Windows Analysis Report
https://c.web.de/@337550745597380876/74ahEl4NT1un_FYZa8msnw

Overview

General Information

Sample URL: https://c.web.de/@337550745597380876/74ahEl4NT1un_FYZa8msnw
Analysis ID: 1500454
Infos:

Detection

Score: 3
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

Detected non-DNS traffic on DNS port
HTML body with high number of embedded SVGs detected
HTML page contains hidden javascript code
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Stores files to the Windows start menu directory

Classification

HTML body with high number of embedded SVGs detected
Source: https://c.web.de/@337550745597380876/74ahEl4NT1un_FYZa8msnw HTTP Parser: Total embedded SVG size: 156283
HTML page contains hidden javascript code
Source: https://c.web.de/@337550745597380876/74ahEl4NT1un_FYZa8msnw HTTP Parser: Base64 decoded: spfgoto=/onlinespeicher_erweitern&spfportal=produkte&mc=undefined
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.167.17.97:443 -> 192.168.2.16:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.16:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.16:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:53306 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:53307 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:53308 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:53309 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:53932 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:53935 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53941 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53939 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53940 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53938 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53937 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:53948 version: TLS 1.2
Source: excel.exe Memory has grown: Private usage: 19MB later: 71MB
Source: chrome.exe Memory has grown: Private usage: 7MB later: 30MB
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.16:53929 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:53305 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:53929 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:53305 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:53929 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:53305 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:53929 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:53305 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:53929 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:53305 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:53929 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:53305 -> 1.1.1.1:53
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 52.167.17.97
Source: unknown TCP traffic detected without corresponding DNS query: 52.167.17.97
Source: unknown TCP traffic detected without corresponding DNS query: 52.167.17.97
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 52.167.17.97
Source: unknown TCP traffic detected without corresponding DNS query: 52.167.17.97
Source: global traffic DNS traffic detected: DNS query: c.web.de
Source: global traffic DNS traffic detected: DNS query: s.uicdn.com
Source: global traffic DNS traffic detected: DNS query: dl.web.de
Source: global traffic DNS traffic detected: DNS query: uim.tifbs.net
Source: global traffic DNS traffic detected: DNS query: img.ui-portal.de
Source: global traffic DNS traffic detected: DNS query: wa.web.de
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: sdthumbs.ui-static.net
Source: global traffic DNS traffic detected: DNS query: img.web.de
Source: global traffic DNS traffic detected: DNS query: cgateu01we.storage-webde.de
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 53944 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53311 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 53938 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53941 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53935 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53314 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53308 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53942 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53313 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53307 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53950 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown Network traffic detected: HTTP traffic on port 53948 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53940 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53309 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53935
Source: unknown Network traffic detected: HTTP traffic on port 53945 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53939
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53938
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53937
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53932
Source: unknown Network traffic detected: HTTP traffic on port 53310 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53939 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53309
Source: unknown Network traffic detected: HTTP traffic on port 53946 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53308
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53946
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53307
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53945
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53306
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53944
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53948
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53943
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53942
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53941
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53940
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53932 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53312
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53950
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53311
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53310
Source: unknown Network traffic detected: HTTP traffic on port 53943 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53314
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53313
Source: unknown Network traffic detected: HTTP traffic on port 53312 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53306 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 53937 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.167.17.97:443 -> 192.168.2.16:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.16:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.16:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:53306 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:53307 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:53308 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:53309 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:53932 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:53935 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53941 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53939 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53940 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53938 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.57:443 -> 192.168.2.16:53937 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:53948 version: TLS 1.2
Source: classification engine Classification label: clean3.win@22/24@34/126
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\{6CA4AA6A-901C-40CE-BF79-9989D1EB488F} - OProcSessId.dat
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File read: C:\Users\desktop.ini
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://c.web.de/@337550745597380876/74ahEl4NT1un_FYZa8msnw
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1948,i,2416684251995544226,11427346836613146946,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1948,i,2416684251995544226,11427346836613146946,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Downloads\57361.xlsx"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\user\Downloads\57361.xlsx"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
52.113.194.132
 unknown United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
142.250.185.68
 unknown United States
15169 GOOGLEUS false
1.1.1.1
 unknown Australia
13335 CLOUDFLARENETUS false
34.104.35.123
 unknown United States
15169 GOOGLEUS false
184.27.96.196
 unknown United States
7016 CCCH-3US false
51.132.193.105
 unknown United Kingdom
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
74.125.133.84
 unknown United States
15169 GOOGLEUS false
13.107.246.57
 s-part-0029.t-0009.t-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
142.250.186.163
 unknown United States
15169 GOOGLEUS false
217.72.199.4
 cloud.web.de Germany
8560 ONEANDONE-ASBrauerstrasse48DE false
195.20.251.162
 sdthumbs.ui-static.net Germany
8560 ONEANDONE-ASBrauerstrasse48DE false
195.20.251.111
 uim-tifbs.ha-cdn.de Germany
8560 ONEANDONE-ASBrauerstrasse48DE false
82.165.229.39
 wa.web.de Germany
8560 ONEANDONE-ASBrauerstrasse48DE false
52.109.68.129
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
239.255.255.250
 unknown Reserved
unknown unknown false
142.250.185.164
 www.google.com United States
15169 GOOGLEUS false
195.20.251.168
 cgateu01we.g-ha-web.de Germany
8560 ONEANDONE-ASBrauerstrasse48DE false
52.109.28.46
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
142.250.185.195
 unknown United States
15169 GOOGLEUS false
184.28.90.27
 unknown United States
16625 AKAMAI-ASUS false
142.250.184.206
 unknown United States
15169 GOOGLEUS false

Private

IP
192.168.2.16

Contacted Domains

Name IP Active
wa.web.de 82.165.229.39 true
cgateu01we.g-ha-web.de 195.20.251.168 true
uim-tifbs.ha-cdn.de 195.20.251.111 true
www.google.com 142.250.185.164 true
sdthumbs.ui-static.net 195.20.251.162 true
cloud.web.de 217.72.199.4 true
s-part-0032.t-0009.t-msedge.net 13.107.246.60 true
s-part-0029.t-0009.t-msedge.net 13.107.246.57 true
img.web.de unknown unknown
s.uicdn.com unknown unknown
c.web.de unknown unknown
cgateu01we.storage-webde.de unknown unknown
dl.web.de unknown unknown
img.ui-portal.de unknown unknown
uim.tifbs.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://c.web.de/@337550745597380876/74ahEl4NT1un_FYZa8msnw false
    		unknown