Cuckoo Sandbox

Category	Started On	Completed On	Duration	Cuckoo Version
FILE	2023-06-18 21:31:44.787744	2023-06-18 21:33:37.734244	112 seconds	2.0-dev

Machine	Label	Manager	Started On	Shutdown On
win7cuckoo	win7 Clone 1	VirtualBox	2023-06-18 21:31:45	2023-06-18 21:33:37

File Details

File name	dae4772df7795451e9a89c23e402e5a07d992c42.xlsx
File size	122036 bytes
File type	Zip archive data, at least v2.0 to extract
CRC32	CEDE0FC5
MD5	bc83c6640b2b7679de22d78c85142c31
SHA1	dae4772df7795451e9a89c23e402e5a07d992c42
SHA256	ea1a5d0a5e8925a38d9e710421cdae65263d1909c3f2d96949379e5e1e9b68a5
SHA512	7b25b0db31be656e50e981da23115616d90d0fc70f89dcb08a4083446669b0b58a6098b1afa9cc15e3ded57d3612e6476d514e892abd633f7e7fd1312e55bbac
Ssdeep	None
PEiD	None matched
Yara	contains_base64 (This rule finds for base64 strings)
VirusTotal	File not found on VirusTotal

MetaFlows Scores

Metaflows Analysis Results (Signatures=50, Anomalies=0, PEiD=0, Yara=0, VT[1687138432]=0): Snort Events=0, AV Events=0
Total Score=50

Dropped File/Buffer Yara Signatures:
fe1e54d11c168dfc_excel.exe_rules.xml: contains_base64

Signatures

raises_exception details

nolookup_communication details

applcation_raises_exception details

creates_doc details

Screenshots

No screenshots available.

Static Analysis

Strings

Dropped Files

efdea51426aad96a_6daf50c1-f12d-4cf1-8a56-00466574792f

File name	efdea51426aad96a_6daf50c1-f12d-4cf1-8a56-00466574792f
File size	156266 bytes
File type	XML document text
MD5	b7ed3ce6f792f7db0ebeb346f73ac90c
SHA1	37a1a9b542b7c0df027e87b5bf10f35c5100a368
SHA256	efdea51426aad96af6df2f1db85215f4bed289d3b7744fb8a4629e415f8ce9c5
SHA512	90bc28a57db1c55eb4e340cad22dea01210caa0800f1c7cb2d0a481f1fccdd763f654db26e23227fb70c01528df5b459947cb0a087b3bf42b79f363e8d0bba56
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings) Big_Numbers1 (Looks for big numbers 32:sized) memory_shylock ()
VirusTotal	Search for Analysis

fe1e54d11c168dfc_excel.exe_rules.xml

File name	fe1e54d11c168dfc_excel.exe_rules.xml
File size	579491 bytes
File type	XML document text
MD5	5eedd9cfdc26653401ae2192865ab384
SHA1	60f9d64a3f48c0d1a5d177dd9d005db50f71272b
SHA256	fe1e54d11c168dfc0c07ca046aa6b811eab2ff3cc7c884c1ed544b86bf9413de
SHA512	f7da093002d13343465f9d602a0e95f967cc34e1f13379eccc1ed2f865abecb6d8ca0369eedd121a6bec3947bea84d9cb8b335b36068aa6bec3bfc6ffc92d836
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings) Str_Win32_Internet_API (Match Windows Inet API call) Big_Numbers1 (Looks for big numbers 32:sized)
VirusTotal	Search for Analysis

cb3ccbb76031e5e0_3c428b1a3e5f57d887ec4b864fac5dcc

File name	cb3ccbb76031e5e0_3c428b1a3e5f57d887ec4b864fac5dcc
File size	914 bytes
File type	data
MD5	e4a68ac854ac5242460afd72481b2a44
SHA1	df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256	cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512	5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings)
VirusTotal	Search for Analysis

942deb331e8cb48b_3c428b1a3e5f57d887ec4b864fac5dcc

File name	942deb331e8cb48b_3c428b1a3e5f57d887ec4b864fac5dcc
File size	252 bytes
File type	data
MD5	76b17943e7cc8962ecf7b9a62fd8c3cb
SHA1	885cad861ba8707a03ea9adf0fe7e61bd97b5672
SHA256	942deb331e8cb48b0e475d184737808e93e9debdc00f0ef0ac7a7bdbcaf7898a
SHA512	c42330be6cc5eaffce61c164a9d5529be1547cee95f0a6d3e4af6654053f8757dfcec3113bd6859791446bacac49844e8a8dc352e83e59544bd08b692cb92b88
Ssdeep	None
Yara	None matched
VirusTotal	Search for Analysis

Network Analysis

Hosts Involved

IP Address
104.75.133.129
192.229.211.108
20.223.225.174
23.101.14.229
23.99.109.44
68.142.107.4
70.186.27.24
70.186.27.9
8.8.8.8

DNS Requests

Domain	IP Address
vortex-win.data.microsoft.com	20.189.173.5
armmf.adobe.com	23.1.100.158
cacerts.digicert.com	192.229.211.108
dns.msftncsi.com	131.107.255.255
ctldl.windowsupdate.com	72.21.81.240
ocos-office365-s2s.msedge.net	13.107.5.88
ols.officeapps.live.com	52.109.0.24
teredo.ipv6.microsoft.com	54.156.11.120
nexus.officeapps.live.com	20.25.84.51
ipv6.msftncsi.com
nexusrules.officeapps.live.com	52.109.8.86
config.edge.skype.com	13.107.42.16
officeclient.microsoft.com	52.109.2.151

HTTP Requests

URL	Data
http://cacerts.digicert.com/DigiCertGlobalRootG2.crt	GET /DigiCertGlobalRootG2.crt HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/3679CA35668772304D30A5FB873B0FA77BB70D54.crt?911320f9b04be75f	GET /msdownload/update/v3/static/trustedr/en/3679CA35668772304D30A5FB873B0FA77BB70D54.crt?911320f9b04be75f HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ctldl.windowsupdate.com
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?99597122bcf08015	GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?99597122bcf08015 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ctldl.windowsupdate.com

Behavior Summary

File-Written

C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\6DAF50C1-F12D-4CF1-8A56-00466574792F
C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5944AACF.png
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
C:\Users\Harry Dresden\AppData\Local\Temp\~$dae4772df7795451e9a89c23e402e5a07d992c42.xlsx
C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A3455E59.png
C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\24CE4086.png
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

File-Opened

C:\Users\Harry Dresden\AppData\Local\Temp
C:\
C:\Windows\System32\mscoree.dll
C:\Windows\SysWOW64\en-US\CRYPT32.dll.mui
C:\Windows\Fonts\tahoma.ttf
C:\Users\Harry Dresden\Favorites\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\2B482C5D-3A63-457D-BC30-53A361F3C4C2
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\C642E3AC-C787-461C-8130-49BC8B3B8E54
C:\Users\Harry Dresden\
C:\Users\Harry Dresden\AppData\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\Excel\XLSTART\
C:\Windows\WindowsShell.Manifest
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO40UIRES.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\1033\msointl30.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\OTele\{B873B1AD-6171-49BF-89FE-C4666F2C8444} (0) - 3872 - winword.exe - OTeleMediumCost.dat
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\83917C1B-CFCF-4F12-BA76-7138123D93FC
C:\Users\Harry Dresden\Links\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\51792303-9B41-4132-AD62-E72F4D1C08D6
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache
C:\Windows\SysWOW64\en-US\USER32.dll.mui
C:\Users\Harry Dresden\Videos\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\1430F911-5AD3-4749-AFAC-24A34E4FD4A9
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\68CF3A26-FE19-459A-A97F-7DAFCB3AD924
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office
C:\Windows\System32\oleaccrc.dll
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\
C:\Program Files (x86)\Common Files\Microsoft Shared\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso20win32client.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\60B61A8B-72E6-431D-B56F-E4939E48D96C
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\7611C3D4-0673-442E-850F-6C64C041E91E
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\OTele\{B873B1AD-6171-49BF-89FE-C4666F2C8444} (0) - 3872 - winword.exe - OTele.dat
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\5DD973A5-6B8F-40E7-93DC-F099B3954B65
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSORES.DLL
C:\Users\Harry Dresden\AppData\LocalLow
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\B146098F-4064-49C1-985D-AEC3D779A81B
C:\Windows\AppPatch\sysmain.sdb
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\F3721A83-BE42-474E-A0FE-86C399B43BD1
C:\Windows\System32\en-US\d2d1.dll.mui
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\459A34E0-3D69-4909-8E7B-40D4C989545E
C:\Users\Harry Dresden\Pictures\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\54235051-D104-456C-B62E-7BBA73FA48DC
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\Cultures\OFFICE.ODF
C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHEV.DLL
C:\Users\Harry Dresden\Contacts\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\27AE1074-21E3-40FA-AE57-4027C89A1728
C:\Users\Harry Dresden\AppData\Local\Temp\dae4772df7795451e9a89c23e402e5a07d992c42.xlsx
C:\Program Files (x86)\Microsoft Office\root\Office16\1033\excel_whatsnew.xml
C:\Users\Harry Dresden\Searches\desktop.ini
C:\Windows\SysWOW64\shell32.dll
C:\Users\Harry Dresden\Downloads\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D5CA04B0-F36E-4671-9B61-C281C22245A8
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\BEE1372A-C6B0-45A5-B2DF-946BCF71815A
C:\Program Files (x86)\Microsoft Office\root\Office16\XLSTART\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\2B6C7C22-BAAE-4D80-8E6A-3176CC4E5946
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\88DDE652-0345-4105-81DB-355519848C29
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content
C:\Windows\SysWOW64\en-US\setupapi.dll.mui
C:\Windows\Microsoft.NET\Framework\v4.0.30319\
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat
C:\Users\Harry Dresden
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\0136C3E2-C15B-4825-B21D-FD8681596A3A
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSO.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\7DF8FCF3-C8C9-4CF7-8416-171D71D0C04A
C:\Windows\System32\en-US\shdocvw.dll.mui
C:\Users\Harry Dresden\Documents\
C:\Windows\System32\en-US\webservices.dll.mui
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\41998CBE-23F6-4A35-9D07-30563B2494C7
C:\Windows\Fonts\SEGOEUISL.TTF
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\ECB4A42C-1CD2-416B-A8EE-28711F2E4748
C:\Windows\Fonts\
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso40uiwin32client.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\71FD5FF9-FB04-4B94-95CF-F362AB85F4C7
C:\Program Files (x86)\Microsoft Office\root\Office16\1033\XLINTL32.DLL
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO99LRES.DLL
C:\Users\Harry Dresden\AppData\Local
C:\Windows\SysWOW64\en-US\SETUPAPI.dll.mui
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\
C:\ProgramData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D8906D2F-B5FB-47A7-A48C-64280468337B
C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO.DLL
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso99Lwin32client.dll
C:\Users\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\C88FD7A6-07CC-42CE-ABF8-77F23D1FCFAC
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\DC7D18FE-1987-4CC1-A220-8C2AB3F89FE4
C:\Users\Harry Dresden\Music\desktop.ini
C:\Users
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\
C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
C:\Users\Harry Dresden\Saved Games\desktop.ini
C:\Windows\Microsoft.NET\Framework\
C:\Users\desktop.ini
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\1033\MSOINTL.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\141E62F4-A1F6-4895-AAD3-8A2A95D4A1E2
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\80B9ABAF-5777-40C6-9BCA-7FF88408BA18
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\A42028F2-CFF8-48B7-B283-04ADC903CA42
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\02F53DDF-4F31-4BA0-97DE-29F451F29819
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\218BD889-250F-4009-AC70-37A89D831B8B
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\
C:\Windows\Fonts\staticcache.dat
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\166A7C48-F18B-4F49-AD05-CA648AF56FB1
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\12E38A7D-EDAC-40BC-8980-4A83DF7AAB2E
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso30win32client.dll
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\3F7A38BA-8B2B-4C7D-817A-A29170E7C939
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso98win32client.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\6E4E86D9-CE48-4E5A-BDC2-529EA93CE6D2
C:\Users\Harry Dresden\AppData\Local\
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\4A1D1BE3-CA4C-4C42-AE17-C9AD7D0BDD26
C:\Windows\System32\shdocvw.dll
C:\Users\Harry Dresden\Desktop\desktop.ini
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
C:\Windows\System32
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\B3F75FA2-5E0D-426B-BC60-74C92AEBECEB
C:\Windows\
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
C:\Users\Harry Dresden\AppData\Local\Temp\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\OTele\
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\398C73D5-F266-4B67-A792-8EFC910B2A68
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My
C:\Program Files (x86)\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D81F3CE6-A0F2-4E05-91A2-9A4B8276F8BE
C:\Program Files (x86)\Microsoft Office\root\Office16\CHART.DLL
C:\Users\Harry Dresden\AppData\Local\Temp\~$dae4772df7795451e9a89c23e402e5a07d992c42.xlsx
C:\Windows\Fonts\segoeui.ttf
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\
C:\Program Files (x86)\Microsoft Office\root\Office16\MSPUB.EXE
C:\Users\Harry Dresden\Documents\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\62CA747E-A81B-485E-B093-BF90DBBAE9EC
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\49196BB5-66DD-4A41-B334-5325D2D5E6C5
C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\FEE4C9D3-C3C3-4DD8-9A8A-E5EE2FB996B2
C:\Windows\System32\
C:\Program Files (x86)\Microsoft Office\root\Office16
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D5741299-7A7A-4BE1-86B6-ADB88C449156
C:\Users\Harry Dresden\AppData

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 480, Parent PID: 384

"C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" C:\Users\HARRYD~1\AppData\Local\Temp\dae4772df7795451e9a89c23e402e5a07d992c42.xlsx PID: 2408, Parent PID: 1312

Volatility

Nothing to display.