Cuckoo Sandbox

Category	Started On	Completed On	Duration	Cuckoo Version
FILE	2023-03-29 20:47:33.913165	2023-03-29 20:49:25.141793	111 seconds	2.0-dev

Machine	Label	Manager	Started On	Shutdown On
win7cuckoo	win7 Clone 1	VirtualBox	2023-03-29 20:47:34	2023-03-29 20:49:24

File Details

File name	fd99eb40ad1105b9693b850abd87058240c872bb.xlsx
File size	11407 bytes
File type	Zip archive data, at least v2.0 to extract
CRC32	3EDC4919
MD5	4d7ccdefcff56768b22236c7dc1102e5
SHA1	fd99eb40ad1105b9693b850abd87058240c872bb
SHA256	6dd07c006fa0b11b3fb5222e5128340253852779d56789e7f817a3ad81518c50
SHA512	dddac5547cc5a8c8402ef5dc21c84ed2d258ee992e97d6134e4fd4ebe96b073bb56034fc0db7364d2c7607d8258a1a6200f5da572bd9bea84aa9d1a345d71a88
Ssdeep	None
PEiD	None matched
Yara	contains_base64 (This rule finds for base64 strings)
VirusTotal	File not found on VirusTotal

MetaFlows Scores

Metaflows Analysis Results (Signatures=50, Anomalies=0, PEiD=0, Yara=0, VT[1680137389]=0): Snort Events=0, AV Events=0
Total Score=50

Dropped File/Buffer Yara Signatures:
fe1e54d11c168dfc_excel.exe_rules.xml: contains_base64

Signatures

raises_exception details

nolookup_communication details

applcation_raises_exception details

creates_doc details

Screenshots

No screenshots available.

Static Analysis

Strings

Dropped Files

f19e0bd89225704d_12dbd172-b338-4dd1-b070-ce8053c5171f

File name	f19e0bd89225704d_12dbd172-b338-4dd1-b070-ce8053c5171f
File size	155399 bytes
File type	XML document text
MD5	9516efb710558be43a2dc806965e78bf
SHA1	85befd3765f576f3f0f0d1530ba350b61c383019
SHA256	f19e0bd89225704d05f8236d6ea4f64b7ba917294f5aca3ff62241a0240dabfc
SHA512	bafb8d9427b3e7e7ab417504ed8666f34b116e69217db3d9f624ce0fae8b162a0562b4c618f3e8fdd3cb264df31671f4ed95e83f5eca37f37150d9705e02749f
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings) Big_Numbers1 (Looks for big numbers 32:sized) memory_shylock ()
VirusTotal	Search for Analysis

cb3ccbb76031e5e0_3c428b1a3e5f57d887ec4b864fac5dcc

File name	cb3ccbb76031e5e0_3c428b1a3e5f57d887ec4b864fac5dcc
File size	914 bytes
File type	data
MD5	e4a68ac854ac5242460afd72481b2a44
SHA1	df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256	cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512	5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings)
VirusTotal	Search for Analysis

cc7407e6075e2db3_3c428b1a3e5f57d887ec4b864fac5dcc

File name	cc7407e6075e2db3_3c428b1a3e5f57d887ec4b864fac5dcc
File size	252 bytes
File type	data
MD5	3ca75e347473acf88d717159439888b4
SHA1	27ad3547d3e8a788084a68174463084dec0b6661
SHA256	cc7407e6075e2db315a85ef7846a20bc5fa640780bcd42ebf9fbc7dda261f522
SHA512	4aa05e2b7e8a98bba8670e856715aa98a627eadfd5f78f178aa3486aa5783a880fde585536f54bfb2d734c8282df004b387109b7a0113d46ddb79988aef9a7a7
Ssdeep	None
Yara	None matched
VirusTotal	Search for Analysis

fe1e54d11c168dfc_excel.exe_rules.xml

File name	fe1e54d11c168dfc_excel.exe_rules.xml
File size	579491 bytes
File type	XML document text
MD5	5eedd9cfdc26653401ae2192865ab384
SHA1	60f9d64a3f48c0d1a5d177dd9d005db50f71272b
SHA256	fe1e54d11c168dfc0c07ca046aa6b811eab2ff3cc7c884c1ed544b86bf9413de
SHA512	f7da093002d13343465f9d602a0e95f967cc34e1f13379eccc1ed2f865abecb6d8ca0369eedd121a6bec3947bea84d9cb8b335b36068aa6bec3bfc6ffc92d836
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings) Str_Win32_Internet_API (Match Windows Inet API call) Big_Numbers1 (Looks for big numbers 32:sized)
VirusTotal	Search for Analysis

Network Analysis

Hosts Involved

IP Address
104.75.133.129
192.229.211.108
20.224.151.203
20.224.201.79
20.50.201.201
23.101.14.229
23.217.118.210
23.99.109.44
70.186.27.24
70.186.27.9
8.8.8.8

DNS Requests

Domain	IP Address
armmf.adobe.com	23.3.84.164
cacerts.digicert.com	192.229.211.108
dns.msftncsi.com	131.107.255.255
vortex-win.data.microsoft.com	20.42.65.84
ctldl.windowsupdate.com	13.107.4.50
config.edge.skype.com	13.107.42.16
ols.officeapps.live.com	52.109.16.60
teredo.ipv6.microsoft.com	54.156.11.120
nexus.officeapps.live.com	20.223.130.133
ipv6.msftncsi.com
nexusrules.officeapps.live.com	20.224.254.73
ocos-office365-s2s.msedge.net	13.107.5.88
officeclient.microsoft.com	52.109.2.151

HTTP Requests

URL	Data
http://cacerts.digicert.com/DigiCertGlobalRootG2.crt	GET /DigiCertGlobalRootG2.crt HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/3679CA35668772304D30A5FB873B0FA77BB70D54.crt?911320f9b04be75f	GET /msdownload/update/v3/static/trustedr/en/3679CA35668772304D30A5FB873B0FA77BB70D54.crt?911320f9b04be75f HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ctldl.windowsupdate.com
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?99597122bcf08015	GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?99597122bcf08015 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ctldl.windowsupdate.com

Behavior Summary

File-Written

C:\Users\Harry Dresden\AppData\Local\Temp\~$fd99eb40ad1105b9693b850abd87058240c872bb.xlsx
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\12DBD172-B338-4DD1-B070-CE8053C5171F
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

File-Opened

C:\Users\Harry Dresden\AppData\Local\Temp
C:\
C:\Windows\System32\mscoree.dll
C:\Windows\SysWOW64\en-US\CRYPT32.dll.mui
C:\Windows\Fonts\tahoma.ttf
C:\Users\Harry Dresden\Favorites\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\2B482C5D-3A63-457D-BC30-53A361F3C4C2
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\C642E3AC-C787-461C-8130-49BC8B3B8E54
C:\Users\Harry Dresden\
C:\Users\Harry Dresden\AppData\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\Excel\XLSTART\
C:\Windows\WindowsShell.Manifest
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO40UIRES.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\1033\msointl30.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\83917C1B-CFCF-4F12-BA76-7138123D93FC
C:\Users\Harry Dresden\Links\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\51792303-9B41-4132-AD62-E72F4D1C08D6
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache
C:\Windows\SysWOW64\en-US\USER32.dll.mui
C:\Users\Harry Dresden\Videos\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\1430F911-5AD3-4749-AFAC-24A34E4FD4A9
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\68CF3A26-FE19-459A-A97F-7DAFCB3AD924
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\
C:\Program Files (x86)\Common Files\Microsoft Shared\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso20win32client.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\60B61A8B-72E6-431D-B56F-E4939E48D96C
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\7611C3D4-0673-442E-850F-6C64C041E91E
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\5DD973A5-6B8F-40E7-93DC-F099B3954B65
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSORES.DLL
C:\Users\Harry Dresden\AppData\LocalLow
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\B146098F-4064-49C1-985D-AEC3D779A81B
C:\Windows\AppPatch\sysmain.sdb
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\F3721A83-BE42-474E-A0FE-86C399B43BD1
C:\Windows\System32\en-US\d2d1.dll.mui
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\459A34E0-3D69-4909-8E7B-40D4C989545E
C:\Users\Harry Dresden\Pictures\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\54235051-D104-456C-B62E-7BBA73FA48DC
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\Cultures\OFFICE.ODF
C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHEV.DLL
C:\Users\Harry Dresden\Contacts\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\27AE1074-21E3-40FA-AE57-4027C89A1728
C:\Program Files (x86)\Microsoft Office\root\Office16\1033\excel_whatsnew.xml
C:\Users\Harry Dresden\Searches\desktop.ini
C:\Windows\SysWOW64\shell32.dll
C:\Users\Harry Dresden\Downloads\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D5CA04B0-F36E-4671-9B61-C281C22245A8
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\BEE1372A-C6B0-45A5-B2DF-946BCF71815A
C:\Program Files (x86)\Microsoft Office\root\Office16\XLSTART\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\2B6C7C22-BAAE-4D80-8E6A-3176CC4E5946
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\88DDE652-0345-4105-81DB-355519848C29
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content
C:\Windows\SysWOW64\en-US\setupapi.dll.mui
C:\Windows\Microsoft.NET\Framework\v4.0.30319\
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat
C:\Users\Harry Dresden
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\0136C3E2-C15B-4825-B21D-FD8681596A3A
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSO.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\7DF8FCF3-C8C9-4CF7-8416-171D71D0C04A
C:\Windows\System32\en-US\shdocvw.dll.mui
C:\Users\Harry Dresden\AppData\Local\Temp\~$fd99eb40ad1105b9693b850abd87058240c872bb.xlsx
C:\Users\Harry Dresden\Documents\
C:\Windows\System32\en-US\webservices.dll.mui
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\41998CBE-23F6-4A35-9D07-30563B2494C7
C:\Windows\Fonts\SEGOEUISL.TTF
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\ECB4A42C-1CD2-416B-A8EE-28711F2E4748
C:\Windows\Fonts\
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso40uiwin32client.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\71FD5FF9-FB04-4B94-95CF-F362AB85F4C7
C:\Program Files (x86)\Microsoft Office\root\Office16\1033\XLINTL32.DLL
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO99LRES.DLL
C:\Users\Harry Dresden\AppData\Local
C:\Windows\SysWOW64\en-US\SETUPAPI.dll.mui
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\
C:\ProgramData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D8906D2F-B5FB-47A7-A48C-64280468337B
C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO.DLL
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso99Lwin32client.dll
C:\Users\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\C88FD7A6-07CC-42CE-ABF8-77F23D1FCFAC
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\DC7D18FE-1987-4CC1-A220-8C2AB3F89FE4
C:\Users\Harry Dresden\Music\desktop.ini
C:\Users
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\
C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
C:\Users\Harry Dresden\Saved Games\desktop.ini
C:\Windows\Microsoft.NET\Framework\
C:\Users\desktop.ini
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\1033\MSOINTL.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\141E62F4-A1F6-4895-AAD3-8A2A95D4A1E2
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\80B9ABAF-5777-40C6-9BCA-7FF88408BA18
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\A42028F2-CFF8-48B7-B283-04ADC903CA42
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\02F53DDF-4F31-4BA0-97DE-29F451F29819
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\218BD889-250F-4009-AC70-37A89D831B8B
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\
C:\Windows\Fonts\staticcache.dat
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\166A7C48-F18B-4F49-AD05-CA648AF56FB1
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\12E38A7D-EDAC-40BC-8980-4A83DF7AAB2E
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso30win32client.dll
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\3F7A38BA-8B2B-4C7D-817A-A29170E7C939
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso98win32client.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\6E4E86D9-CE48-4E5A-BDC2-529EA93CE6D2
C:\Users\Harry Dresden\AppData\Local\
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\4A1D1BE3-CA4C-4C42-AE17-C9AD7D0BDD26
C:\Windows\System32\shdocvw.dll
C:\Users\Harry Dresden\Desktop\desktop.ini
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
C:\Windows\System32
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\B3F75FA2-5E0D-426B-BC60-74C92AEBECEB
C:\Windows\
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
C:\Users\Harry Dresden\AppData\Local\Temp\
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\398C73D5-F266-4B67-A792-8EFC910B2A68
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My
C:\Program Files (x86)\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D81F3CE6-A0F2-4E05-91A2-9A4B8276F8BE
C:\Program Files (x86)\Microsoft Office\root\Office16\CHART.DLL
C:\Windows\Fonts\segoeui.ttf
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\
C:\Program Files (x86)\Microsoft Office\root\Office16\MSPUB.EXE
C:\Users\Harry Dresden\Documents\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\62CA747E-A81B-485E-B093-BF90DBBAE9EC
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\49196BB5-66DD-4A41-B334-5325D2D5E6C5
C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\FEE4C9D3-C3C3-4DD8-9A8A-E5EE2FB996B2
C:\Users\Harry Dresden\AppData\Local\Temp\fd99eb40ad1105b9693b850abd87058240c872bb.xlsx
C:\Windows\System32\
C:\Program Files (x86)\Microsoft Office\root\Office16
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D5741299-7A7A-4BE1-86B6-ADB88C449156
C:\Users\Harry Dresden\AppData

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 480, Parent PID: 384

"C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" C:\Users\HARRYD~1\AppData\Local\Temp\fd99eb40ad1105b9693b850abd87058240c872bb.xlsx PID: 2280, Parent PID: 2848

Volatility

Nothing to display.