Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

DEBT_2026004977_03182021.xlsm

Microsoft Excel 2007+

initial sample

Details

Filetype:	Microsoft Excel 2007+
Entropy:	7.661072420094417
Filename:	DEBT_2026004977_03182021.xlsm
Filesize:	189006
MD5:	042b349265bbac709ff2cbddb725033b
SHA1:	41b74d0c3b18fdcd17a8ca7ebfd883421f39c993
SHA256:	ba1912b685d37e4db3b8a622fa966a5e2c2f38c56037bfcc2a9f0a6f39872429
SHA512:	59faf72347ac8dde4e263fb3c4e6a063dd4f59159ea55eebfffc6446789afce6ba1a3db8f69916dbe73f5c5c51837ea91e47930b131eb70d962b952ab7d4c131
SSDEEP:	3072:jQXFYiB3kNT+2Jozo1UW8gOvlAsku0Gy3ZsY0OPlaK/LBE:jQXFYiB3kNBozoR8gOvljFy3ZIOX6
Preview:	PK..........!..#\|.....X.......[Content_Types].xml ...(.........................................................................................................................................................................................................

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Found Excel 4.0 Macro with suspicious formulas	System Summary	Scripting
Found abnormal large hidden Excel 4.0 Macro sheet	System Summary
Sample is known by Antivirus	System Summary
Document is a ZIP file with path names indicative of goodware	System Summary

C:\Users\user\Desktop\~$DEBT_2026004977_03182021.xlsm

data

dropped

Details

File:	C:\Users\user\Desktop\~$DEBT_2026004977_03182021.xlsm
Category:	dropped
Dump:	~$DEBT_2026004977_03182021.xlsm.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	data
Entropy:	1.4377382811115937
Encrypted:	false
Ssdeep:	3:vZ/FFDJw2fj/FFDJw2fV:vBFFGaFFGS
Size:	330
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Found Excel 4.0 Macro with suspicious formulas	System Summary	Scripting
Found abnormal large hidden Excel 4.0 Macro sheet	System Summary	Scripting
Creates files inside the user directory	System Summary	Masquerading
Sample is known by Antivirus	System Summary
Document is a ZIP file with path names indicative of goodware	System Summary

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7A4B8C50.jpeg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 1386x1386, frames 3

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7A4B8C50.jpeg
Category:	dropped
Dump:	7A4B8C50.jpeg.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 1386x1386, frames 3
Entropy:	7.651426384659082
Encrypted:	false
Ssdeep:	3072:RXFYiB3kNT+2Jozo1UW8gOvlAsku0Gy3ZsY0OPlaK/LBd:RXFYiB3kNBozoR8gOvljFy3ZIOXP
Size:	171553
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Downloads files	Networking	Ingress Tool Transfer

C:\Users\user\AppData\Local\Temp\1ACE0000

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\1ACE0000
Category:	dropped
Dump:	1ACE0000.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	data
Entropy:	7.658901379717203
Encrypted:	false
Ssdeep:	3072:YATXFYiB3kNT+2Jozo1UW8gOvlAsku0Gy3ZsY0OPlaK/LBQgB:YATXFYiB3kNBozoR8gOvljFy3ZIOXF
Size:	188484
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\DEBT_2026004977_03182021.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:13 2020, mtime=Mon Jun 28 23:44:37 2021, atime=Mon Jun 28 23:44:37 2021, length=188484, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\DEBT_2026004977_03182021.LNK
Category:	dropped
Dump:	DEBT_2026004977_03182021.LNK.0.dr
ID:	dr_6
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:13 2020, mtime=Mon Jun 28 23:44:37 2021, atime=Mon Jun 28 23:44:37 2021, length=188484, window=hide
Entropy:	4.518526401830706
Encrypted:	false
Ssdeep:	48:8kH/XT3Ikktr6A2Qh2kH/XT3Ikktr6A2Q/:8kH/XLIkk92Qh2kH/XLIkk92Q/
Size:	2178
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Mon Jun 28 23:44:37 2021, atime=Mon Jun 28 23:44:37 2021, length=12288, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
Category:	dropped
Dump:	Desktop.LNK.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Mon Jun 28 23:44:37 2021, atime=Mon Jun 28 23:44:37 2021, length=12288, window=hide
Entropy:	4.468852982717485
Encrypted:	false
Ssdeep:	12:85QPLgXg/XAlCPCHaXgzB8IB/ddiUkvX+WnicvbbbDtZ3YilMMEpxRljKPTdJP9O:854/XTwz6IDdivYebDv3q2rNru/
Size:	867
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
Category:	dropped
Dump:	index.dat.0.dr
ID:	dr_5
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	ASCII text, with CRLF line terminators
Entropy:	4.61015684972344
Encrypted:	false
Ssdeep:	3:oyBVomxWqiUT/RRXVEAl5DT/RRXVEAlmxWqiUT/RRXVEAlv:djZlbrDlbWlb1
Size:	127
Whitelisted:	false
Reputation:	low

C:\Users\user\Desktop\DACE0000

data

dropped

Details

File:	C:\Users\user\Desktop\DACE0000
Category:	dropped
Dump:	DACE0000.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	data
Entropy:	7.658901379717203
Encrypted:	false
Ssdeep:	3072:YATXFYiB3kNT+2Jozo1UW8gOvlAsku0Gy3ZsY0OPlaK/LBQgB:YATXFYiB3kNBozoR8gOvljFy3ZIOXF
Size:	188484
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	2580
Target ID:	0
Parent PID:	584
Name:	EXCEL.EXE
Class:	excel
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Size:	27641504
MD5:	5FB0A0F93382ECD19F5F499A5CAA59F0
Time:	17:44:34
Date:	28/06/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x13f730000
Modulesize:	27758592
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\rundll32.exe

Rundll32 ..\Kiod.hod,DllRegisterServer

Details

Is windows:	true
Is dropped:	false
PID:	2352
Target ID:	4
Parent PID:	2580
Name:	rundll32.exe
Class:	rundll32
Path:	C:\Windows\System32\rundll32.exe
Commandline:	Rundll32 ..\Kiod.hod,DllRegisterServer
Size:	45568
MD5:	DD81D91FF3B0763C392422865C9AC12E
Time:	17:46:01
Date:	28/06/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xff330000
Modulesize:	61440
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Document exploit detected (process start blacklist hit)	Software Vulnerabilities	Exploitation for Client Execution
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary
Runs a DLL by calling functions	System Summary	Rundll32
Spawns processes	System Summary	Process Injection

C:\Windows\System32\rundll32.exe

Rundll32 ..\Kiod.hod1,DllRegisterServer

Details

Is windows:	true
Is dropped:	false
PID:	3056
Target ID:	5
Parent PID:	2580
Name:	rundll32.exe
Class:	rundll32
Path:	C:\Windows\System32\rundll32.exe
Commandline:	Rundll32 ..\Kiod.hod1,DllRegisterServer
Size:	45568
MD5:	DD81D91FF3B0763C392422865C9AC12E
Time:	17:46:02
Date:	28/06/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xff330000
Modulesize:	61440
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Document exploit detected (process start blacklist hit)	Software Vulnerabilities	Exploitation for Client Execution
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary
Runs a DLL by calling functions	System Summary	Rundll32
Spawns processes	System Summary	Process Injection

C:\Windows\System32\rundll32.exe

Rundll32 ..\Kiod.hod2,DllRegisterServer

Details

Is windows:	true
Is dropped:	false
PID:	2620
Target ID:	6
Parent PID:	2580
Name:	rundll32.exe
Class:	rundll32
Path:	C:\Windows\System32\rundll32.exe
Commandline:	Rundll32 ..\Kiod.hod2,DllRegisterServer
Size:	45568
MD5:	DD81D91FF3B0763C392422865C9AC12E
Time:	17:46:02
Date:	28/06/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xff330000
Modulesize:	61440
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Document exploit detected (process start blacklist hit)	Software Vulnerabilities	Exploitation for Client Execution
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary
Runs a DLL by calling functions	System Summary	Rundll32
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://185.82.219.219/44375.7393215278.dat

185.82.219.219

Details

Name:	http://185.82.219.219/44375.7393215278.dat
IP:	185.82.219.219
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check

unknown

Details

Name:	http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
TargetID:	4
From Memory:	true
Current Path:	C:\Windows\System32\rundll32.exe
Source:	rundll32.exe, 00000004.00000002.2277154813.0000000001D57000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2274671747.0000000001CF7000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2268568892.0000000001E07000.00000002.00000001.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://www.windows.com/pctv.

unknown

Details

Name:	http://www.windows.com/pctv.
TargetID:	6
From Memory:	true
Current Path:	C:\Windows\System32\rundll32.exe
Source:	rundll32.exe, 00000006.00000002.2268420124.0000000001C20000.00000002.00000001.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://investor.msn.com

unknown

Details

Name:	http://investor.msn.com
TargetID:	4
From Memory:	true
Current Path:	C:\Windows\System32\rundll32.exe
Source:	rundll32.exe, 00000004.00000002.2276985743.0000000001B70000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2274475788.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2268420124.0000000001C20000.00000002.00000001.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://www.msnbc.com/news/ticker.txt

unknown

Details

Name:	http://www.msnbc.com/news/ticker.txt
TargetID:	4
From Memory:	true
Current Path:	C:\Windows\System32\rundll32.exe
Source:	rundll32.exe, 00000004.00000002.2276985743.0000000001B70000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2274475788.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2268420124.0000000001C20000.00000002.00000001.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://www.icra.org/vocabulary/.

unknown

Details

Name:	http://www.icra.org/vocabulary/.
TargetID:	4
From Memory:	true
Current Path:	C:\Windows\System32\rundll32.exe
Source:	rundll32.exe, 00000004.00000002.2277154813.0000000001D57000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2274671747.0000000001CF7000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2268568892.0000000001E07000.00000002.00000001.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://windowsmedia.com/redir/services.asp?WMPFriendly=true

unknown

Details

Name:	http://windowsmedia.com/redir/services.asp?WMPFriendly=true
TargetID:	4
From Memory:	true
Current Path:	C:\Windows\System32\rundll32.exe
Source:	rundll32.exe, 00000004.00000002.2277154813.0000000001D57000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2274671747.0000000001CF7000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2268568892.0000000001E07000.00000002.00000001.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://www.hotmail.com/oe

unknown

Details

Name:	http://www.hotmail.com/oe
TargetID:	4
From Memory:	true
Current Path:	C:\Windows\System32\rundll32.exe
Source:	rundll32.exe, 00000004.00000002.2276985743.0000000001B70000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2274475788.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2268420124.0000000001C20000.00000002.00000001.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking

http://investor.msn.com/

unknown

Details

Name:	http://investor.msn.com/
TargetID:	4
From Memory:	true
Current Path:	C:\Windows\System32\rundll32.exe
Source:	rundll32.exe, 00000004.00000002.2276985743.0000000001B70000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2274475788.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2268420124.0000000001C20000.00000002.00000001.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

45.140.146.180

unknown

United Kingdom

Details

IP:	45.140.146.180
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Country:	United Kingdom
Countrycode:	GBR
ASN number:	44486
ASN name:	SYNLINQsynlinqdeDE
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

188.127.231.55

unknown

Russian Federation

Details

IP:	188.127.231.55
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Country:	Russian Federation
Countrycode:	RUS
ASN number:	56694
ASN name:	DHUBRU
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Connects to IPs without corresponding DNS lookups	Networking

185.82.219.219

unknown

Bulgaria

Details

IP:	185.82.219.219
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Country:	Bulgaria
Countrycode:	BGR
ASN number:	59729
ASN name:	ITL-BG
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

Registry

Path

Value

Malicious

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

2~4

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

MTTT

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ReviewToken

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC5CF

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

VBAFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

DefaultSheetR2L

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

UseSystemSeparators

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ThousandsSeparator

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

DecimalSeparator

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 1

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 2

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 3

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 4

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 5

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 6

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 8

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 9

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 10

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 11

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 12

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 13

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 14

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 15

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 16

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 17

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 18

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 19

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 20

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC8BC

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC9B5

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 1

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 2

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 3

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 4

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 5

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 6

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 8

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 9

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 10

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 11

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 12

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 13

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 14

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 15

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 16

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 17

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 18

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 19

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 20

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ECA80

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ECB1C

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

y'4

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

LastPurgeTime

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

108E7A

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 1

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 2

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 3

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 4

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 5

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 6

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 8

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 9

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 10

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 11

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 12

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 13

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 14

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 15

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 16

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 17

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 18

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 19

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 20

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

10906D

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EXCELFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SavedLegacySettings

There are 95 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

2A75000

unkown

page readonly

1EF0000

unkown

page write copy

2CC0000

unkown

page readonly

770000

unkown

page readonly

29F2000

unkown

page readonly

22D9000

heap private

page read and write

2598000

unkown

page readonly

2A02000

unkown

page readonly

2922000

unkown

page readonly

22C000

unkown

page read and write

2772000

unkown

page readonly

2846000

unkown

page readonly

28D4000

unkown

page readonly

20000

unkown

page readonly

2350000

heap private

page read and write

2A45000

unkown

page readonly

20EB000

heap private

page read and write

2A45000

unkown

page readonly

29D6000

unkown

page readonly

2772000

unkown

page readonly

2A72000

unkown

page readonly

1E07000

unkown

page readonly

2935000

unkown

page readonly

28E5000

unkown

page readonly

28F4000

unkown

page readonly

21F0000

unkown

page readonly

D0000

unkown

page read and write

2000000

unkown

page write copy

27D5000

unkown

page readonly

2E6B000

heap private

page read and write

2AE0000

unkown

page readonly

2752000

unkown

page readonly

2A5D000

unkown

page readonly

326000

unkown

page read and write

28B5000

unkown

page readonly

2AD2000

unkown

page readonly

2A26000

unkown

page readonly

3E6000

unkown

page read and write

26F2000

unkown

page readonly

2170000

heap private

page read and write

F0000

unkown

page read and write

2210000

unkown

page readonly

29B5000

unkown

page readonly

28F2000

unkown

page readonly

28B2000

unkown

page readonly

27E6000

unkown

page readonly

2899000

unkown

page readonly

2A15000

unkown

page readonly

680000

unkown

page readonly

2F0000

unkown

page read and write

29D000

unkown

page read and write

3B0000

unkown

page read and write

2170000

heap private

page read and write

2592000

unkown

page readonly

2A95000

unkown

page readonly

BBF000

unkown

page read and write

29C5000

unkown

page readonly

2879000

unkown

page readonly

287D000

unkown

page readonly

28F2000

unkown

page readonly

27C2000

unkown

page readonly

28D2000

unkown

page readonly

1C20000

unkown

page readonly

2010000

unkown

page readonly

60000

unkown

page readonly

D0000

unkown

page readonly

1BC000

unkown

page read and write

2350000

unkown

page readonly

2C40000

unkown

page readonly

2C60000

unkown

page readonly

1CF7000

unkown

page readonly

29A6000

unkown

page readonly

29DD000

unkown

page readonly

20000

heap private

page read and write

75E000

unkown

page read and write

2A0000

unkown

page read and write

E0000

unkown

page read and write

1B70000

unkown

page readonly

29C6000

unkown

page readonly

2A59000

unkown

page readonly

2B0000

heap default

page read and write

2E25000

heap private

page read and write

2982000

unkown

page readonly

2932000

unkown

page readonly

2B7000

heap default

page read and write

150000

heap default

page read and write

27F2000

unkown

page readonly

2A82000

unkown

page readonly

1F0000

heap default

page read and write

2EB0000

unkown

page readonly

2965000

unkown

page readonly

2AC5000

unkown

page readonly

29D2000

unkown

page readonly

1F50000

unkown

page write copy

450000

unkown

page readonly

1B10000

unkown

page readonly

107000

heap default

page read and write

21F0000

unkown

page readonly

2BE2000

unkown

page readonly

2355000

heap private

page read and write

2876000

unkown

page readonly

2359000

heap private

page read and write

2B00000

unkown

page readonly

2822000

unkown

page readonly

100000

heap default

page read and write

2A79000

unkown

page readonly

2AA9000

unkown

page readonly

2865000

unkown

page readonly

2954000

unkown

page readonly

22D5000

heap private

page read and write

2952000

unkown

page readonly

1F7000

heap default

page read and write

2D00000

unkown

page read and write

2CA0000

unkown

page readonly

1D57000

unkown

page readonly

2A32000

unkown

page readonly

146000

heap default

page read and write

29B2000

unkown

page readonly

52F000

unkown

page read and write

29D9000

unkown

page readonly

2E35000

heap private

page read and write

2AF5000

unkown

page readonly

2915000

unkown

page readonly

2AC0000

unkown

page readonly

2C20000

unkown

page readonly

24000

heap private

page read and write

E0000

unkown

page read and write

2C62000

unkown

page readonly

2179000

heap private

page read and write

2805000

unkown

page readonly

26F8000

unkown

page readonly

2892000

unkown

page readonly

350000

unkown

page read and write

2A56000

unkown

page readonly

22E000

heap default

page read and write

E0000

unkown

page read and write

60000

unkown

page readonly

2995000

unkown

page readonly

5BF000

unkown

page read and write

21A0000

unkown

page read and write

2A59000

unkown

page readonly

2E20000

heap private

page read and write

22D0000

heap private

page read and write

2972000

unkown

page readonly

29E5000

unkown

page readonly

414000

heap private

page read and write

1FB0000

heap private

page read and write

60000

unkown

page readonly

250000

heap default

page read and write

2946000

unkown

page readonly

2852000

unkown

page readonly

28C9000

unkown

page readonly

2120000

heap private

page read and write

23D0000

unkown

page readonly

2778000

unkown

page readonly

28C2000

unkown

page readonly

2A52000

unkown

page readonly

2816000

unkown

page readonly

1EB000

unkown

page read and write

2AA2000

unkown

page readonly

28B4000

unkown

page readonly

2754000

unkown

page readonly

4F4000

heap private

page read and write

4F0000

heap private

page read and write

2A22000

unkown

page readonly

2A15000

unkown

page readonly

5D0000

unkown

page readonly

500000

unkown

page readonly

20B0000

heap private

page read and write

2872000

unkown

page readonly

2692000

unkown

page readonly

24000

heap private

page read and write

29F9000

unkown

page readonly

2370000

unkown

page readonly

28E000

heap default

page read and write

20B5000

heap private

page read and write

2EA0000

unkown

page readonly

2E30000

heap private

page read and write

410000

heap private

page read and write

2835000

unkown

page readonly

3F0000

unkown

page readonly

2792000

unkown

page readonly

2C00000

unkown

page readonly

2ED0000

unkown

page read and write

2175000

heap private

page read and write

27F2000

unkown

page readonly

2976000

unkown

page readonly

28F9000

unkown

page readonly

60000

unkown

page readonly

257000

heap default

page read and write

2934000

unkown

page readonly

20000

heap private

page read and write

F0000

unkown

page read and write

23F0000

unkown

page readonly

2974000

unkown

page readonly

2EE000

heap default

page read and write

2794000

unkown

page readonly

2774000

unkown

page readonly

13D000

heap default

page read and write

2AD9000

unkown

page readonly

D0000

unkown

page readonly

386000

unkown

page read and write

2D6000

unkown

page read and write

2952000

unkown

page readonly

2E5B000

heap private

page read and write

570000

unkown

page readonly

2CE0000

unkown

page readonly

29F6000

unkown

page readonly

29A2000

unkown

page readonly

2A29000

unkown

page readonly

2B20000

unkown

page readonly

There are 201 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOCReport

Files

Processes

URLs

IPs

Registry

Memdumps