Cuckoo Sandbox

Category	Started On	Completed On	Duration	Cuckoo Version
FILE	2023-02-09 20:30:05.918865	2023-02-09 20:31:55.581142	109 seconds	2.0-dev

Machine	Label	Manager	Started On	Shutdown On
win7cuckoo	win7 Clone 1	VirtualBox	2023-02-09 20:30:06	2023-02-09 20:31:55

File Details

File name	50d3aa51a95c80f487dd38a75ebc82d1b3766d18.xlsx
File size	316774 bytes
File type	Zip archive data, at least v2.0 to extract
CRC32	EB1FAAC4
MD5	63d4b10f7b1be5e06674ab6fd5be74a4
SHA1	50d3aa51a95c80f487dd38a75ebc82d1b3766d18
SHA256	5ebd6280000e4cde1d468cbfd817f1ccdb540b565f3033dacf7c7240211d2fc6
SHA512	501f4bb4e890760175efd804bff64114b8bd14c9702c8f1212eac16037f623a1c030246812e83b42ab80a31256e43af2bab741c95c73e7d7cc03948f7f02ebf7
Ssdeep	None
PEiD	None matched
Yara	contains_base64 (This rule finds for base64 strings)
VirusTotal	File not found on VirusTotal

MetaFlows Scores

Metaflows Analysis Results (Signatures=50, Anomalies=0, PEiD=0, Yara=0, VT[1675992733]=0): Snort Events=0, AV Events=0
Total Score=50

Dropped File/Buffer Yara Signatures:
fe1e54d11c168dfc_excel.exe_rules.xml: contains_base64

Signatures

raises_exception details

nolookup_communication details

applcation_raises_exception details

creates_doc details

Screenshots

No screenshots available.

Static Analysis

Strings

Dropped Files

fe1e54d11c168dfc_excel.exe_rules.xml

File name	fe1e54d11c168dfc_excel.exe_rules.xml
File size	579491 bytes
File type	XML document text
MD5	5eedd9cfdc26653401ae2192865ab384
SHA1	60f9d64a3f48c0d1a5d177dd9d005db50f71272b
SHA256	fe1e54d11c168dfc0c07ca046aa6b811eab2ff3cc7c884c1ed544b86bf9413de
SHA512	f7da093002d13343465f9d602a0e95f967cc34e1f13379eccc1ed2f865abecb6d8ca0369eedd121a6bec3947bea84d9cb8b335b36068aa6bec3bfc6ffc92d836
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings) Str_Win32_Internet_API (Match Windows Inet API call) Big_Numbers1 (Looks for big numbers 32:sized)
VirusTotal	Search for Analysis

33cfcd4100a63d7c_error035560_01.xml

File name	33cfcd4100a63d7c_error035560_01.xml
File size	554 bytes
File type	XML document text
MD5	3e672a758319f6ee2da9afb7aa177c0c
SHA1	90609f081430c9b1bf253b2d55c7ce755338a545
SHA256	33cfcd4100a63d7ce13e4a77e25686100ee63b23c8cb9168af638df2fe8012dd
SHA512	72570dedbd310d5dfaf98a0753b42990d38de16106fb175beb07f8b143f9a23d84b150e4116a70f68ac1fda49af7b011a2ad918989d0c5c8f662ca003589b571
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings)
VirusTotal	Search for Analysis

c5188671da62b8ed_adda0989-22be-4c93-a2cc-2cd9b594e2f2

File name	c5188671da62b8ed_adda0989-22be-4c93-a2cc-2cd9b594e2f2
File size	153874 bytes
File type	XML document text
MD5	334d1691b35a2861c2096a40e4b73c68
SHA1	88d65bce73822144473f73c7107a3ad2e8155369
SHA256	c5188671da62b8ed29bec7e0bcd8b19d63afc7c7d8eae7f573ca2bf2d6051903
SHA512	f19c54bf806cf1e84021a4882d384aa605a2d92fb9a7b79163690ee05a2f76272eb04e6657ebf528bb0dd0e9c7e9b344c6264dd630a4e5d7a18332880b902650
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings) Big_Numbers1 (Looks for big numbers 32:sized) memory_shylock ()
VirusTotal	Search for Analysis

cb3ccbb76031e5e0_3c428b1a3e5f57d887ec4b864fac5dcc

File name	cb3ccbb76031e5e0_3c428b1a3e5f57d887ec4b864fac5dcc
File size	914 bytes
File type	data
MD5	e4a68ac854ac5242460afd72481b2a44
SHA1	df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256	cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512	5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings)
VirusTotal	Search for Analysis

24ef3ec34406ece5_3c428b1a3e5f57d887ec4b864fac5dcc

File name	24ef3ec34406ece5_3c428b1a3e5f57d887ec4b864fac5dcc
File size	252 bytes
File type	data
MD5	cab48b562de985fa3febe1c582cc7813
SHA1	a6e645ded49860898d6f3a78dfdfd2eeaa8941a6
SHA256	24ef3ec34406ece5b8ee32e6f77527f634d1a4ca2dad8ccb869355582ffed31e
SHA512	4ed59aef5f93dcd9b9cd487a54078f3d0d86d0a7ef7d0fe9c937242a509851998198ad665cd86ccc680409f9d901b56546c4e8ef9f53309afd102fbecfdbc42f
Ssdeep	None
Yara	None matched
VirusTotal	Search for Analysis

Network Analysis

Hosts Involved

IP Address
104.75.133.129
192.229.211.108
20.224.151.203
20.231.69.218
23.101.14.229
23.99.109.44
70.186.27.24
70.186.27.9
8.8.8.8

DNS Requests

Domain	IP Address
nexus.officeapps.live.com	20.223.225.174
vortex-win.data.microsoft.com	51.11.192.50
armmf.adobe.com	72.247.96.179
cacerts.digicert.com	192.229.211.108
teredo.ipv6.microsoft.com	54.241.176.34
dns.msftncsi.com	131.107.255.255
ctldl.windowsupdate.com	208.111.153.0
config.edge.skype.com	13.107.42.16
ols.officeapps.live.com	52.109.16.60
ipv6.msftncsi.com
nexusrules.officeapps.live.com	52.109.8.45
ocos-office365-s2s.msedge.net	13.107.5.88
officeclient.microsoft.com	52.109.4.32

HTTP Requests

URL	Data
http://cacerts.digicert.com/DigiCertGlobalRootG2.crt	GET /DigiCertGlobalRootG2.crt HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/3679CA35668772304D30A5FB873B0FA77BB70D54.crt?911320f9b04be75f	GET /msdownload/update/v3/static/trustedr/en/3679CA35668772304D30A5FB873B0FA77BB70D54.crt?911320f9b04be75f HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ctldl.windowsupdate.com

Behavior Summary

File-Written

C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
C:\Users\Harry Dresden\AppData\Local\Temp\error035560_01.xml
C:\Users\Harry Dresden\AppData\Local\Temp\~$50d3aa51a95c80f487dd38a75ebc82d1b3766d18.xlsx
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\ADDA0989-22BE-4C93-A2CC-2CD9B594E2F2
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

File-Opened

C:\Users\Harry Dresden\AppData\Local\Temp
C:\
C:\Windows\System32\mscoree.dll
C:\Windows\SysWOW64\en-US\CRYPT32.dll.mui
C:\Windows\Fonts\tahoma.ttf
C:\Windows\System32\en-US\netmsg.dll.mui
C:\Users\Harry Dresden\Favorites\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\2B482C5D-3A63-457D-BC30-53A361F3C4C2
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\C642E3AC-C787-461C-8130-49BC8B3B8E54
C:\Windows\System32\netmsg.dll
C:\Users\Harry Dresden\AppData\Local\Temp\50d3aa51a95c80f487dd38a75ebc82d1b3766d18.xlsx
C:\Users\Harry Dresden\
C:\Users\Harry Dresden\AppData\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\Excel\XLSTART\
C:\Windows\WindowsShell.Manifest
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO40UIRES.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\1033\msointl30.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\83917C1B-CFCF-4F12-BA76-7138123D93FC
C:\Users\Harry Dresden\Links\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\51792303-9B41-4132-AD62-E72F4D1C08D6
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache
C:\Windows\SysWOW64\en-US\USER32.dll.mui
C:\Windows\System32\en-US\imageres.dll.mui
C:\Users\Harry Dresden\Videos\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\1430F911-5AD3-4749-AFAC-24A34E4FD4A9
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\68CF3A26-FE19-459A-A97F-7DAFCB3AD924
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\
C:\Program Files (x86)\Common Files\Microsoft Shared\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso20win32client.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\60B61A8B-72E6-431D-B56F-E4939E48D96C
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\7611C3D4-0673-442E-850F-6C64C041E91E
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\5DD973A5-6B8F-40E7-93DC-F099B3954B65
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSORES.DLL
C:\Users\Harry Dresden\AppData\LocalLow
C:\Windows\System32\imageres.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\B146098F-4064-49C1-985D-AEC3D779A81B
C:\Windows\AppPatch\sysmain.sdb
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\F3721A83-BE42-474E-A0FE-86C399B43BD1
C:\Windows\System32\en-US\d2d1.dll.mui
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\459A34E0-3D69-4909-8E7B-40D4C989545E
C:\Users\Harry Dresden\Pictures\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\54235051-D104-456C-B62E-7BBA73FA48DC
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\Cultures\OFFICE.ODF
C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHEV.DLL
C:\Users\Harry Dresden\Contacts\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\27AE1074-21E3-40FA-AE57-4027C89A1728
C:\Program Files (x86)\Microsoft Office\root\Office16\1033\excel_whatsnew.xml
C:\Users\Harry Dresden\Searches\desktop.ini
C:\Windows\SysWOW64\shell32.dll
C:\Users\Harry Dresden\Downloads\desktop.ini
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\1033\ALRTINTL.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D5CA04B0-F36E-4671-9B61-C281C22245A8
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\BEE1372A-C6B0-45A5-B2DF-946BCF71815A
C:\Program Files (x86)\Microsoft Office\root\Office16\XLSTART\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\2B6C7C22-BAAE-4D80-8E6A-3176CC4E5946
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\88DDE652-0345-4105-81DB-355519848C29
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content
C:\Windows\SysWOW64\en-US\setupapi.dll.mui
C:\Windows\Microsoft.NET\Framework\v4.0.30319\
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat
C:\Windows\System32\en-US\propsys.dll.mui
C:\Users\Harry Dresden
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\0136C3E2-C15B-4825-B21D-FD8681596A3A
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSO.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\7DF8FCF3-C8C9-4CF7-8416-171D71D0C04A
C:\Windows\System32\en-US\shdocvw.dll.mui
C:\Users\Harry Dresden\Documents\
C:\Windows\System32\en-US\webservices.dll.mui
C:\Users\Harry Dresden\AppData\Local\Temp\~$50d3aa51a95c80f487dd38a75ebc82d1b3766d18.xlsx
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\41998CBE-23F6-4A35-9D07-30563B2494C7
C:\Windows\Fonts\SEGOEUISL.TTF
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\ECB4A42C-1CD2-416B-A8EE-28711F2E4748
C:\Windows\Fonts\
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso40uiwin32client.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\71FD5FF9-FB04-4B94-95CF-F362AB85F4C7
C:\Program Files (x86)\Microsoft Office\root\Office16\1033\XLINTL32.DLL
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO99LRES.DLL
C:\Users\Harry Dresden\AppData\Local
C:\Windows\SysWOW64\en-US\SETUPAPI.dll.mui
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\
C:\ProgramData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D8906D2F-B5FB-47A7-A48C-64280468337B
C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO.DLL
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso99Lwin32client.dll
C:\Users\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\C88FD7A6-07CC-42CE-ABF8-77F23D1FCFAC
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\DC7D18FE-1987-4CC1-A220-8C2AB3F89FE4
C:\Users\Harry Dresden\Music\desktop.ini
C:\Users
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\
C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
C:\Users\Harry Dresden\Saved Games\desktop.ini
C:\Windows\Microsoft.NET\Framework\
C:\Users\desktop.ini
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\1033\MSOINTL.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\141E62F4-A1F6-4895-AAD3-8A2A95D4A1E2
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\80B9ABAF-5777-40C6-9BCA-7FF88408BA18
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\A42028F2-CFF8-48B7-B283-04ADC903CA42
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\02F53DDF-4F31-4BA0-97DE-29F451F29819
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\218BD889-250F-4009-AC70-37A89D831B8B
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\
C:\Windows\Fonts\staticcache.dat
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\166A7C48-F18B-4F49-AD05-CA648AF56FB1
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\12E38A7D-EDAC-40BC-8980-4A83DF7AAB2E
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso30win32client.dll
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\3F7A38BA-8B2B-4C7D-817A-A29170E7C939
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso98win32client.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\6E4E86D9-CE48-4E5A-BDC2-529EA93CE6D2
C:\Users\Harry Dresden\AppData\Local\
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\4A1D1BE3-CA4C-4C42-AE17-C9AD7D0BDD26
C:\Windows\System32\shdocvw.dll
C:\Users\Harry Dresden\Desktop\desktop.ini
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
C:\Windows\System32
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\B3F75FA2-5E0D-426B-BC60-74C92AEBECEB
C:\Windows\
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
C:\Users\Harry Dresden\AppData\Local\Temp\
C:\Windows\System32\en-US\msxml6r.dll.mui
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\398C73D5-F266-4B67-A792-8EFC910B2A68
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My
C:\Program Files (x86)\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D81F3CE6-A0F2-4E05-91A2-9A4B8276F8BE
C:\Program Files (x86)\Microsoft Office\root\Office16\CHART.DLL
C:\Windows\Fonts\segoeui.ttf
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\
C:\Program Files (x86)\Microsoft Office\root\Office16\MSPUB.EXE
C:\Users\Harry Dresden\Documents\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\62CA747E-A81B-485E-B093-BF90DBBAE9EC
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\49196BB5-66DD-4A41-B334-5325D2D5E6C5
C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\FEE4C9D3-C3C3-4DD8-9A8A-E5EE2FB996B2
C:\Windows\System32\
C:\Program Files (x86)\Microsoft Office\root\Office16
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D5741299-7A7A-4BE1-86B6-ADB88C449156
C:\Users\Harry Dresden\AppData

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 480, Parent PID: 384

"C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" C:\Users\HARRYD~1\AppData\Local\Temp\50d3aa51a95c80f487dd38a75ebc82d1b3766d18.xlsx PID: 3556, Parent PID: 748

Volatility

Nothing to display.