Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Cancellation_1844611233_06082021.xlsm

Microsoft Excel 2007+

initial sample

Details

Filetype:	Microsoft Excel 2007+
Entropy:	7.97999804023918
Filename:	Cancellation_1844611233_06082021.xlsm
Filesize:	341572
MD5:	245c3e542030fb5f37cc1786c6d2ad52
SHA1:	d3659467af26b5cf1773b69bd6b9820b1b777dcb
SHA256:	72da5a8ba62bc25dfbe12f189664117f79db3fcf2d539e3b1f8abc3923e8a2ea
SHA512:	820d7b0e8686eeb0a020cf884ecbc86c8e0e64e1e2b4493174ce22c4461cb1440efb0e53a11635cd60c278639eab240604cbecc42612cc1900f534df566303db
SSDEEP:	6144:8gRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNpC:8gRMmEv2Bc/nvm8IKABfsYOmauFM
Preview:	PK..........!...`.....W.......[Content_Types].xml ...(.........................................................................................................................................................................................................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Sample is known by Antivirus	System Summary
Document is a ZIP file with path names indicative of goodware	System Summary

C:\Users\user\Desktop\~$Cancellation_1844611233_06082021.xlsm

data

dropped

Details

File:	C:\Users\user\Desktop\~$Cancellation_1844611233_06082021.xlsm
Category:	dropped
Dump:	~$Cancellation_1844611233_06082021.xlsm.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	data
Entropy:	1.4377382811115937
Encrypted:	false
Ssdeep:	3:vZ/FFDJw2fj/FFDJw2fV:vBFFGaFFGS
Size:	330
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Creates files inside the user directory	System Summary	Masquerading
Sample is known by Antivirus	System Summary
Document is a ZIP file with path names indicative of goodware	System Summary

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\61190FA7.tif

TIFF image data, little-endian, direntries=19, height=1600, bps=53710, compression=LZW, PhotometricIntepretation=RGB, width=1600

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\61190FA7.tif
Category:	dropped
Dump:	61190FA7.tif.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	TIFF image data, little-endian, direntries=19, height=1600, bps=53710, compression=LZW, PhotometricIntepretation=RGB, width=1600
Entropy:	7.988901270632308
Encrypted:	false
Ssdeep:	6144:hRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZN3:hRMmEv2Bc/nvm8IKABfsYOmauFD
Size:	315878
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Downloads files	Networking	Ingress Tool Transfer

C:\Users\user\AppData\Local\Temp\DCCE0000

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\DCCE0000
Category:	dropped
Dump:	DCCE0000.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	data
Entropy:	7.979775569009726
Encrypted:	false
Ssdeep:	6144:lwObRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNX:lwObRMmEv2Bc/nvm8IKABfsYOmauFaJu
Size:	340119
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Cancellation_1844611233_06082021.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:13 2020, mtime=Wed Jun 9 11:27:37 2021, atime=Wed Jun 9 11:27:37 2021, length=340119, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Cancellation_1844611233_06082021.LNK
Category:	dropped
Dump:	Cancellation_1844611233_06082021.LNK.0.dr
ID:	dr_6
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:13 2020, mtime=Wed Jun 9 11:27:37 2021, atime=Wed Jun 9 11:27:37 2021, length=340119, window=hide
Entropy:	4.550309181412507
Encrypted:	false
Ssdeep:	48:8u6/XT3Ik+9ZXasAQh2u6/XT3Ik+9ZXasAQ/:8b/XLIk+avQh2b/XLIk+avQ/
Size:	2258
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed Jun 9 11:27:37 2021, atime=Wed Jun 9 11:27:37 2021, length=8192, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
Category:	dropped
Dump:	Desktop.LNK.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed Jun 9 11:27:37 2021, atime=Wed Jun 9 11:27:37 2021, length=8192, window=hide
Entropy:	4.4828377434773685
Encrypted:	false
Ssdeep:	12:85QAcLgXg/XAlCPCHaXgzB8IB/raxX+Wnicvb0nbDtZ3YilMMEpxRljKRlCTdJP8:85c/XTwz6IIxYeIbDv3qsArNru/
Size:	867
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
Category:	dropped
Dump:	index.dat.0.dr
ID:	dr_5
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	ASCII text, with CRLF line terminators
Entropy:	4.7385279356566095
Encrypted:	false
Ssdeep:	3:oyBVomxWtlUvER1EV2Al+iRvER1EV2AlmxWtlUvER1EV2Alv:djelaiu2ARBiu2Azlaiu2A1
Size:	151
Whitelisted:	false
Reputation:	low

C:\Users\user\Desktop\ADCE0000

data

dropped

Details

File:	C:\Users\user\Desktop\ADCE0000
Category:	dropped
Dump:	ADCE0000.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	data
Entropy:	7.979775569009726
Encrypted:	false
Ssdeep:	6144:lwObRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNX:lwObRMmEv2Bc/nvm8IKABfsYOmauFaJu
Size:	340119
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	2060
Target ID:	0
Parent PID:	584
Name:	EXCEL.EXE
Class:	excel
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Size:	27641504
MD5:	5FB0A0F93382ECD19F5F499A5CAA59F0
Time:	05:27:33
Date:	09/06/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x13f300000
Modulesize:	27758592
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\regsvr32.exe

regsvr32 -s ..\Post.storg

Details

Is windows:	true
Is dropped:	false
PID:	2908
Target ID:	3
Parent PID:	2060
Name:	regsvr32.exe
Class:	system-tools
Path:	C:\Windows\System32\regsvr32.exe
Commandline:	regsvr32 -s ..\Post.storg
Size:	19456
MD5:	59BCE9F07985F8A4204F4D6554CFF708
Time:	05:28:20
Date:	09/06/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xff4b0000
Modulesize:	32768
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Document exploit detected (process start blacklist hit)	Software Vulnerabilities	Exploitation for Client Execution
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\regsvr32.exe

regsvr32 -s ..\Post.storg1

Details

Is windows:	true
Is dropped:	false
PID:	2784
Target ID:	4
Parent PID:	2060
Name:	regsvr32.exe
Class:	system-tools
Path:	C:\Windows\System32\regsvr32.exe
Commandline:	regsvr32 -s ..\Post.storg1
Size:	19456
MD5:	59BCE9F07985F8A4204F4D6554CFF708
Time:	05:28:21
Date:	09/06/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xff4b0000
Modulesize:	32768
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Document exploit detected (process start blacklist hit)	Software Vulnerabilities	Exploitation for Client Execution
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\regsvr32.exe

regsvr32 -s ..\Post.storg2

Details

Is windows:	true
Is dropped:	false
PID:	2808
Target ID:	5
Parent PID:	2060
Name:	regsvr32.exe
Class:	system-tools
Path:	C:\Windows\System32\regsvr32.exe
Commandline:	regsvr32 -s ..\Post.storg2
Size:	19456
MD5:	59BCE9F07985F8A4204F4D6554CFF708
Time:	05:28:21
Date:	09/06/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xff4b0000
Modulesize:	32768
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Document exploit detected (process start blacklist hit)	Software Vulnerabilities	Exploitation for Client Execution
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://103.155.92.95/44356.227524537.dat

103.155.92.95

Details

Name:	http://103.155.92.95/44356.227524537.dat
IP:	103.155.92.95
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

http://servername/isapibackend.dll

unknown

Details

Name:	http://servername/isapibackend.dll
TargetID:	3
From Memory:	true
Current Path:	C:\Windows\System32\regsvr32.exe
Source:	regsvr32.exe, 00000003.00000002.2173436473.0000000001E60000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2174040381.0000000001E50000.00000002.00000001.sdmp, regsvr32.exe, 00000005.00000002.2175172538.0000000001DA0000.00000002.00000001.sdmp
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://51.89.115.125/44356.227524537.dat

51.89.115.125

Details

Name:	http://51.89.115.125/44356.227524537.dat
IP:	51.89.115.125
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Source:	network

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

IPs

Domain

Country

Malicious

103.155.92.95

unknown

Details

IP:	103.155.92.95
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ASN number:	134687
ASN name:	TWIDC-AS-APTWIDCLimitedHK
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

51.89.115.125

unknown

France

Details

IP:	51.89.115.125
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Country:	France
Countrycode:	FRA
ASN number:	16276
ASN name:	OVHFR
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

45.144.31.105

unknown

United Kingdom

Details

IP:	45.144.31.105
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Country:	United Kingdom
Countrycode:	GBR
ASN number:	42994
ASN name:	HQservCommunicationSolutionsIL
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

Registry

Path

Value

Malicious

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

{~6

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

MTTT

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ReviewToken

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC19A

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

VBAFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

DefaultSheetR2L

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

UseSystemSeparators

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ThousandsSeparator

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

DecimalSeparator

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 1

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 2

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 3

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 4

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 5

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 6

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 8

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 9

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 10

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 11

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 12

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 13

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 14

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 15

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 16

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 17

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 18

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 19

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 20

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC5DE

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC67A

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC745

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC7D2

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC86E

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC938

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC9C5

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ECA61

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ECB5A

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ECBE7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ECCB2

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 1

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 2

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 3

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 4

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 5

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 6

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 8

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 9

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 10

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 11

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 12

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 13

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 14

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 15

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 16

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 17

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 18

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 19

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 20

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ECD7C

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ECE18

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

un6

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

LastPurgeTime

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

FD4FB

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 1

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 2

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 3

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 4

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 5

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 6

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 8

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 9

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 10

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 11

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 12

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 13

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 14

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 15

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 16

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 17

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 18

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 19

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 20

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

FD71D

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EXCELFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SavedLegacySettings

There are 104 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

5B6000

unkown

page read and write

3CE000

heap default

page read and write

580000

unkown

page read and write

740000

unkown

page readonly

5B6000

unkown

page read and write

450000

heap default

page read and write

2150000

unkown

page readonly

22C000

unkown

page read and write

48E000

heap default

page read and write

490000

unkown

page readonly

164000

heap private

page read and write

800000

unkown

page readonly

F0000

unkown

page read and write

70000

unkown

page readonly

730000

unkown

page readonly

734000

heap private

page read and write

4B6000

unkown

page read and write

296000

unkown

page read and write

20000

unkown

page readonly

260000

unkown

page read and write

674000

heap private

page read and write

303000

heap default

page read and write

720000

heap private

page read and write

397000

heap default

page read and write

20000

unkown

page readonly

457000

heap default

page read and write

390000

heap default

page read and write

724000

heap private

page read and write

E0000

unkown

page read and write

2160000

unkown

page write copy

730000

heap private

page read and write

226B000

heap private

page read and write

2235000

heap private

page read and write

680000

unkown

page readonly

70000

unkown

page readonly

270000

unkown

page read and write

B9F000

unkown

page read and write

2135000

heap private

page read and write

810000

unkown

page readonly

60000

unkown

page readonly

2250000

heap private

page read and write

470000

heap private

page read and write

22C000

unkown

page read and write

21B0000

unkown

page write copy

26C000

unkown

page read and write

216B000

heap private

page read and write

67E000

unkown

page read and write

116000

unkown

page read and write

3EA000

heap default

page read and write

2230000

heap private

page read and write

160000

heap private

page read and write

1E50000

unkown

page readonly

670000

heap private

page read and write

480000

unkown

page read and write

2255000

heap private

page read and write

2B7000

heap default

page read and write

E0000

heap private

page read and write

230000

unkown

page read and write

370000

unkown

page read and write

1E0000

unkown

page read and write

7BF000

unkown

page read and write

3B0000

unkown

page write copy

25D000

unkown

page read and write

41D000

heap default

page read and write

E0000

unkown

page read and write

20000

unkown

page readonly

E4000

heap private

page read and write

70000

unkown

page readonly

E0000

unkown

page read and write

228B000

heap private

page read and write

1DA0000

unkown

page readonly

4A3000

heap default

page read and write

3E7000

heap default

page read and write

2EE000

heap default

page read and write

550000

unkown

page readonly

2A6000

unkown

page read and write

8B0000

unkown

page readonly

266000

unkown

page read and write

71F000

unkown

page read and write

474000

heap private

page read and write

1E60000

unkown

page readonly

574000

heap private

page read and write

2B0000

heap default

page read and write

4AA000

heap default

page read and write

2130000

heap private

page read and write

30A000

heap default

page read and write

8C0000

unkown

page readonly

426000

heap default

page read and write

3E3000

heap default

page read and write

3E0000

heap default

page read and write

42B000

heap default

page read and write

570000

heap private

page read and write

580000

unkown

page read and write

F0000

unkown

page read and write

There are 84 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOCReport

Files

Processes

URLs

IPs

Registry

Memdumps