IOCReport

loading gif

Files

File Path
Type
Category
Malicious
9177284661-04302021.xlsm
Microsoft Excel 2007+
initial sample
 malicious
C:\Users\user\Desktop\~$9177284661-04302021.xlsm
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\307513F9.jpg
[TIFF image data, big-endian, direntries=5], baseline, precision 8, 1080x1080, frames 3
dropped
 clean
C:\Users\user\AppData\Local\Temp\36FE0000
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\9177284661-04302021.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:21 2020, mtime=Tue May 4 12:07:48 2021, atime=Tue May 4 12:07:48 2021, length=115178, window=hide
modified
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Tue May 4 12:07:48 2021, atime=Tue May 4 12:07:48 2021, length=8192, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\Desktop\27FE0000
data
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\195EC58F.jpg
[TIFF image data, big-endian, direntries=5], baseline, precision 8, 1080x1080, frames 3
dropped
 clean
C:\Users\user\AppData\Local\Temp\EE720000
data
dropped
 clean
C:\Users\user\Desktop\D1820000
data
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\EB62A569.jpg
[TIFF image data, big-endian, direntries=5], baseline, precision 8, 1080x1080, frames 3
dropped
 clean
C:\Users\user\AppData\Local\Temp\46FE0000
data
dropped
 clean
There are 4 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
 malicious

URLs

Name
IP
Malicious
http://185.45.193.80/44313,6048108796.dat
185.45.193.80
 malicious
http://45.144.31.232/44313,6048108796.dat
45.144.31.232
 malicious
https://api.diagnosticssdf.office.com
unknown
 clean
https://login.microsoftonline.com/
unknown
 clean
https://shell.suite.office.com:1443
unknown
 clean
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
unknown
 clean
https://autodiscover-s.outlook.com/
unknown
 clean
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
unknown
 clean
https://cdn.entity.
unknown
 clean
https://api.addins.omex.office.net/appinfo/query
unknown
 clean
https://clients.config.office.net/user/v1.0/tenantassociationkey
unknown
 clean
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
unknown
 clean
https://powerlift.acompli.net
unknown
 clean
https://rpsticket.partnerservices.getmicrosoftkey.com
unknown
 clean
https://lookup.onenote.com/lookup/geolocation/v1
unknown
 clean
https://cortana.ai
unknown
 clean
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
unknown
 clean
https://cloudfiles.onenote.com/upload.aspx
unknown
 clean
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
unknown
 clean
https://entitlement.diagnosticssdf.office.com
unknown
 clean
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
unknown
 clean
https://api.aadrm.com/
unknown
 clean
https://ofcrecsvcapi-int.azurewebsites.net/
unknown
 clean
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
unknown
 clean
https://api.microsoftstream.com/api/
unknown
 clean
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
unknown
 clean
https://cr.office.com
unknown
 clean
https://portal.office.com/account/?ref=ClientMeControl
unknown
 clean
https://ecs.office.com/config/v2/Office
unknown
 clean
https://graph.ppe.windows.net
unknown
 clean
https://res.getmicrosoftkey.com/api/redemptionevents
unknown
 clean
https://powerlift-frontdesk.acompli.net
unknown
 clean
https://tasks.office.com
unknown
 clean
https://officeci.azurewebsites.net/api/
unknown
 clean
https://sr.outlook.office.net/ws/speech/recognize/assistant/work
unknown
 clean
https://store.office.cn/addinstemplate
unknown
 clean
https://outlook.office.com/autosuggest/api/v1/init?cvid=
unknown
 clean
https://globaldisco.crm.dynamics.com
unknown
 clean
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
unknown
 clean
https://store.officeppe.com/addinstemplate
unknown
 clean
https://dev0-api.acompli.net/autodetect
unknown
 clean
https://www.odwebp.svc.ms
unknown
 clean
https://api.powerbi.com/v1.0/myorg/groups
unknown
 clean
https://web.microsoftstream.com/video/
unknown
 clean
https://graph.windows.net
unknown
 clean
https://dataservice.o365filtering.com/
unknown
 clean
https://officesetup.getmicrosoftkey.com
unknown
 clean
https://analysis.windows.net/powerbi/api
unknown
 clean
https://prod-global-autodetect.acompli.net/autodetect
unknown
 clean
https://outlook.office365.com/autodiscover/autodiscover.json
unknown
 clean
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
unknown
 clean
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
unknown
 clean
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
unknown
 clean
https://ncus.contentsync.
unknown
 clean
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
unknown
 clean
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
unknown
 clean
http://weather.service.msn.com/data.aspx
unknown
 clean
https://apis.live.net/v5.0/
unknown
 clean
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
unknown
 clean
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
unknown
 clean
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
unknown
 clean
https://management.azure.com
unknown
 clean
https://wus2.contentsync.
unknown
 clean
https://incidents.diagnostics.office.com
unknown
 clean
https://clients.config.office.net/user/v1.0/ios
unknown
 clean
https://insertmedia.bing.office.net/odc/insertmedia
unknown
 clean
https://o365auditrealtimeingestion.manage.office.com
unknown
 clean
https://outlook.office365.com/api/v1.0/me/Activities
unknown
 clean
https://api.office.net
unknown
 clean
https://incidents.diagnosticssdf.office.com
unknown
 clean
https://asgsmsproxyapi.azurewebsites.net/
unknown
 clean
https://clients.config.office.net/user/v1.0/android/policies
unknown
 clean
https://entitlement.diagnostics.office.com
unknown
 clean
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
unknown
 clean
https://outlook.office.com/
unknown
 clean
https://storage.live.com/clientlogs/uploadlocation
unknown
 clean
https://templatelogging.office.com/client/log
unknown
 clean
https://outlook.office365.com/
unknown
 clean
https://webshell.suite.office.com
unknown
 clean
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
unknown
 clean
https://management.azure.com/
unknown
 clean
https://login.windows.net/common/oauth2/authorize
unknown
 clean
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
unknown
 clean
https://graph.windows.net/
unknown
 clean
https://api.powerbi.com/beta/myorg/imports
unknown
 clean
https://devnull.onenote.com
unknown
 clean
https://ncus.pagecontentsync.
unknown
 clean
https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
unknown
 clean
https://messaging.office.com/
unknown
 clean
https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
unknown
 clean
https://augloop.office.com/v2
unknown
 clean
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
unknown
 clean
https://skyapi.live.net/Activity/
unknown
 clean
https://clients.config.office.net/user/v1.0/mac
unknown
 clean
https://dataservice.o365filtering.com
unknown
 clean
https://api.cortana.ai
unknown
 clean
https://onedrive.live.com
unknown
 clean
https://ovisualuiapp.azurewebsites.net/pbiagave/
unknown
 clean
https://visio.uservoice.com/forums/368202-visio-on-devices
unknown
 clean
https://directory.services.
unknown
 clean
There are 90 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
82.118.21.70
unknown
Ukraine
clean
45.144.31.232
unknown
United Kingdom
clean
185.45.193.80
unknown
United Arab Emirates
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
%k6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EEF7D
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF392
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF4EA
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF5D4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF6BE
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF798
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
3x6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
'0;
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
(0;
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
RemoteClearDate
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
Last
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
FilePath
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
StartDate
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
EndDate
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
Properties
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
Url
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
LastClean
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
DisableWinHttpCertAuth
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
DisableIsOwnerRegex
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
DisableSessionAwareHttpClose
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
DisableADALForExtendedApps
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
DisableADALSetSilentAuth
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
msoridDisableGuestCredProvider
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
msoridDisableOstringReplace
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
LastBootTime
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
VBAFiles
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
MSForms
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
MSComctlLib
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
ReviewToken
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
27258
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
2796D
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
27CA9
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
27E10
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
2816C
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
28208
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
il;
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
ProductFiles
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
en-US
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
en-US
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
RoamingConfigurableSettings
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
RoamingLastSyncTime
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
RoamingLastWriteTime
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
CacheReady
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
LastRequest
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
CacheReady
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
LastUpdate
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
NextUpdate
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
ProductFiles
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
ProductFiles
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
ProductFiles
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
ProductFiles
 clean
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
LastBootTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
nt7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF058
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF44E
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF557
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF602
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF6DD
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF779
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
$`7
 clean
There are 140 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
5EF000
unkown
page read and write
 clean
17B000
heap default
page read and write
 clean
420000
heap private
page read and write
 clean
137000
heap default
page read and write
 clean
C6F000
unkown
page read and write
 clean
16D000
heap default
page read and write
 clean
2A0000
unkown
page read and write
 clean
424000
heap private
page read and write
 clean
130000
heap default
page read and write
 clean
B3F000
unkown
page read and write
 clean
4DF000
unkown
page read and write
 clean
6F0000
unkown
page readonly
 clean
CD000
unkown
page read and write
 clean
D2F000
unkown
page read and write
 clean
230000
unkown
page readonly
 clean
176000
heap default
page read and write
 clean
2D6000
unkown
page read and write
 clean
There are 7 hidden memdumps, click here to show them.