20, 23.219.36.143, 23.219.36.140, 52.182.143.210, 52.123.128.14, 20.190.151.8, 4.175.87.197
Excluded domains from analysis (whitelisted): omex.cdn.office.net, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, osiprod-ncus-buff-azsc-000.northcentralus.cloudapp.azure.com, ncus-azsc-000.roaming.officeapps.live.com, roaming.officeapps.live.com, dual-s-0005-office.config.skype.com, login.live.com, eus2-azsc-config.officeapps.live.com, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, onedscolprdcus10.centralus.cloudapp.azure.com, a1864.dscd.akamai.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, fe3cr.delivery.mp.microsoft.com, us1.roaming1.live.com.akadns.net, config.officeapps.live.com, us.configsvc1.live.com.akadns.net, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:31:57	API Interceptor	602x Sleep call for process: splwow64.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.41	http://www.surveymonkey.com/tr/v1/te/PUEIZHbYTJGrZEIkVMWlCoicdktJQxDgUh5D5mhe1V5RrTmuIdynx7PnFHXRUx9slMgQjvZdyUWqhr_2Bl49oNXjy3TOleTjKMKR6WbsGcrstlT2syBMlSkW7U5aKlKcBD9NFqJqrxGyODSWJJr6_2BMbXsKkDA_2F0ep4iw23xw6huuM_3D	Get hash	malicious	Unknown	Browse	www.eand.com/en/index.html
	02-11-2024 MVP.html	Get hash	malicious	Unknown	Browse	www.mvphealthcare.com/
	02-11-2024 MVP.html	Get hash	malicious	Unknown	Browse	www.mvphealthcare.com/
	http://y84x.mjt.lu/lnk/CAAABPdweCoAAAAAAAAAAAVG8MwAAAA6pnMAAAAAAAvpOQBlhIO4-ImJ1UImRBC5CNVIkLSaswAL-7Q/2/r-vXj7XjX0azsD7QNKNH-A/aHR0cHM6Ly9hcHBjZW50ZXIubXMvaW52aXRhdGlvbnMvb3JnL2IxNjM2ZDYzMTE0YTM0MjBkYWFmNTg4YTE5N2Y0N2MxNGY4ZDViNWMyM2ZjM2RhYTgxMWM0ODgwOWM1ZTZkNjQ	Get hash	malicious	Unknown	Browse	appcenter.ms/
	http://url7816.acetaxi.com/ls/click?upn=k9eqZnPBEZmPVPka3LxS61O1ksdCJOgznvtiwccqzi2-2BneqvfCXEJ-2FQj-2BZo7snmCwDunBahf2LYhfs7qQp7-2F23xLStq-2BkxJ70xqVvyXzkWM-3D8Cie_z5TGfmB4A65PPE2hDgRdrx6OZsZ3AmrJLHJ0M9ePWeHP5QDTWsAVp117uXam9dNn-2BGSxHeP-2BInRF-2Bgy2v-2FXBPODjmLss6NRV2RYsUYD7um77hgLl0ET9pPGTHF-2BQ1m6-2Fw7-2B-2B9DJOpakZj874YLC8uUep0F7rZMDlM46gmHmQqqAeCV477M0h2b07T2IcXu0hzUcKftN0UG2jhPq8qo00cQl0gvOLl-2BjChyaOdLpENao-3D	Get hash	malicious	Unknown	Browse	twiliosolutions.azurefd.net/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-0005.dual-s-msedge.net	FW_ FW_ DirectDeposit# 952759 _ Payment_ HSAAZDIXHI [ID_0024087].eml	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	52.123.128.14
	20250326_105213_E06iobGVLsebU2XlmUYXRv33mfADWIwk.eml	Get hash	malicious	Unknown	Browse	52.123.128.14
	20250326_105213_E06iobGVLsebU2XlmUYXRv33mfADWIwk.eml	Get hash	malicious	Unknown	Browse	52.123.129.14
	FW_ Malware_ [ID_0024077].eml	Get hash	malicious	Unknown	Browse	52.123.129.14
	d#U043e.xlsm	Get hash	malicious	Unknown	Browse	52.123.128.14
	phish_alert_sp2_2.0.0.0 (50).eml	Get hash	malicious	Unknown	Browse	52.123.129.14
	List_242508-02.docx.doc	Get hash	malicious	Unknown	Browse	52.123.128.14
	242508-02.docx.doc	Get hash	malicious	Unknown	Browse	52.123.128.14
	Merged%20documents.docx.doc	Get hash	malicious	Unknown	Browse	52.123.128.14
	List_242508-02.docx.doc	Get hash	malicious	Unknown	Browse	52.123.129.14
s-part-0013.t-0009.t-msedge.net	XRealStats.xlam	Get hash	malicious	Unknown	Browse	13.107.246.41
	XRealStats.xlam	Get hash	malicious	Unknown	Browse	13.107.246.41
	Pricing Analysis - Ecomm and Amazon vs List.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.41
	PURCHASE ORDER 517-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.41
	PURCHASE ORDER 517-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.41
	Pricing Analysis - Ecomm and Amazon vs List.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.41
	PURCHASE ORDER 517-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.41
	python312.dll	Get hash	malicious	Unknown	Browse	13.107.246.41
	https://www.flugger.pl/	Get hash	malicious	Unknown	Browse	13.107.246.41
	https://www.flugger.pl	Get hash	malicious	Unknown	Browse	13.107.246.41

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	Tftpd64_SE-4.64-setup.exe	Get hash	malicious	Unknown	Browse	20.190.190.131
	phishing.eml	Get hash	malicious	Unknown	Browse	52.123.247.79
	XRealStats.xlam	Get hash	malicious	Unknown	Browse	13.107.246.41
	XRealStats.xlam	Get hash	malicious	Unknown	Browse	13.107.246.41
	https://e23a311b.5f438d8b1fa34021ffea2c2f.workers.dev/&umid=ea64e973-4742-4a13-b7e6-f166cfb5aedf&auth=4c13a8eb8816953c02b02599c881676174c26b4b-2d2cb8f6bf763978670ab6e3d03aef460cd5c82c	Get hash	malicious	HTMLPhisher	Browse	13.107.9.156
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	52.111.227.28
	OdJqjzS22H.jar	Get hash	malicious	Can Stealer	Browse	204.79.197.203
	OdJqjzS22H.jar	Get hash	malicious	Can Stealer	Browse	204.79.197.203
	Pricing Analysis - Ecomm and Amazon vs List.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.41
	PURCHASE ORDER 517-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.41

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	XRealStats.xlam	Get hash	malicious	Unknown	Browse	13.107.246.41
	PURCHASE ORDER 517-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.41
	Pricing Analysis - Ecomm and Amazon vs List.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.41
	PURCHASE ORDER 517-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.41
	Loader.exe	Get hash	malicious	LummaC	Browse	13.107.246.41
	4UuBoHs64W.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.41
	tHmLxo3S58.exe	Get hash	malicious	LummaC Stealer, Stealc, Vidar	Browse	13.107.246.41
	4MlZyXN7Co.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.41
	3DTcqOJmxa.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.41
	hfRqL1uE9g.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.41

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Cognos\Office Connection\PAfE_Browser\runtimes\win-x64\native\WebView2Loader.dll	ep_setup.exe	Get hash	malicious	Unknown	Browse
	ep_setup.exe	Get hash	malicious	Unknown	Browse
	ep_setup.exe	Get hash	malicious	Unknown	Browse
	ep_setup.exe	Get hash	malicious	Unknown	Browse
	ep_setup.exe	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_1e6015f93d85f7b9e57857c379892348775dbb40.zip	Get hash	malicious	Unknown	Browse
	ep_setup (1).exe	Get hash	malicious	Unknown	Browse
	https://github.com/valinet/ExplorerPatcher/releases/download/22621.3007.63.4_91aaa82/ep_setup.exe	Get hash	malicious	Unknown	Browse
	https://github.com/valinet/ExplorerPatcher/releases/download/22621.3007.63.2_fb28688/ep_setup.exe	Get hash	malicious	Unknown	Browse
	https://github.com/valinet/ExplorerPatcher/releases/download/22621.2861.62.2_9b68cc0/ep_setup.exe	Get hash	malicious	Unknown	Browse

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.982886675915413
TrID:	Microsoft Excel Add in (1028004/3) 24.61% Microsoft Excel Add in (1015504/3) 24.31% Win32 Dynamic Link Library (generic) Net Framework (1011504/3) 24.21% Win32 Dynamic Link Library (generic) (1002004/3) 23.99% Windows ActiveX control (116523/4) 2.79%
File name:	IBM_PAfE_x86_2.0.91.10.xll
File size:	7'890'792 bytes
MD5:	723533fb01fcfbd0efe35a60565d7476
SHA1:	9deb47b7edd59febd3967c908ee704cc09888423
SHA256:	365d809aa3889e3e4b11f63da513df84af27ef6ed074f7a0c9f3e38d6afd3d90
SHA512:	561f3127b35c81743a676bea075f85593e685ec413763e6fa7316e1a7688b03f1e77a9caae6fbc2ed12d353358faba795938ee35824e3e87ac563b942e217dbc
SSDEEP:	196608:WDi+hkWysqZF8uUjixoQzsb6HLkG7hKWP5Dl:WDpCWqjjNSk7LkohKMDl
TLSH:	E2863322BFDADE25DEBE06BB82618120353DAB5D5F714FDBA603058A0910FC18675F27
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...M...M...M...&...M...&..9M...&...M...8...M...8...M...8...M...&...M...M...M...8...M...8...M...8M..M...8...M..Rich.M.........

Entrypoint:	0x100036f1
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	NX_COMPAT
Time Stamp:	0x6536E120 [Mon Oct 23 21:09:52 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	0d1f84f6c2b4bba2a12f1e0bd9352c88

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	04/01/2023 00:00:00 15/06/2024 00:59:59
Subject Chain	CN=International Business Machines Corporation, OU=IBM CCSS, O=International Business Machines Corporation, L=Armonk, S=New York, C=US
Version:	3
Thumbprint MD5:	3DA880BDDE217B4ADE98B520FA983017
Thumbprint SHA-1:	0F4CF912D1D86AE77C839C200CF0B39169320F8C
Thumbprint SHA-256:	F4FAB0BB37DB35E356DFAD9D7650F508B6A9B207A83CBBD59C6862CA4429BC07
Serial:	0560D75C229F51D749DF99E408CCD51E

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x31c50	0x135ec	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4523c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4d000	0x73a8ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x783e00	0x2968	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x788000	0x3d0c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x30738	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x30880	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x307a8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x28000	0x1c8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x26a09	0x26c00	ca7828dafbeabb5185e5288d4140686b	False	0.3491431451612903	data	5.239129194687003	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x28000	0x1db84	0x1dc00	7bcbb26ad958d6f916cb21710f40702f	False	0.40988543855042014	data	5.610700710235698	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x46000	0x65f0	0xa00	fa751fcf6b17a06193e0e38ffe9045f0	False	0.1875	data	2.6618886934048884	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4d000	0x73a8ac	0x73aa00	57edb45778e2da747b0f96d4503dc40b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x788000	0x3d0c	0x3e00	ffaedb0a5d1456db623c09cd35497600	False	0.3099168346774194	data	5.954987781711769	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
ASSEMBLY	0x4d9ec	0x13200	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	English	United States	0.4153518178104575
ASSEMBLY_LZMA	0x60bec	0x4baf	LZMA compressed data, non-streamed, size 44032			1.000825806451613
ASSEMBLY_LZMA	0x6579c	0x1e63cb	LZMA compressed data, non-streamed, size 5579776			1.0003108978271484
ASSEMBLY_LZMA	0x24bb68	0x2064	LZMA compressed data, non-streamed, size 20480			1.0013265798359865
ASSEMBLY_LZMA	0x24dbcc	0x15269	LZMA compressed data, non-streamed, size 254976			1.0004155460390383
ASSEMBLY_LZMA	0x262e38	0x2598	LZMA compressed data, non-streamed, size 25088			1.0011429758935992
ASSEMBLY_LZMA	0x2653d0	0x2452	LZMA compressed data, non-streamed, size 26112			1.001183050118305
ASSEMBLY_LZMA	0x267824	0x391d5	LZMA compressed data, non-streamed, size 1376256			1.000346241146272
ASSEMBLY_LZMA	0x2a09fc	0xe520	LZMA compressed data, non-streamed, size 171520			1.0004432624113475
ASSEMBLY_LZMA	0x2aef1c	0x6b26	LZMA compressed data, non-streamed, size 78336			1.0005833029529712
ASSEMBLY_LZMA	0x2b5a44	0x2f5dc	LZMA compressed data, non-streamed, size 838144			1.000340185143187
ASSEMBLY_LZMA	0x2e5020	0x34b88	LZMA compressed data, non-streamed, size 1047552			1.0003519430963583
ASSEMBLY_LZMA	0x319ba8	0x19e69	LZMA compressed data, non-streamed, size 325632			1.000386467965576
ASSEMBLY_LZMA	0x333a14	0xde74	LZMA compressed data, non-streamed, size 169984			1.0004565568588888
ASSEMBLY_LZMA	0x341888	0x4da00	LZMA compressed data, non-streamed, size 1100288			1.0003333836553945
ASSEMBLY_LZMA	0x38f288	0x9a5c	LZMA compressed data, non-streamed, size 144896			1.0005314303067112
ASSEMBLY_LZMA	0x398ce4	0x1cd04	LZMA compressed data, non-streamed, size 570880			1.000389764446704
ASSEMBLY_LZMA	0x3b59e8	0x2773	LZMA compressed data, non-streamed, size 25088			1.001089216754134
ASSEMBLY_LZMA	0x3b815c	0x9a0	LZMA compressed data, non-streamed, size 6144			1.0044642857142858
ASSEMBLY_LZMA	0x3b8afc	0xc874	LZMA compressed data, non-streamed, size 284064			1.0005066645880427
ASSEMBLY_LZMA	0x3c5370	0x44fb	LZMA compressed data, non-streamed, size 39840			1.0009060535704173
ASSEMBLY_LZMA	0x3c986c	0x13eeb	LZMA compressed data, non-streamed, size 342016			1.0003797018727876
ASSEMBLY_LZMA	0x3dd758	0x39253b	LZMA compressed data, non-streamed, size 7296512			1.0003108978271484
ASSEMBLY_LZMA	0x76fc94	0x497a	LZMA compressed data, non-streamed, size 51712			1.000850611376927
ASSEMBLY_LZMA	0x774610	0xfc3b	LZMA compressed data, non-streamed, size 134656			1.0004026575397624
DNA	0x78424c	0x790	XML 1.0 document, ASCII text, with CRLF line terminators			0.25206611570247933
RT_STRING	0x7849dc	0x40	data	English	United States	0.640625
RT_STRING	0x784a1c	0xfb8	data	English	United States	0.25646123260437376
RT_STRING	0x7859d4	0xcd0	data	English	United States	0.26371951219512196
RT_STRING	0x7866a4	0xca8	data	English	United States	0.2740740740740741
RT_VERSION	0x78734c	0x560	data	English	United States	0.37136627906976744

DLL	Import
KERNEL32.dll	GetLastError, LockResource, HeapReAlloc, RaiseException, LoadLibraryW, FindResourceExW, LoadResource, FindResourceW, HeapAlloc, DecodePointer, HeapDestroy, DeleteCriticalSection, GetProcessHeap, FreeLibrary, WideCharToMultiByte, MultiByteToWideChar, GetProcAddress, GetModuleHandleW, HeapSize, GetCurrentProcessId, GetModuleFileNameW, GetTempPathW, GetTempFileNameW, CreateFileW, WriteFile, CloseHandle, DeleteFileW, ReadFile, FormatMessageW, LocalFree, SetFilePointerEx, GetConsoleMode, GetConsoleOutputCP, FlushFileBuffers, SetStdHandle, InitializeCriticalSectionAndSpinCount, HeapFree, SetLastError, SizeofResource, GetStringTypeW, GetFileType, GetStdHandle, LCMapStringW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetCPInfo, GetOEMCP, WriteConsoleW, GetACP, IsDebuggerPresent, OutputDebugStringW, EnterCriticalSection, LeaveCriticalSection, SetEvent, ResetEvent, WaitForSingleObjectEx, CreateEventW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, InterlockedFlushSList, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, ExitProcess, GetModuleHandleExW, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage
USER32.dll	RealGetWindowClassW, GetWindowThreadProcessId, EnumWindows, MessageBoxW
ADVAPI32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
OLEAUT32.dll	SysFreeString, SysAllocString, VariantClear, VariantInit, SysAllocStringLen, SafeArrayLock, SafeArrayRedim, SafeArrayCreate, SafeArrayUnlock, SafeArrayDestroy, SafeArrayGetUBound, VariantCopyInd, SafeArrayGetLBound, SysStringLen
SHLWAPI.dll	PathFileExistsW, PathRenameExtensionW, PathRemoveFileSpecW, PathStripPathW, PathRemoveExtensionW

Description	Data
Comments	Unmanaged loader shim for Excel-DNA Add-Ins
CompanyName	Govert van Drimmelen; IBM
FileDescription	Excel-DNA Dynamic Link Library for IBM Cognos Analysis for Microsoft Excel
FileVersion	0.31.10.1
InternalName	ExcelDna
LegalCopyright	Excel-DNA add-in for Microsoft Excel is Copyright (C) 2005-2013 Govert van Drimmelen; IBM Cognos Analysis for Microsoft Excel is (C) Copyright IBM Corp. 2013
OriginalFilename	ExcelDna.xll
ProductName	IBM Cognos Analysis for Microsoft Excel/Excel-DNA addin for Microsoft Excel
ProductVersion	0.31.10.1
Translation	0x0800 0x04b0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 26, 2025 22:31:30.622869015 CET	53	62890	162.159.36.2	192.168.2.4
Mar 26, 2025 22:31:57.983973026 CET	58138	53	192.168.2.4	1.1.1.1
Mar 26, 2025 22:31:58.095449924 CET	53	58138	1.1.1.1	192.168.2.4

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 26, 2025 22:30:53.114001036 CET	1.1.1.1	192.168.2.4	0x6cda	No error (0)	ecs-office.s-0005.dual-s-msedge.net	s-0005.dual-s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 22:30:53.114001036 CET	1.1.1.1	192.168.2.4	0x6cda	No error (0)	s-0005.dual-s-msedge.net		52.123.128.14	A (IP address)	IN (0x0001)	false
Mar 26, 2025 22:30:53.114001036 CET	1.1.1.1	192.168.2.4	0x6cda	No error (0)	s-0005.dual-s-msedge.net		52.123.129.14	A (IP address)	IN (0x0001)	false
Mar 26, 2025 22:31:58.095449924 CET	1.1.1.1	192.168.2.4	0x9cee	No error (0)	otelrules.svc.static.microsoft	otelrules-bzhndjfje8dvh5fd.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 22:31:58.095449924 CET	1.1.1.1	192.168.2.4	0x9cee	No error (0)	otelrules-bzhndjfje8dvh5fd.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 22:31:58.095449924 CET	1.1.1.1	192.168.2.4	0x9cee	No error (0)	star-azurefd-prod.trafficmanager.net	shed.dual-low.s-part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 22:31:58.095449924 CET	1.1.1.1	192.168.2.4	0x9cee	No error (0)	shed.dual-low.s-part-0013.t-0009.t-msedge.net	s-part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 22:31:58.095449924 CET	1.1.1.1	192.168.2.4	0x9cee	No error (0)	s-part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:31:58 UTC	226	OUT	GET /rules/excel.exe-Production-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-26 21:31:58 UTC	493	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 21:31:58 GMT Content-Type: text/plain Content-Length: 1114783 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 24 Mar 2025 13:40:54 GMT ETag: "0x8DD6AD97FEF19EF" x-ms-request-id: c143ef55-001e-005a-3b72-9ec3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20250326T213158Z-17cccd5449bcdqb4hC1EWRt7pn00000007kg000000004gf2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-26 21:31:58 UTC	15891	IN	Data Raw: 31 30 30 30 34 32 76 32 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 34 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 55 58 2e 44 65 73 6b 74 6f 70 2e 4f 66 66 69 63 65 54 68 65 6d 65 2e 41 70 70 2e 49 6e 69 74 22 20 41 54 54 3d 22 63 34 33 38 38 63 39 37 37 32 39 37 34 31 33 62 62 30 35 34 62 61 64 31 61 63 66 30 61 64 65 31 2d 63 63 35 38 65 35 33 65 2d 66 35 61 34 2d 34 66 33 37 2d 62 30 64 32 2d 39 61 38 30 37 39 65 33 34 34 32 30 2d 36 38 37 39 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 63 6d 39 79 35 Data Ascii: 100042v2+<?xml version="1.0" encoding="utf-8"?><R Id="100042" V="2" DC="SM" EN="Office.UX.Desktop.OfficeTheme.App.Init" ATT="c4388c977297413bb054bad1acf0ade1-cc58e53e-f5a4-4f37-b0d2-9a8079e34420-6879" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="cm9y5
2025-03-26 21:31:58 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 30 31 31 37 76 30 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 31 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 38 79 6c 6c 66 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 56 20 56 3d 22 43 6c 69 63 6b 22 20 54 3d 22 57 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 Data Ascii: /> </T></R><$!#>100117v0+<?xml version="1.0" encoding="utf-8"?><R Id="100117" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="8yllf" /> </S> <C T="W" I="0" O="false"> <V V="Click" T="W" /> </C> <C T="U32
2025-03-26 21:31:58 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 37 38 31 76 31 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 37 38 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 67 6f 34 74 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 68 6c 76 79 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 49 33 32 Data Ascii: </C> <T> <S T="2" /> <S T="3" /> </T></R><$!#>10781v1+<?xml version="1.0" encoding="utf-8"?><R Id="10781" V="1" DC="SM" T="Subrule" xmlns=""> <S> <UTS T="1" Id="bgo4t" /> <UTS T="2" Id="bhlvy" /> </S> <C T="I32
2025-03-26 21:31:58 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 30 30 30 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: <L> <O T="GT"> <L> <S T="1" F="0" /> </L> <R> <V V="1000" T="U32" /> </R> </O> </L> <R> <O T="LE"> <
2025-03-26 21:31:58 UTC	16384	IN	Data Raw: 20 49 3d 22 32 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 56 69 64 65 6f 43 61 6c 6c 56 69 64 65 6f 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 36 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 33 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 53 61 53 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 34 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 4f 76 65 72 66 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 Data Ascii: I="22" O="false" N="FlyoutVideoCallVideo"> <C> <S T="26" /> </C> </C> <C T="U32" I="23" O="false" N="FlyoutSaS"> <C> <S T="27" /> </C> </C> <C T="U32" I="24" O="false" N="FlyoutOverflow"> <C> <S T
2025-03-26 21:31:58 UTC	16384	IN	Data Raw: 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 39 30 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 4e 44 42 2e 55 6e 6b 6e 6f 77 6e 2e 43 6f 72 72 75 70 74 69 6f 6e 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 53 3d 22 31 30 30 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 45 74 77 20 54 3d 22 31 22 20 45 3d 22 33 39 35 22 20 47 3d 22 7b 32 61 64 66 38 65 32 33 2d 30 61 66 39 2d Data Ascii: coding="utf-8"?><R Id="10907" V="0" DC="SM" EN="Office.Outlook.Desktop.NDB.Unknown.Corruption" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" S="100" DCa="PSU" xmlns=""> <S> <Etw T="1" E="395" G="{2adf8e23-0af9-
2025-03-26 21:31:58 UTC	16384	IN	Data Raw: 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 33 22 20 49 64 3d 22 62 70 66 79 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 34 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 50 68 6f 74 6f 53 69 7a 65 49 6e 42 79 74 65 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 55 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 Data Ascii: "TelemetryShutdown" /> <UTS T="3" Id="bpfy1" /> <F T="4"> <O T="GT"> <L> <S T="3" F="PhotoSizeInBytes" /> </L> <R> <V V="0" T="U64" /> </R> </O> </F> </S> <C T="U
2025-03-26 21:31:58 UTC	16384	IN	Data Raw: 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 65 76 65 6e 74 49 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 33 35 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 74 63 69 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <L> <S T="4" F="eventId" /> </L> <R> <V V="135" T="I32" /> </R> </O> </F> <F T="7"> <O T="EQ"> <L> <S T="5" F="tcid" /> </L> <R> <V
2025-03-26 21:31:58 UTC	16384	IN	Data Raw: 0d 0a 20 20 20 20 3c 46 20 54 3d 22 31 30 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 46 69 6c 65 50 72 6f 74 65 63 74 69 6f 6e 53 74 61 74 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 35 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 4f 66 54 68 72 6f 77 6e 45 78 63 65 70 74 69 6f 6e 22 3e 0d Data Ascii: <F T="10"> <O T="EQ"> <L> <S T="3" F="FileProtectionState" /> </L> <R> <V V="5" T="U32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="CountOfThrownException">
2025-03-26 21:31:58 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 72 65 73 75 6c 74 73 5f 49 73 4e 75 6c 6c 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 Data Ascii: <S T="5" F="results_IsNull" /> </L> <R> <V V="false" T="B" /> </R> </O> </L> <R> <O T="EQ"> <L>

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:32:05 UTC	214	OUT	GET /rules/rule120603v8s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-26 21:32:05 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 21:32:05 GMT Content-Type: text/xml Content-Length: 2128 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA41F3C62" x-ms-request-id: 788ac460-101e-0028-1057-9e8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20250326T213205Z-186b855ff67p8kbrhC1NYCh33g0000000hwg000000000hk6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-26 21:32:05 UTC	2128	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 33 22 20 56 3d 22 38 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 64 64 69 74 69 6f 6e 61 6c 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 45 3d 22 66 61 6c 73 65 22 20 44 4c 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120603" V="8" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAdditional" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" E="false" DL=

Timestamp	Bytes transferred	Direction	Data
2025-03-26 21:32:05 UTC	214	OUT	GET /rules/rule120607v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-26 21:32:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 21:32:05 GMT Content-Type: text/xml Content-Length: 204 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6C8527A" x-ms-request-id: fe09a350-901e-0048-3adf-9cb800000000 x-ms-version: 2018-03-28 x-azure-ref: 20250326T213205Z-17cccd5449bkk7bshC1EWR4rww0000000hq000000000g51b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-26 21:32:05 UTC	204	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 37 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 45 52 3d 22 31 32 30 36 30 33 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 62 70 7a 73 22 20 41 3d 22 39 34 30 74 63 20 39 78 35 6a 73 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120607" V="1" DC="SM" T="Subrule" ER="120603" xmlns=""> <S> <UTS T="1" Id="bbpzs" A="940tc 9x5js" /> </S> <T> <S T="1" /> </T></R>

Target ID:	0
Start time:	17:30:49
Start date:	26/03/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /C "C:\Users\user\Desktop\IBM_PAfE_x86_2.0.91.10.xll"
Imagebase:	0xc70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	4
Start time:	17:30:56
Start date:	26/03/2025
Path:	C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Cognos\Office Connection\SessionMonitor\CognosSessionMonitor.exe" 7748
Imagebase:	0x1e5fe6a0000
File size:	21'352 bytes
MD5 hash:	0614D83EE1D82EC45B85A5F2D4AF3F3B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report IBM_PAfE_x86_2.0.91.10.xll

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Privilege Escalation

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Cognos\Office Connection\CognosOfficeReportingSettings.xml

C:\Users\user\AppData\Local\Cognos\Office Connection\CognosSessionManager.xml

C:\Users\user\AppData\Local\Cognos\Office Connection\CommManagerSettings.xml

C:\Users\user\AppData\Local\Cognos\Office Connection\Config.xml

C:\Users\user\AppData\Local\Cognos\Office Connection\EULAs\Cognos.Office.Reporting.Resource.EULA.EULA.cs.resources

C:\Users\user\AppData\Local\Cognos\Office Connection\EULAs\Cognos.Office.Reporting.Resource.EULA.EULA.de.resources

C:\Users\user\AppData\Local\Cognos\Office Connection\EULAs\Cognos.Office.Reporting.Resource.EULA.EULA.el.resources

C:\Users\user\AppData\Local\Cognos\Office Connection\EULAs\Cognos.Office.Reporting.Resource.EULA.EULA.en.resources

C:\Users\user\AppData\Local\Cognos\Office Connection\EULAs\Cognos.Office.Reporting.Resource.EULA.EULA.es.resources

C:\Users\user\AppData\Local\Cognos\Office Connection\EULAs\Cognos.Office.Reporting.Resource.EULA.EULA.fr.resources

C:\Users\user\AppData\Local\Cognos\Office Connection\EULAs\Cognos.Office.Reporting.Resource.EULA.EULA.id.resources

C:\Users\user\AppData\Local\Cognos\Office Connection\EULAs\Cognos.Office.Reporting.Resource.EULA.EULA.it.resources

C:\Users\user\AppData\Local\Cognos\Office Connection\EULAs\Cognos.Office.Reporting.Resource.EULA.EULA.ja.resources

C:\Users\user\AppData\Local\Cognos\Office Connection\EULAs\Cognos.Office.Reporting.Resource.EULA.EULA.ko.resources

C:\Users\user\AppData\Local\Cognos\Office Connection\EULAs\Cognos.Office.Reporting.Resource.EULA.EULA.lt.resources

C:\Users\user\AppData\Local\Cognos\Office Connection\EULAs\Cognos.Office.Reporting.Resource.EULA.EULA.pl.resources

C:\Users\user\AppData\Local\Cognos\Office Connection\EULAs\Cognos.Office.Reporting.Resource.EULA.EULA.pt.resources

C:\Users\user\AppData\Local\Cognos\Office Connection\EULAs\Cognos.Office.Reporting.Resource.EULA.EULA.resources

Windows Analysis Report
IBM_PAfE_x86_2.0.91.10.xll

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre