IOC Report
https://euc-excel.officeapps.live.com/x/_layouts/xlviewerinternal.aspx?unified=1&ui=ca-ES&rs=es-ES&wopisrc=https%3A%2F%2Funiversitatdevic.sharepoint.com%2Fteams%2FEdP-Equip%2F_vti_bin%2Fwopi.ashx%2Ffiles%2F1a602db243354254b5c6726a082e17a2&wdorigin=OFFICECOM-WEB.START.REC&wdprevioussessionsrc=Harmony

loading gif

Files

File Path
Type
Category
Malicious
Chrome Cache Entry: 100
Unicode text, UTF-8 text, with very long lines (64201), with no line terminators
downloaded
Chrome Cache Entry: 101
Unicode text, UTF-8 text, with no line terminators
downloaded
Chrome Cache Entry: 102
ASCII text, with very long lines (590)
dropped
Chrome Cache Entry: 103
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 104
ASCII text, with very long lines (65446), with CRLF line terminators
dropped
Chrome Cache Entry: 105
ASCII text, with very long lines (62133), with no line terminators
downloaded
Chrome Cache Entry: 106
Unicode text, UTF-8 text, with very long lines (55776)
dropped
Chrome Cache Entry: 107
ASCII text, with very long lines (691)
downloaded
Chrome Cache Entry: 108
ASCII text, with very long lines (8536)
dropped
Chrome Cache Entry: 109
Unicode text, UTF-8 text, with very long lines (65477), with no line terminators
dropped
Chrome Cache Entry: 110
Unicode text, UTF-8 text, with no line terminators
dropped
Chrome Cache Entry: 111
TrueType Font data, 24 tables, 1st "GDEF", 58 names, Unicode, \251 2017 The Monotype Corporation. All Rights Reserved.
downloaded
Chrome Cache Entry: 112
Unicode text, UTF-8 text, with very long lines (65477), with no line terminators
downloaded
Chrome Cache Entry: 113
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 114
Unicode text, UTF-8 text, with very long lines (64414), with no line terminators
downloaded
Chrome Cache Entry: 115
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 116
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 117
ASCII text, with very long lines (62133), with no line terminators
dropped
Chrome Cache Entry: 118
MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
downloaded
Chrome Cache Entry: 119
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 120
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 121
ASCII text, with very long lines (33360)
downloaded
Chrome Cache Entry: 122
C source, ASCII text, with very long lines (825)
dropped
Chrome Cache Entry: 123
Unicode text, UTF-8 text, with very long lines (55776)
downloaded
Chrome Cache Entry: 124
ASCII text, with very long lines (699)
downloaded
Chrome Cache Entry: 125
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 126
ASCII text, with very long lines (691)
dropped
Chrome Cache Entry: 127
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 128
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 129
ASCII text, with very long lines (699)
dropped
Chrome Cache Entry: 79
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 80
ASCII text, with very long lines (644)
downloaded
Chrome Cache Entry: 81
ASCII text, with very long lines (8536)
downloaded
Chrome Cache Entry: 82
ASCII text, with very long lines (33360)
dropped
Chrome Cache Entry: 83
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 84
Unicode text, UTF-8 text, with very long lines (65530), with no line terminators
downloaded
Chrome Cache Entry: 85
ASCII text, with very long lines (65467)
downloaded
Chrome Cache Entry: 86
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 87
ASCII text, with very long lines (65446), with CRLF line terminators
downloaded
Chrome Cache Entry: 88
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 89
Unicode text, UTF-8 text, with very long lines (65530), with no line terminators
dropped
Chrome Cache Entry: 90
ASCII text, with very long lines (65467)
dropped
Chrome Cache Entry: 91
C source, ASCII text, with very long lines (825)
downloaded
Chrome Cache Entry: 92
Unicode text, UTF-8 text, with very long lines (64201), with no line terminators
dropped
Chrome Cache Entry: 93
ASCII text, with very long lines (644)
dropped
Chrome Cache Entry: 94
Unicode text, UTF-8 text, with very long lines (64414), with no line terminators
dropped
Chrome Cache Entry: 95
ASCII text, with very long lines (590)
downloaded
Chrome Cache Entry: 96
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 97
C source, ASCII text, with very long lines (604)
downloaded
Chrome Cache Entry: 98
MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
dropped
Chrome Cache Entry: 99
C source, ASCII text, with very long lines (604)
dropped
There are 42 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1984,i,8733658070340134704,425223869410374193,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://euc-excel.officeapps.live.com/x/_layouts/xlviewerinternal.aspx?unified=1&ui=ca-ES&rs=es-ES&wopisrc=https%3A%2F%2Funiversitatdevic.sharepoint.com%2Fteams%2FEdP-Equip%2F_vti_bin%2Fwopi.ashx%2Ffiles%2F1a602db243354254b5c6726a082e17a2&wdorigin=OFFICECOM-WEB.START.REC&wdprevioussessionsrc=HarmonyWeb&wdprevioussession=f83ebcdf-f3b3-4911-bade-ab836c0f140a&wdenableroaming=1&mscc=1&hid=AF975EA1-007C-A000-3814-6E56C0E10F40.0&uih=sharepointcom&wdlcid=ca-ES&jsapi=1&jsapiver=v2&corrid=9003efda-e234-9141-1c55-4f48ddfbee55&usid=9003efda-e234-9141-1c55-4f48ddfbee55&newsession=1&sftc=1&uihit=docaspx&muv=1&cac=1&sams=1&mtf=1&sfp=1&sdp=1&hch=1&hwfh=1&dchat=1&sc=%7B%22pmo%22%3A%22https%3A%2F%2Funiversitatdevic.sharepoint.com%22%2C%22pmshare%22%3Atrue%7D&preseededsessionkey=0d1dd148-01db-49e0-20ab-81678010248d&preseededwacsessionid=9003efda-e234-9141-1c55-4f48ddfbee55&ctp=LeastProtected&rct=Normal&wdhostclicktime=1730189074252&wdredirectionreason=Force_SingleStepBoot&xlel=1&instantedi"

URLs

Name
IP
Malicious
https://euc-excel.officeapps.live.com/x/_layouts/xlviewerinternal.aspx?unified=1&ui=ca-ES&rs=es-ES&wopisrc=https%3A%2F%2Funiversitatdevic.sharepoint.com%2Fteams%2FEdP-Equip%2F_vti_bin%2Fwopi.ashx%2Ffiles%2F1a602db243354254b5c6726a082e17a2&wdorigin=OFFICECOM-WEB.START.REC&wdprevioussessionsrc=HarmonyWeb&wdprevioussession=f83ebcdf-f3b3-4911-bade-ab836c0f140a&wdenableroaming=1&mscc=1&hid=AF975EA1-007C-A000-3814-6E56C0E10F40.0&uih=sharepointcom&wdlcid=ca-ES&jsapi=1&jsapiver=v2&corrid=9003efda-e234-9141-1c55-4f48ddfbee55&usid=9003efda-e234-9141-1c55-4f48ddfbee55&newsession=1&sftc=1&uihit=docaspx&muv=1&cac=1&sams=1&mtf=1&sfp=1&sdp=1&hch=1&hwfh=1&dchat=1&sc=%7B%22pmo%22%3A%22https%3A%2F%2Funiversitatdevic.sharepoint.com%22%2C%22pmshare%22%3Atrue%7D&preseededsessionkey=0d1dd148-01db-49e0-20ab-81678010248d&preseededwacsessionid=9003efda-e234-9141-1c55-4f48ddfbee55&ctp=LeastProtected&rct=Normal&wdhostclicktime=1730189074252&wdredirectionreason=Force_SingleStepBoot&xlel=1&instantedi
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/EwaTS.js.map/8503d3ef5ff25c5b5b078d0b1211
unknown
https://feross.org
unknown
https://feross.org/opensource
unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/richTextEditor.min.js.map/3cceeb057ff3324
unknown
https://js.live.net/v5.0/wl.ms.js
unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/common.min.js.map/0443bb03add7ee0aace44fd
unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/EwaTS.vrs.js.map/2f5686a84d289e5494259fa1
unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/appChrome.min.js.map/254c1dbba441c914a21b
unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/EwaTS.rt.js.map/68c98deffdd58e60d9b11e1c4
unknown
https://aka.ms/AddinShortcutsHelpWeb
unknown
http://contoso.sharepoint.com/
unknown
http://mywebservice.com/serviceEndpoint?searchString=Excel
unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/runtime.min.js.map/d90a8e049f826df7bd2324
unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/EwaTS.bootCommon.js.map/d2bdcc297ffc2231a
unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/EwaTS.policycheck.js.map/2d7b5bfa76362b40
unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/EwaTS.cl.js.map/756ad555e85690463be58d7a7
unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/EwaTS.licensecheck.js.map/16205b58d37f003
unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/EwaTS.fo.js.map/b8c2fd07144bf07c10236efa8
unknown
There are 8 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
wac-0003.wac-msedge.net
52.108.8.12
s-part-0014.t-0009.fb-t-msedge.net
13.107.253.42
s-part-0017.t-0009.t-msedge.net
13.107.246.45
www.google.com
172.217.16.196

IPs

IP
Domain
Country
Malicious
192.168.2.4
unknown
unknown
52.108.8.12
wac-0003.wac-msedge.net
United States
239.255.255.250
unknown
Reserved
192.168.2.15
unknown
unknown
184.28.90.27
unknown
United States
172.217.16.196
www.google.com
United States

DOM / HTML

URL
Malicious
https://euc-excel.officeapps.live.com/x/_layouts/xlviewerinternal.aspx?unified=1&ui=ca-ES&rs=es-ES&wopisrc=https%3A%2F%2Funiversitatdevic.sharepoint.com%2Fteams%2FEdP-Equip%2F_vti_bin%2Fwopi.ashx%2Ffiles%2F1a602db243354254b5c6726a082e17a2&wdorigin=OFFICECOM-WEB.START.REC&wdprevioussessionsrc=HarmonyWeb&wdprevioussession=f83ebcdf-f3b3-4911-bade-ab836c0f140a&wdenableroaming=1&mscc=1&hid=AF975EA1-007C-A000-3814-6E56C0E10F40.0&uih=sharepointcom&wdlcid=ca-ES&jsapi=1&jsapiver=v2&corrid=9003efda-e234-9141-1c55-4f48ddfbee55&usid=9003efda-e234-9141-1c55-4f48ddfbee55&newsession=1&sftc=1&uihit=docaspx&muv=1&cac=1&sams=1&mtf=1&sfp=1&sdp=1&hch=1&hwfh=1&dchat=1&sc=%7B%22pmo%22%3A%22https%3A%2F%2Funiversitatdevic.sharepoint.com%22%2C%22pmshare%22%3Atrue%7D&preseededsessionkey=0d1dd148-01db-49e0-20ab-81678010248d&preseededwacsessionid=9003efda-e234-9141-1c55-4f48ddfbee55&ctp=LeastProtected&rct=Normal&wdhostclicktime=1730189074252&wdredirectionreason=Force_SingleStepBoot&xlel=1&instantedi
https://euc-excel.officeapps.live.com/x/_layouts/xlviewerinternal.aspx?unified=1&ui=ca-ES&rs=es-ES&wopisrc=https%3A%2F%2Funiversitatdevic.sharepoint.com%2Fteams%2FEdP-Equip%2F_vti_bin%2Fwopi.ashx%2Ffiles%2F1a602db243354254b5c6726a082e17a2&wdorigin=OFFICECOM-WEB.START.REC&wdprevioussessionsrc=HarmonyWeb&wdprevioussession=f83ebcdf-f3b3-4911-bade-ab836c0f140a&wdenableroaming=1&mscc=1&hid=AF975EA1-007C-A000-3814-6E56C0E10F40.0&uih=sharepointcom&wdlcid=ca-ES&jsapi=1&jsapiver=v2&corrid=9003efda-e234-9141-1c55-4f48ddfbee55&usid=9003efda-e234-9141-1c55-4f48ddfbee55&newsession=1&sftc=1&uihit=docaspx&muv=1&cac=1&sams=1&mtf=1&sfp=1&sdp=1&hch=1&hwfh=1&dchat=1&sc=%7B%22pmo%22%3A%22https%3A%2F%2Funiversitatdevic.sharepoint.com%22%2C%22pmshare%22%3Atrue%7D&preseededsessionkey=0d1dd148-01db-49e0-20ab-81678010248d&preseededwacsessionid=9003efda-e234-9141-1c55-4f48ddfbee55&ctp=LeastProtected&rct=Normal&wdhostclicktime=1730189074252&wdredirectionreason=Force_SingleStepBoot&xlel=1&instantedi