Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Documents_111651917_375818984.xls

Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Last Saved By: 5, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon May 3 14:24:59 2021, Security: 0

initial sample

Details

Filetype:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Last Saved By: 5, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon May 3 14:24:59 2021, Security: 0
Entropy:	3.330043919784793
Filename:	Documents_111651917_375818984.xls
Filesize:	300032
MD5:	72526a505496a9b7da9a6c9651dbda5e
SHA1:	84cf963666314eee0d8ad1ef09e5462a66e3ccbf
SHA256:	3c20530c13d6736ec705786d1694052b2abf42bf87d3bbc359ea95b343fcf681
SHA512:	ca1ac0057d9ede44a1d9ecf9f854140a39b9b626895c85f34fbf973b8ee749fa2fbd836bc882e9ca2fab7929a9aecb790d7e795ea55a32ce66d6ee1d078afe46
SSDEEP:	6144:KcPiTQAVW/89BQnmlcGvgZ7r3J8b5IPJK++3ey:uqy
Preview:	........................>.......................H...........................C...D...E...F...G..................................................................................................................................................................

Signature Hits	Behavior Group	Mitre Attack
Found Excel 4.0 Macro with suspicious formulas	System Summary	Security Software Discovery
Found abnormal large hidden Excel 4.0 Macro sheet	System Summary
Document contains embedded VBA macros	System Summary	Scripting Security Software Discovery
Yara signature match	System Summary
Document contains an OLE Workbook stream indicating a Microsoft Excel file	System Summary	Security Software Discovery

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\vegas[1].dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

downloaded

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\vegas[1].dll
IE cache URL:	https://otusmail.com/b/vegas.dll
Category:	downloaded
Dump:	vegas[1].dll.0.dr
ID:	dr_6
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	5.949946336029269
Encrypted:	false
Ssdeep:	12288:ga6g2O+gAaY9cc40TeAjaRoA5FZuY+F4:gZlOBAaY9RCy05FZuYq
Size:	525312
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Document exploit detected (creates forbidden files)	Software Vulnerabilities	Exploitation for Client Execution
Office process drops PE file	System Summary
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

C:\Users\user\bsdnbsej.dbw

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\bsdnbsej.dbw
Category:	dropped
Dump:	bsdnbsej.dbw.0.dr
ID:	dr_7
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	5.949946336029269
Encrypted:	false
Ssdeep:	12288:ga6g2O+gAaY9cc40TeAjaRoA5FZuY+F4:gZlOBAaY9RCy05FZuYq
Size:	525312
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files to the user root directory	Boot Survival	Masquerading
Office process drops PE file	System Summary
Drops PE files	Persistence and Installation Behavior
Drops PE files to the user directory	Persistence and Installation Behavior	Masquerading
Drops files with a non-matching file extension (content does not match file extension)	Persistence and Installation Behavior	Masquerading

C:\Users\user\AppData\Local\Temp\06CE0000

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\06CE0000
Category:	dropped
Dump:	06CE0000.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	data
Entropy:	7.896549073080212
Encrypted:	false
Ssdeep:	1536:j+mgXtzCN/ynI4rIEOzU2mSBPDa6pDwoXAeWvie2HWCWGHKlMVGoIahaDHTU6hr2:j+mgXGOOja6pDdAizWCW2K2sTU2yF70G
Size:	97222
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Tue May 4 07:06:36 2021, atime=Tue May 4 07:06:36 2021, length=12288, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
Category:	dropped
Dump:	Desktop.LNK.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Tue May 4 07:06:36 2021, atime=Tue May 4 07:06:36 2021, length=12288, window=hide
Entropy:	4.471309463237221
Encrypted:	false
Ssdeep:	12:85QdG0LgXg/XAlCPCHaXgzB8IB/LmX+WnicvbGCd+bDtZ3YilMMEpxRljKBwTdJU:85c/XTwz6I0YeiCkDv3qy8rNru/
Size:	867
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Documents_111651917_375818984.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:13 2020, mtime=Tue May 4 07:06:36 2021, atime=Tue May 4 07:06:36 2021, length=123904, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Documents_111651917_375818984.LNK
Category:	dropped
Dump:	Documents_111651917_375818984.LNK.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:13 2020, mtime=Tue May 4 07:06:36 2021, atime=Tue May 4 07:06:36 2021, length=123904, window=hide
Entropy:	4.509927331022281
Encrypted:	false
Ssdeep:	48:8jZ/XT3InYTHldT43Qh2jZ/XT3InYTHldT43Q/:8jZ/XLInYBW3Qh2jZ/XLInYBW3Q/
Size:	2218
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
Category:	dropped
Dump:	index.dat.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	ASCII text, with CRLF line terminators
Entropy:	4.747564355627999
Encrypted:	false
Ssdeep:	3:oyBVomMU9UjaWedPFo5S/9UjaWedPFomMU9UjaWedPFov:dj6CUXCPFySlUXCPF6CUXCPFy
Size:	140
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\VPKC7C2S.txt

ASCII text

downloaded

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\VPKC7C2S.txt
IE cache URL:	otusmail.com/
Category:	downloaded
Dump:	VPKC7C2S.txt.0.dr
ID:	dr_5
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	ASCII text
Entropy:	4.352150128673656
Encrypted:	false
Ssdeep:	3:GmM/RVlG6XBW5BWQENMVWEQSRQPHKKvcSNZPVtr5WX9W3pN:XM/RVlG8BW5BWfNcWEHQSKE8n1WWT
Size:	114
Whitelisted:	false
Reputation:	low

C:\Users\user\Desktop\C6CE0000

Applesoft BASIC program data, first line number 16

dropped

Details

File:	C:\Users\user\Desktop\C6CE0000
Category:	dropped
Dump:	C6CE0000.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	Applesoft BASIC program data, first line number 16
Entropy:	6.290384078644883
Encrypted:	false
Ssdeep:	3072:Gu8rmjAItyzElBIL6lECbgBGGP5xLm7Tm2nTUSyF70Si6W23nWknWju8rmjAItyy:P8rmjAItyzElBIL6lECbgBvP5Nm7ThU7
Size:	178930
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	2064
Target ID:	0
Parent PID:	584
Name:	EXCEL.EXE
Class:	excel
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Size:	27641504
MD5:	5FB0A0F93382ECD19F5F499A5CAA59F0
Time:	01:06:32
Date:	04/05/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x13fa20000
Modulesize:	27758592
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\System32\rundll32.exe

rundll32 ..\bsdnbsej.dbw,PluginInit

Details

Is windows:	true
Is dropped:	false
PID:	2564
Target ID:	3
Parent PID:	2064
Name:	rundll32.exe
Class:	rundll32
Path:	C:\Windows\System32\rundll32.exe
Commandline:	rundll32 ..\bsdnbsej.dbw,PluginInit
Size:	45568
MD5:	DD81D91FF3B0763C392422865C9AC12E
Time:	01:06:37
Date:	04/05/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xffad0000
Modulesize:	61440
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Document exploit detected (process start blacklist hit)	Software Vulnerabilities	Exploitation for Client Execution
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Runs a DLL by calling functions	System Summary	Rundll32
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\rundll32.exe

rundll32 ..\bsdnbsej.dbw,PluginInit

Details

Is windows:	true
Is dropped:	false
PID:	2484
Target ID:	4
Parent PID:	2564
Name:	rundll32.exe
Class:	system-tools
Path:	C:\Windows\SysWOW64\rundll32.exe
Commandline:	rundll32 ..\bsdnbsej.dbw,PluginInit
Size:	44544
MD5:	51138BEEA3E2C21EC44D0932C71762A8
Time:	01:06:37
Date:	04/05/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xef0000
Modulesize:	57344
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Document exploit detected (process start blacklist hit)	Software Vulnerabilities	Exploitation for Client Execution
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Runs a DLL by calling functions	System Summary	Rundll32
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check

unknown

Details

Name:	http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
TargetID:	3
From Memory:	true
Current Path:	C:\Windows\System32\rundll32.exe
Source:	rundll32.exe, 00000003.00000002.2174265271.0000000001CC7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2173529258.0000000000B47000.00000002.00000001.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://www.windows.com/pctv.

unknown

Details

Name:	http://www.windows.com/pctv.
TargetID:	4
From Memory:	true
Current Path:	C:\Windows\SysWOW64\rundll32.exe
Source:	rundll32.exe, 00000004.00000002.2173337440.0000000000960000.00000002.00000001.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://investor.msn.com

unknown

Details

Name:	http://investor.msn.com
TargetID:	3
From Memory:	true
Current Path:	C:\Windows\System32\rundll32.exe
Source:	rundll32.exe, 00000003.00000002.2174078892.0000000001AE0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2173337440.0000000000960000.00000002.00000001.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://www.msnbc.com/news/ticker.txt

unknown

Details

Name:	http://www.msnbc.com/news/ticker.txt
TargetID:	3
From Memory:	true
Current Path:	C:\Windows\System32\rundll32.exe
Source:	rundll32.exe, 00000003.00000002.2174078892.0000000001AE0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2173337440.0000000000960000.00000002.00000001.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://www.icra.org/vocabulary/.

unknown

Details

Name:	http://www.icra.org/vocabulary/.
TargetID:	3
From Memory:	true
Current Path:	C:\Windows\System32\rundll32.exe
Source:	rundll32.exe, 00000003.00000002.2174265271.0000000001CC7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2173529258.0000000000B47000.00000002.00000001.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://windowsmedia.com/redir/services.asp?WMPFriendly=true

unknown

Details

Name:	http://windowsmedia.com/redir/services.asp?WMPFriendly=true
TargetID:	3
From Memory:	true
Current Path:	C:\Windows\System32\rundll32.exe
Source:	rundll32.exe, 00000003.00000002.2174265271.0000000001CC7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2173529258.0000000000B47000.00000002.00000001.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://www.hotmail.com/oe

unknown

Details

Name:	http://www.hotmail.com/oe
TargetID:	3
From Memory:	true
Current Path:	C:\Windows\System32\rundll32.exe
Source:	rundll32.exe, 00000003.00000002.2174078892.0000000001AE0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2173337440.0000000000960000.00000002.00000001.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking

http://investor.msn.com/

unknown

Details

Name:	http://investor.msn.com/
TargetID:	3
From Memory:	true
Current Path:	C:\Windows\System32\rundll32.exe
Source:	rundll32.exe, 00000003.00000002.2174078892.0000000001AE0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2173337440.0000000000960000.00000002.00000001.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

otusmail.com

172.67.151.10

Details

Name:	otusmail.com
IP:	172.67.151.10
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Potential document exploit detected (performs DNS queries)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Uses secure TLS version for HTTPS connections	Compliance, Networking

cdn.digicertcdn.com

104.18.10.39

IPs

Domain

Country

Malicious

172.67.151.10

otusmail.com

United States

Details

IP:	172.67.151.10
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	otusmail.com

Signature Hits	Behavior Group	Mitre Attack
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Uses secure TLS version for HTTPS connections	Compliance, Networking

Registry

Path

Value

Malicious

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

r37

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

MTTT

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ReviewToken

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EBE5F

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

FontCachePath

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

VBAFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

DefaultSheetR2L

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

UseSystemSeparators

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ThousandsSeparator

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

DecimalSeparator

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 1

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 2

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 3

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 4

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 5

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 6

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 8

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 9

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 10

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 11

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 12

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 13

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 14

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 15

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 16

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 17

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 18

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 19

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 20

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC4B6

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC533

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC5BF

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 1

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 2

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 3

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 4

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 5

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 6

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 8

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 9

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 10

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 11

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 12

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 13

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 14

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 15

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 16

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 17

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 18

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 19

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 20

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC69A

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC716

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

2?7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

@%SystemRoot%\system32\qagentrt.dll,-10

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

@%SystemRoot%\System32\fveui.dll,-843

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

@%SystemRoot%\System32\fveui.dll,-844

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

@%SystemRoot%\System32\wuaueng.dll,-400

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

LastPurgeTime

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

FDBBF

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 1

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 2

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 3

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 4

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 5

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 6

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 8

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 9

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 10

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 11

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 12

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 13

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 14

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 15

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 16

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 17

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 18

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 19

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 20

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

FDD26

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EXCELFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SavedLegacySettings

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Blob

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Blob

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Blob

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Blob

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Blob

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Blob

There are 108 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

17B000

unkown

page read and write

3BA000

unkown

page read and write

70D000

heap default

page read and write

3C1000

unkown

page read and write

3D9000

unkown

page read and write

180000

unkown

page execute and read and write

707000

heap default

page read and write

3D6000

unkown

page read and write

3C2000

unkown

page read and write

71E000

unkown

page read and write

B20000

unkown

page readonly

1FB0000

heap private

page read and write

357000

heap default

page read and write

540000

unkown

page readonly

130000

unkown

page readonly

20000

heap private

page read and write

6E738000

unkown image

page execute read

3C9000

unkown

page read and write

6E72C000

unkown image

page readonly

430000

heap private

page read and write

3BF000

unkown

page read and write

2ED000

unkown

page read and write

38D000

heap default

page read and write

396000

heap default

page read and write

60000

unkown

page readonly

120000

unkown

page readonly

E40000

unkown

page readonly

2FE000

heap default

page read and write

135F000

unkown

page read and write

6E898000

unkown image

page read and write

1F6000

unkown

page read and write

6D0000

heap default

page read and write

14DE000

unkown

page read and write

1AE0000

unkown

page readonly

350000

heap default

page read and write

3B7000

unkown

page read and write

640000

heap private

page read and write

6A0000

unkown

page readonly

1CC7000

unkown

page readonly

3C2000

unkown

page read and write

1BC000

unkown

page read and write

F0000

unkown

page read and write

3F0000

heap private

page read and write

E0000

unkown

page read and write

6E733000

unkown image

page read and write

2C7000

heap default

page read and write

6E711000

unkown image

page execute read

3C2000

unkown

page read and write

20000

unkown

page readonly

3D1000

unkown

page read and write

3BD000

unkown

page read and write

3D5000

unkown

page read and write

644000

heap private

page read and write

100000

unkown

page read and write

960000

unkown

page readonly

3BE000

unkown

page read and write

3BC000

unkown

page read and write

3CC000

unkown

page read and write

13B0000

heap private

page read and write

6F4000

heap default

page read and write

24000

heap private

page read and write

B47000

unkown

page readonly

3BF000

unkown

page read and write

52F000

unkown

page read and write

7EFDF000

unkown

page read and write

340000

unkown

page read and write

6E710000

unkown image

page readonly

6D7000

heap default

page read and write

16D000

unkown

page read and write

DA0000

unkown

page readonly

D0000

unkown

page readonly

330000

unkown

page read and write

6E899000

unkown image

page readonly

3B8000

unkown

page read and write

6E78E000

unkown image

page read and write

7D0000

unkown

page readonly

110000

unkown

page readonly

4A0000

heap default

page read and write

1C0000

heap private

page read and write

3C0000

unkown

page readonly

E0000

unkown

page readonly

3BC000

unkown

page read and write

2C0000

heap default

page read and write

3B2000

heap default

page read and write

D90000

heap private

page read and write

3CF000

unkown

page read and write

3C5000

unkown

page read and write

360000

heap private

page read and write

382000

heap private

page read and write

240000

heap private

page read and write

3B5000

unkown

page read and write

364000

heap private

page read and write

CA0000

unkown

page readonly

190000

unkown

page execute and read and write

60000

unkown

page readonly

6E735000

unkown image

page readonly

3D1000

unkown

page read and write

1C0000

unkown

page read and write

90000

unkown

page readonly

170000

unkown

page read and write

1A6000

unkown

page read and write

520000

unkown

page readonly

2F0000

unkown

page execute and read and write

3AF000

unkown

page read and write

6E710000

unkown image

page readonly

3C0000

unkown

page read and write

6E78F000

unkown image

page execute and read and write

3D8000

unkown

page read and write

3C3000

unkown

page read and write

2470000

heap private

page read and write

There are 100 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOCReport

Files

Processes

URLs

Domains

IPs

Registry

Memdumps