|
Payout Receipt.pptx
|
Microsoft PowerPoint 2007+
|
initial sample
|
 |
|
|
| Filetype: |
Microsoft PowerPoint 2007+
|
| Entropy: |
7.978439598376639
|
| Filename: |
Payout Receipt.pptx
|
| Filesize: |
210853
|
| MD5: |
1417101d84f9b072a9d27567e41b12eb
|
| SHA1: |
d4ad5741fd589701af1c8270cfedeced334c0956
|
| SHA256: |
12dda16106f761f8d7508f450b212e3eefdbef67e97ff74afde7ac94ba704498
|
| SHA512: |
64ce5f8c224cd8388876ed9027a515f0e5e60dc10efc0c7b730d2e0d2c83119c4a4a0c8aaa34e9c44895b9d5ae46ff1f494131912f9cd46402c9c30faf43256b
|
| SSDEEP: |
3072:lEhMf8S02zjwwvQj3MTokJuEulCGZquL2tIueTNXsFmnnPqguXABcuQwtdoB:59Jzjwwv18muS4q/aCtX0QKdW
|
| Preview: |
PK............................[Content_Types].xml...n.:....8. p.X..6M..Y...%@..`....7p.....h.Q..Jj..F.......x.^...k...........J.E...~.]..I8%.wP..
......v.......[.....\..X....f..........)........#p4.F....a.V...5......`..m...b.6...w.....<...`. E.`.....k..j.
|
|
|
C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml
|
XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml
|
| Category: |
dropped
|
| Dump: |
CatalogCacheMetaData.xml.3.dr
|
| ID: |
dr_3
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
|
| Entropy: |
5.091142390459905
|
| Encrypted: |
false
|
| Ssdeep: |
48:cGndypdyrKdnzymrkSyrVinzyGDSyX9JdycTdSy8fASyr1JnzyxAdyrfMnzyO:vEpEGd23bI2cb/EUdboAbX2aEQ2O
|
| Size: |
1869
|
| Whitelisted: |
false
|
| Reputation: |
low
|
|
|
C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json
|
JSON data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json
|
| Category: |
dropped
|
| Dump: |
ListAll.Json.3.dr
|
| ID: |
dr_4
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
JSON data
|
| Entropy: |
4.9084889265453135
|
| Encrypted: |
false
|
| Ssdeep: |
3072:gdTb5Sb3F2FqSrfZm+CnQsbzxZO7aYb6f5780K2:wb5q3umBnzT
|
| Size: |
521377
|
| Whitelisted: |
false
|
| Reputation: |
moderate
|
|
|
C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf
|
TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights
Reserved.msofp_4_40RegularVersion 4.40;O365
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf
|
| Category: |
dropped
|
| Dump: |
flat_officeFontsPreview_4_40.ttf.3.dr
|
| ID: |
dr_6
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights
Reserved.msofp_4_40RegularVersion 4.40;O365
|
| Entropy: |
6.55939673749297
|
| Encrypted: |
false
|
| Ssdeep: |
12288:Zn84XULLDs51UJQSOf9VvLXHyheIQ47gEFGHtAgk3+/cLQ/zhm1kjFKy6Nyjbqq+:N8XPDs5+ivOXgo1kYvyz2
|
| Size: |
773040
|
| Whitelisted: |
false
|
| Reputation: |
moderate
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\PowerPoint\1380790193167760279.C4
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\PowerPoint\1380790193167760279.C4
|
| Category: |
dropped
|
| Dump: |
1380790193167760279.C4.3.dr
|
| ID: |
dr_65
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
0.0
|
| Encrypted: |
false
|
| Ssdeep: |
3::
|
| Size: |
32768
|
| Whitelisted: |
true
|
| Reputation: |
high
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\PowerPoint\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.S
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\PowerPoint\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.S
|
| Category: |
dropped
|
| Dump: |
ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.S.3.dr
|
| ID: |
dr_884
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
5.165017571051138
|
| Encrypted: |
false
|
| Ssdeep: |
3:10tnknoliL1SJAHuOsHVWW+Wl111LRydjVlfd+vs:10tnB+IJAOOsHvRt1gFkvs
|
| Size: |
91
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\FA3FA1C8-8B2F-4EAE-AE8F-9258C28FA679
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\FA3FA1C8-8B2F-4EAE-AE8F-9258C28FA679
|
| Category: |
dropped
|
| Dump: |
FA3FA1C8-8B2F-4EAE-AE8F-9258C28FA679.3.dr
|
| ID: |
dr_2
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.28720393760173
|
| Encrypted: |
false
|
| Ssdeep: |
1536:Ri2XfRAqcbH41gwEwLe7HW8bM/o/NMdcAZl1p5ihs7EXXPEAD2Odavo:UCe7HW8bM/o/TXsk4o
|
| Size: |
177810
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules.xml
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules.xml
|
| Category: |
dropped
|
| Dump: |
powerpnt.exe_Rules.xml.3.dr
|
| ID: |
dr_660
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
ASCII text, with CRLF line terminators
|
| Entropy: |
4.780025288688606
|
| Encrypted: |
false
|
| Ssdeep: |
12288:WOB4/zXrZJV0N8x5thr291gess3TylunXb:H4/w
|
| Size: |
1125410
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100042v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100042v2.xml
|
| Category: |
dropped
|
| Dump: |
rule100042v2.xml.3.dr
|
| ID: |
dr_885
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.155248000155917
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdIGXyT9un8DWyZcAAwEerWzlVZ66yuzySNO2su:2dILvDb0wLrWzPr
|
| Size: |
489
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100043v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100043v0.xml
|
| Category: |
dropped
|
| Dump: |
rule100043v0.xml.3.dr
|
| ID: |
dr_886
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.213185196410167
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdAXynO6un8DWyZcAApAQier0lVZ66yuzySNO2su:2dnlvDb0/r0Pr
|
| Size: |
517
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100068v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100068v2.xml
|
| Category: |
dropped
|
| Dump: |
rule100068v2.xml.3.dr
|
| ID: |
dr_887
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.134868815976784
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdlZun8DWyZcAAwEerqlVZ6d7SyFNrlNO2su:2dlZvDb0wLrqP0HFF
|
| Size: |
457
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100069v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100069v1.xml
|
| Category: |
dropped
|
| Dump: |
rule100069v1.xml.3.dr
|
| ID: |
dr_888
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.792062686551037
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdW+un8DWyZcAApAQierAerVxlVZdv2pu+/WkmSP/k//nx2Nf/0//RthmMNOjz:2d3vDb0/rnrVxP2Y+7HSc
|
| Size: |
802
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100070v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100070v0.xml
|
| Category: |
dropped
|
| Dump: |
rule100070v0.xml.3.dr
|
| ID: |
dr_889
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.2896270378885895
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdtr5oun8DWyZcAApAQierglVZ6NO2su:2dtmvDb0/rgPQ
|
| Size: |
410
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100071v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100071v0.xml
|
| Category: |
dropped
|
| Dump: |
rule100071v0.xml.3.dr
|
| ID: |
dr_890
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.295531666329221
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd3LqqNoun8DWyZcAApAQierplVZ6NO2su:2d3OqOvDb0/rpPQ
|
| Size: |
416
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100074v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100074v0.xml
|
| Category: |
dropped
|
| Dump: |
rule100074v0.xml.3.dr
|
| ID: |
dr_891
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.241422570005702
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdWCun8DWyZcAApAQierKNqlVZ6dLJsNO2su:2dPvDb0/rKqP0W
|
| Size: |
500
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100075v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100075v1.xml
|
| Category: |
dropped
|
| Dump: |
rule100075v1.xml.3.dr
|
| ID: |
dr_892
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.184710233838763
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd/ndkTun8DWyZcAAwEerY3tOpv0t/G5yp7s/ZByNO2su:2d/dsvDb0wLrYUlcsBi
|
| Size: |
586
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100076v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100076v2.xml
|
| Category: |
dropped
|
| Dump: |
rule100076v2.xml.3.dr
|
| ID: |
dr_913
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.049181212012891
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd7dkVeun8DWyZcAAwEerN3tOpvdmARdyEXqdUNIdnHD9rgL0NO2su:2dxhvDb0wLrNUD/IDR1
|
| Size: |
729
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100077v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100077v2.xml
|
| Category: |
dropped
|
| Dump: |
rule100077v2.xml.3.dr
|
| ID: |
dr_914
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.158726096353292
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdLF6dkRoun8DWyZcAAwEerm3tOpvvfEFxppvFNvxNO2su:2dLCxvDb0wLrmU1QVvFR3
|
| Size: |
586
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100078v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100078v1.xml
|
| Category: |
dropped
|
| Dump: |
rule100078v1.xml.3.dr
|
| ID: |
dr_915
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.287984558638439
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdQdkV0un8DWyZcAAwEerEA3tOpvNO2su:2dWzvDb0wLrPU/
|
| Size: |
413
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100079v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100079v2.xml
|
| Category: |
dropped
|
| Dump: |
rule100079v2.xml.3.dr
|
| ID: |
dr_916
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.267817827165894
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdCdkJEk3dun8DWyZcAAwEer43tOpvNO2su:2dQQEk3dvDb0wLr4U/
|
| Size: |
412
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100083v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100083v2.xml
|
| Category: |
dropped
|
| Dump: |
rule100083v2.xml.3.dr
|
| ID: |
dr_917
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.231377942579125
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdYZHsHoun8DWyZcAAwEersJV4ciFIqtcifn+0H/Iqttdy9oEINO2su:2dYZGovDb0wLrs8cixcitHTvYg
|
| Size: |
681
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100084v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100084v1.xml
|
| Category: |
dropped
|
| Dump: |
rule100084v1.xml.3.dr
|
| ID: |
dr_918
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.261641260441923
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdN0Iun8DWyZcAAwEerwJVOI3ZaNO2su:2dzvDb0wLryZa
|
| Size: |
403
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100085v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100085v0.xml
|
| Category: |
dropped
|
| Dump: |
rule100085v0.xml.3.dr
|
| ID: |
dr_919
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.2961268242072945
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdG8un8DWyZcAApAQierLYsldUqNO2su:2dG8vDb0/rUqaq
|
| Size: |
421
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100094v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100094v0.xml
|
| Category: |
dropped
|
| Dump: |
rule100094v0.xml.3.dr
|
| ID: |
dr_920
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.193779288742389
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdUW0Tun8DWyZcAAwEer++WuF2yab9zNO2su:2dUW0TvDb0wLrDWQ25
|
| Size: |
457
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule1000v5.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule1000v5.xml
|
| Category: |
dropped
|
| Dump: |
rule1000v5.xml.3.dr
|
| ID: |
dr_921
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.552983510334679
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d0NWlw0/53bTwGuNn/hFF4j68OWxue+Iz:c8L0h3bUGuZjF4Bp7z
|
| Size: |
1594
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100104v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100104v2.xml
|
| Category: |
dropped
|
| Dump: |
rule100104v2.xml.3.dr
|
| ID: |
dr_922
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.13263189574204
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dxlKvDb0wGorplx2Lx2divhC152lU00I:cxIRlasomo/0I
|
| Size: |
950
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100105v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100105v0.xml
|
| Category: |
dropped
|
| Dump: |
rule100105v0.xml.3.dr
|
| ID: |
dr_943
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.1130725494870894
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdYislFun8DWyZcAAwHmdertHwr28KCQmFrnytg/84ADFNyFkd+DO2klU3gNOQ:2dclFvDb0wGoryoK3kLD+8lU3I
|
| Size: |
841
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100106v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100106v0.xml
|
| Category: |
dropped
|
| Dump: |
rule100106v0.xml.3.dr
|
| ID: |
dr_944
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.1005145953903295
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdY1qgkIun8DWyZcAAwHmderm828KR/utxfHxlF82yp1DEfE5kyjkdKO2klU5k:2dvIvDb0wGorwY/Fk1I85kpKIlU5LI
|
| Size: |
1045
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100109v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100109v1.xml
|
| Category: |
dropped
|
| Dump: |
rule100109v1.xml.3.dr
|
| ID: |
dr_945
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.118071593489877
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdYNxun8DWyZcAAwEerJ7sWtlZXaWtvMfZvwxdy96JfMyxNO2su:2dwxvDb0wLrhdM5wrR0y3
|
| Size: |
545
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100110v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100110v1.xml
|
| Category: |
dropped
|
| Dump: |
rule100110v1.xml.3.dr
|
| ID: |
dr_946
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.1674364373796875
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5d20QTun8DWyZcAAwEer+sWtlZXaWtvMfZvwxNO2su:2d5d20QTvDb0wLr+dM5w3
|
| Size: |
460
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100113v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100113v0.xml
|
| Category: |
dropped
|
| Dump: |
rule100113v0.xml.3.dr
|
| ID: |
dr_947
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.601167606059205
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7cD4HperhrJ8d+/OCxnJUq+/ClynMJ/IiiLynJo/AYlMNOn2sby:TMHd+OerXauHIPMxIiOySAYlMNO2su
|
| Size: |
459
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100114v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100114v0.xml
|
| Category: |
dropped
|
| Dump: |
rule100114v0.xml.3.dr
|
| ID: |
dr_948
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.619601498995438
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7cJY4HperhrJfd+/OKxnJUq+/ClynMJ/IiiLynJo/AYlMNOn2sby:TMHdIYOerXFuxIPMxIiOySAYlMNO2su
|
| Size: |
460
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100115v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100115v0.xml
|
| Category: |
dropped
|
| Dump: |
rule100115v0.xml.3.dr
|
| ID: |
dr_949
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.634867139946224
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd4OerXhSuIYVIPMxIiOySAYlMNO2su:2dOrXhSjYeC
|
| Size: |
459
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100116v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100116v0.xml
|
| Category: |
dropped
|
| Dump: |
rule100116v0.xml.3.dr
|
| ID: |
dr_950
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.61410460841382
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7cKZ4HperhrJ3pd+/O9J5xnJUq+/ClynMJ/IiiLynJo/AYlMNOn2sby:TMHdLZOerX/ugjIPMxIiOySAYlMNO2su
|
| Size: |
461
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100117v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100117v0.xml
|
| Category: |
dropped
|
| Dump: |
rule100117v0.xml.3.dr
|
| ID: |
dr_951
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.635238648155877
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdaOerXS7usrSIPMxIiOySAYlM4DRALNO2su:2dgrXS7vBLa
|
| Size: |
535
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100118v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100118v1.xml
|
| Category: |
dropped
|
| Dump: |
rule100118v1.xml.3.dr
|
| ID: |
dr_952
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.59746090389454
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdBOOerXYAuLIPMxIiOySAYlM4DRALnoIaxxR+7xNO2su:2dBkrX7FLP3473
|
| Size: |
680
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100119v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100119v0.xml
|
| Category: |
dropped
|
| Dump: |
rule100119v0.xml.3.dr
|
| ID: |
dr_973
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.703094974590429
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdQmtun8DWyZcAAwEi0iiFi7i9iwOi40NCahIffONf6osf/yGnxMmKN06OXj4i:2dBvDb0w860tS9KPO8BtcRwtI
|
| Size: |
1137
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100124v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100124v2.xml
|
| Category: |
dropped
|
| Dump: |
rule100124v2.xml.3.dr
|
| ID: |
dr_974
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.271528662709587
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdTdkOun8DWyZcAAwEerm73tOpvNO2su:2d5bvDb0wLr0U/
|
| Size: |
409
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100125v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100125v2.xml
|
| Category: |
dropped
|
| Dump: |
rule100125v2.xml.3.dr
|
| ID: |
dr_975
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.2429290585512724
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdYdk9un8DWyZcAAwEerHFU3tOpvStMSAY9NO2su:2du8vDb0wLrH+UctMgz
|
| Size: |
509
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100126v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100126v2.xml
|
| Category: |
dropped
|
| Dump: |
rule100126v2.xml.3.dr
|
| ID: |
dr_976
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.259684957183188
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5PdkMSBun8DWyZcAAwEerHFLS3tOpvStMSAY9NO2su:2d51kBvDb0wLrHsUctMgz
|
| Size: |
515
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100127v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100127v2.xml
|
| Category: |
dropped
|
| Dump: |
rule100127v2.xml.3.dr
|
| ID: |
dr_977
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.234524039048711
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdWdkLpun8DWyZcAAwEerHFY3tOpvStMSAY9NO2su:2dkkvDb0wLrHyUctMgz
|
| Size: |
501
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100128v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100128v1.xml
|
| Category: |
dropped
|
| Dump: |
rule100128v1.xml.3.dr
|
| ID: |
dr_978
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.254995423773981
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdmdkdun8DWyZcAAwEerX3tOpvNO2su:2dUGvDb0wLrXU/
|
| Size: |
418
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100129v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100129v2.xml
|
| Category: |
dropped
|
| Dump: |
rule100129v2.xml.3.dr
|
| ID: |
dr_979
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.258730267850173
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdcdkxtun8DWyZcAAwEerLVU73tOpvNO2su:2dysvDb0wLr4U/
|
| Size: |
418
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100130v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100130v0.xml
|
| Category: |
dropped
|
| Dump: |
rule100130v0.xml.3.dr
|
| ID: |
dr_980
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.202017526192053
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdBCvdun8DWyZcAAwEerD43tOpvdmARNO2su:2dGdvDb0wLrkUDT
|
| Size: |
485
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100131v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100131v1.xml
|
| Category: |
dropped
|
| Dump: |
rule100131v1.xml.3.dr
|
| ID: |
dr_981
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.057028798011694
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdy/dkkLun8DWyZcAAwEerZ3tOpvdmARdyEXqdUNIdNO2su:2dClvDb0wLrZUD/Ip
|
| Size: |
639
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100132v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100132v1.xml
|
| Category: |
dropped
|
| Dump: |
rule100132v1.xml.3.dr
|
| ID: |
dr_982
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.097491847536972
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdVndkkD5kEcFdun8DWyZcAAwEeri3tOpvdmARdyEXqdUNIdNO2su:2dzNLc7vDb0wLriUD/Ip
|
| Size: |
656
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100133v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100133v1.xml
|
| Category: |
dropped
|
| Dump: |
rule100133v1.xml.3.dr
|
| ID: |
dr_1003
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.0658952579474645
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdo/dkk8Lun8DWyZcAAwEerPMS3tOpvdmARdyEXqdUNIdNO2su:2doFuLvDb0wLrPMSUD/Ip
|
| Size: |
643
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100134v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100134v1.xml
|
| Category: |
dropped
|
| Dump: |
rule100134v1.xml.3.dr
|
| ID: |
dr_1004
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.0659835404992695
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdNAOdkk8/LIun8DWyZcAAwEerhS3tOpvdmARdyEXqdUNIdnHD9rgL0NO2su:2dN/ucvDb0wLrhSUD/IDR1
|
| Size: |
742
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100201v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100201v0.xml
|
| Category: |
dropped
|
| Dump: |
rule100201v0.xml.3.dr
|
| ID: |
dr_1005
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.284731259430513
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd0Q4Iun8DWyZcAApAQierVLE7WNoSNO2su:2dN4IvDb0/r9H
|
| Size: |
409
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100202v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100202v0.xml
|
| Category: |
dropped
|
| Dump: |
rule100202v0.xml.3.dr
|
| ID: |
dr_1006
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.183023140804415
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdZqRoun8DWyZcAApAQierRD2HXAGMnPyfY7KMyntwKXO+NO2su:2d4CvDb0/rRa95qKEz+
|
| Size: |
595
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule10450v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule10450v3.xml
|
| Category: |
dropped
|
| Dump: |
rule10450v3.xml.3.dr
|
| ID: |
dr_1007
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.065099138149148
|
| Encrypted: |
false
|
| Ssdeep: |
24:2deuddRgeTukPSAsx+AQ0ehi+JWEbWWEieeqiK5fejM:c1fRgeT8lx+9pYEbREBZ
|
| Size: |
1053
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule10625v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule10625v0.xml
|
| Category: |
dropped
|
| Dump: |
rule10625v0.xml.3.dr
|
| ID: |
dr_1008
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.9078381910356925
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d7OrgdAFxFzFobQFPFXX8XXXsF8krtr9+w9t19Vw9Qtf:c7OFLNoQp1X8HXaZrJNv1keN
|
| Size: |
2690
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule10626v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule10626v1.xml
|
| Category: |
dropped
|
| Dump: |
rule10626v1.xml.3.dr
|
| ID: |
dr_1009
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.836265291604784
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSBVzjRGNdRDDHwpatEervc1NQzDeze9bbTu6oXHaSMt6lzXAWNOLSXdRTcIX:2dSB6dRgeLr+qJSlzQpoFn1J+Q+17Ju
|
| Size: |
1341
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule10627v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule10627v1.xml
|
| Category: |
dropped
|
| Dump: |
rule10627v1.xml.3.dr
|
| ID: |
dr_1010
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.763988090772443
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dUah8dRge8Wqw//tbQz1HAQcV6AQVeQ+fFQxNoQyQBQdoQmf:cUa6RgelqwHts5FzlVP+St7+d9mf
|
| Size: |
1779
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule10781v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule10781v1.xml
|
| Category: |
dropped
|
| Dump: |
rule10781v1.xml.3.dr
|
| ID: |
dr_1011
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.329435177677775
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHddRyberiNereujDb8OKX/c//fpONkMNO/HNUlu:2dd9riYrtuE7
|
| Size: |
479
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule10784v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule10784v0.xml
|
| Category: |
dropped
|
| Dump: |
rule10784v0.xml.3.dr
|
| ID: |
dr_1012
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.825673007247234
|
| Encrypted: |
false
|
| Ssdeep: |
48:cONRgeWqiLsV/6xP+YyKJkyiyqy40yymP7:3RgemLsV/6tnHkcqR01mP7
|
| Size: |
1736
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule10800v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule10800v0.xml
|
| Category: |
dropped
|
| Dump: |
rule10800v0.xml.3.dr
|
| ID: |
dr_1022
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.385258368553274
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd/fercferSDb8OKX/c//fpONkMNOjsu:2d+rRrt+
|
| Size: |
455
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule10801v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule10801v0.xml
|
| Category: |
dropped
|
| Dump: |
rule10801v0.xml.3.dr
|
| ID: |
dr_1023
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.339202408736384
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdCZfi0DO5Q//WRff/0//ShmMnENWwmhfP/k//ix2Nf/0//g//mhfP/k//4x23:2dCfDyjOOpOO1H1HOcEIO9DO2nP
|
| Size: |
2683
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule10802v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule10802v0.xml
|
| Category: |
dropped
|
| Dump: |
rule10802v0.xml.3.dr
|
| ID: |
dr_1024
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.336471169334665
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdxfi0S15Q//WRff/0//ShmMnENWwmhfP/k//ix2Nf/0//g//mhfP/k//4x2NR:2dXkjOOpOO1H1HOcEIO9DO2nP
|
| Size: |
2683
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11370v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11370v1.xml
|
| Category: |
dropped
|
| Dump: |
rule11370v1.xml.3.dr
|
| ID: |
dr_829
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.004173158996676
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdrBVzjpOsdRDDHwpatE+ic1NerBHNdflLOy0gMOXHISMNOS/HNClu:2drB7DdRgelfYrhT9iYB+Z
|
| Size: |
667
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11381v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11381v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11381v0.xml.3.dr
|
| ID: |
dr_832
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.2355029291387805
|
| Encrypted: |
false
|
| Ssdeep: |
48:cU7u2RgelfYrTnWQqMJhI8SUmgI8vzwXr0Z:37Rge+SJMw8Sh/8vzwb0Z
|
| Size: |
2409
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11446v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11446v1.xml
|
| Category: |
dropped
|
| Dump: |
rule11446v1.xml.3.dr
|
| ID: |
dr_835
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.199919152742344
|
| Encrypted: |
false
|
| Ssdeep: |
96:kRgezufyyYyoZqZ8rsIYnhl+itZXq/qh8gk2nANwvNFte8W8c8eu8O8dUJLltLq9:kDgyxlEdy/ozM2JLltOrZ
|
| Size: |
10729
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11464v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11464v1.xml
|
| Category: |
dropped
|
| Dump: |
rule11464v1.xml.3.dr
|
| ID: |
dr_838
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.169007843122619
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdFVzj7dRDDHwpat5rerKHuSn8UMNO2su:2dFVdRgewrGk
|
| Size: |
473
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11498v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11498v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11498v0.xml.3.dr
|
| ID: |
dr_841
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.3475921100141175
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdw4VzjmtFH6dRDDHwpat5Gger1U5+TXZNO2su:2dlcFH6dRgeAr7Tf
|
| Size: |
413
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11499v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11499v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11499v0.xml.3.dr
|
| ID: |
dr_844
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.357045061379154
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dw2BdRgelfYrBGUJ90XwOaPJiAGJTR0ZymN+9ZZ:cw2rRgelfYlGQaQtsR3ZZ
|
| Size: |
1452
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11500v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11500v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11500v0.xml.3.dr
|
| ID: |
dr_847
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.158050495180622
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdrjVzjmjhdRDDHwpatE+ic1Ner/yeXHISMNOS/HNClu:2dvmdRgelfYrL+Z
|
| Size: |
552
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11502v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11502v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11502v0.xml.3.dr
|
| ID: |
dr_849
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.167435603528131
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dtfB2dRgewrlywDnz/rhOEe4ECIn+LdRrz:ctp6RgewiEe4hI+LdRH
|
| Size: |
990
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11504v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11504v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11504v0.xml.3.dr
|
| ID: |
dr_851
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.017793697630464
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dL3J62sdRgeyxvVrn2rJrMrNoBOOrkGgF2rkIZF+:cL3k28RgeyxvVKtAR6xwGgowIZF+
|
| Size: |
1101
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11514v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11514v1.xml
|
| Category: |
dropped
|
| Dump: |
rule11514v1.xml.3.dr
|
| ID: |
dr_852
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.393023802643219
|
| Encrypted: |
false
|
| Ssdeep: |
96:llRgeZHnmf6gagmWrn+YaF8+pusa7LlrC0QFzInWbt2374BbKy5:rDZH0tQp/e3374BbKy5
|
| Size: |
6785
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11659v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11659v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11659v0.xml.3.dr
|
| ID: |
dr_859
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.3112013575014405
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdGDVzjon7dRDDHwpat5lkB9Je1zVhEXMNO2su:2dGDEdRge7E9fXk
|
| Size: |
428
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11701v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11701v1.xml
|
| Category: |
dropped
|
| Dump: |
rule11701v1.xml.3.dr
|
| ID: |
dr_862
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.140935693060115
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dRV6dRgetvroWrxrorVAquDT2DTZ1If7:cRV2RgetvsWNkXIf7
|
| Size: |
1129
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11705v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11705v1.xml
|
| Category: |
dropped
|
| Dump: |
rule11705v1.xml.3.dr
|
| ID: |
dr_865
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.706340035425865
|
| Encrypted: |
false
|
| Ssdeep: |
48:clERge5v4JIBY1U2ehBcYF9HRgs8Hr/Xs:JRge5hgzrfs
|
| Size: |
3171
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11710v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11710v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11710v0.xml.3.dr
|
| ID: |
dr_868
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.23021248178263
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdaVzjw+dRDDHwpatUclPJe1zbhxBHOTWHyn/apx4MNO2su:2daC+dRgeUc98hXHqWHMk
|
| Size: |
631
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11767v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11767v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11767v0.xml.3.dr
|
| ID: |
dr_871
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.802109708779993
|
| Encrypted: |
false
|
| Ssdeep: |
24:2derVrumt4ZPjqTZ2DCNlwOaZ2DCdJZ2DCgz2DiPX2Diq/2DC0PWxVHnPWl9XVlQ:cehymt4tqTnQdJgCt9Xp
|
| Size: |
2649
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11768v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11768v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11768v0.xml.3.dr
|
| ID: |
dr_874
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.605188552555672
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dULuQfXAt4yfXr5+7teoZ4e+FneC1PL4e0j5eAOeD:cOu2XAt4AXr5bj2z
|
| Size: |
2153
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11769v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11769v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11769v0.xml.3.dr
|
| ID: |
dr_877
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.187029908716092
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d2WsdRge8DvS8fbwOdIybGbkvbCbNvQe8LL8X1QJ5EcB7:c2JRge0vS8zgwU8gNE8lFQ
|
| Size: |
2798
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11770v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11770v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11770v0.xml.3.dr
|
| ID: |
dr_879
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.601125821968251
|
| Encrypted: |
false
|
| Ssdeep: |
48:cge8jRgeLWvS8UNwR7dOhJz+701RsrMo7:a8jRgeCbUNwR7dOHry7
|
| Size: |
4634
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11771v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11771v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11771v0.xml.3.dr
|
| ID: |
dr_881
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.292942473815119
|
| Encrypted: |
false
|
| Ssdeep: |
96:1RgegbwwwYwHA1yfiKqLAqrUmYuAbL+hWGL4Hf7:1Dgq1ycGL4/7
|
| Size: |
7262
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11792v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11792v1.xml
|
| Category: |
dropped
|
| Dump: |
rule11792v1.xml.3.dr
|
| ID: |
dr_882
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.789256707640678
|
| Encrypted: |
false
|
| Ssdeep: |
96:wRgenbY5CH/dKfF9feKHg+CjrQP87tPzu7:wDnihGtLu7
|
| Size: |
7022
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11793v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11793v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11793v0.xml.3.dr
|
| ID: |
dr_895
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.65026027684882
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dV5nx6dRgeLr3vS8dbwOa71EeEgFwEcF4ES7:cV5nx2RgeLLvS8hQ8S7
|
| Size: |
1217
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11794v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11794v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11794v0.xml.3.dr
|
| ID: |
dr_897
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.6365736385425627
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dsrXhomuyaPkI3t41ST1lwOa1XOP4POsPv0x8:csFomuyab3t4QTDQ/
|
| Size: |
1382
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11834v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11834v1.xml
|
| Category: |
dropped
|
| Dump: |
rule11834v1.xml.3.dr
|
| ID: |
dr_899
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.9857348097565484
|
| Encrypted: |
false
|
| Ssdeep: |
24:2duKWhdRge+AuMqrKH+aKDH+a8R0B+AOL:cuTRgeJuMVe9ezR0YAOL
|
| Size: |
1403
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11882v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11882v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11882v0.xml.3.dr
|
| ID: |
dr_901
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.249517661765813
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdS1VzjKdRDDHwpat5rereMWasWWW+qDiVfuWSwieFUe3nlWfN1DS8BuM8BSuC:2dEgdRgeArT1ryndrm1m8BL8Br8ey8ed
|
| Size: |
1114
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11890v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11890v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11890v0.xml.3.dr
|
| ID: |
dr_903
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.619641857199903
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dpLVPPdRgeLrSovvS8TejqwOavTQjTFY7:cpLVPlRgeLOovvS8ToqQvWxY7
|
| Size: |
1085
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11930v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11930v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11930v0.xml.3.dr
|
| ID: |
dr_905
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.305751169482486
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dXrVr3r8ghrbzwJQkGqzGnZGn3zGnnGqzGnMFh:cX5rbhMJQkGqGZGjGnGqGMFh
|
| Size: |
1212
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11931v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11931v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11931v0.xml.3.dr
|
| ID: |
dr_907
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.08920233705384
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdzVzj3dNPdRDDHwpat5ai0csr8/ByMhvNxpJNEuONO2su:2dz5PdRgeQcRmF
|
| Size: |
569
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11932v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11932v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11932v0.xml.3.dr
|
| ID: |
dr_909
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.668625032816456
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d8sBdRge/cvvS8OrwOm6+Qr/Qt+qCm+aF2+yPwUUqbR1R97:c8WRge0vvS8U7ron/aoUUgfz7
|
| Size: |
3232
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11933v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11933v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11933v0.xml.3.dr
|
| ID: |
dr_911
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.7999978378778105
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dxQBdRgeQrzvS8/UvwOHU2PUQHaUQZPU+LUKPUOsU6PUWaU8UUqbR1R97:cxyRgeQvvS8ODHU1zC4UUgfz7
|
| Size: |
3343
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11939v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11939v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11939v0.xml.3.dr
|
| ID: |
dr_912
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.24802525642993
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdbVzj9xdjdRDDHwpat5aerkDr8/MbNO2su:2db7dRgefrQx
|
| Size: |
410
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11950v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11950v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11950v0.xml.3.dr
|
| ID: |
dr_925
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.941151920409955
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dM8x6dRgebAuyRDu4Vcwgeg+6Kp5cTIBDR/B+SrCFG:cM8x2RgeMuyRS4VxQdIliFG
|
| Size: |
1286
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11981v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11981v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11981v0.xml.3.dr
|
| ID: |
dr_927
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.203053398959187
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdOVzj5d7jdRDDHwpatEerCefXFJnArQd7cHaSMNO/HNUlu:2dOPd7jdRgeLrCevvld7o7
|
| Size: |
487
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11989v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule11989v0.xml
|
| Category: |
dropped
|
| Dump: |
rule11989v0.xml.3.dr
|
| ID: |
dr_929
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.2050849295587565
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdWVzjDdRDDHwpatEMuJe1zjFP9Asf5+AQxpbe/py4IMSe/jMSkNO2su:2dWxdRgeruEAsx+AQHehgejM
|
| Size: |
700
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120100v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120100v3.xml
|
| Category: |
dropped
|
| Dump: |
rule120100v3.xml.3.dr
|
| ID: |
dr_931
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.7018389810195864
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdMPOO+QMfXFJFfcJfikfGvX4OjPNeJH/M//a5eNX/c//fezPNuc3/8//lSJud:2dMP4QevWRQrPGOZPzqhH
|
| Size: |
999
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120107v6.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120107v6.xml
|
| Category: |
dropped
|
| Dump: |
rule120107v6.xml.3.dr
|
| ID: |
dr_933
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.4661937782352386
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dCdgIqmBrerZWianT2lPBPzaonzPbcPeHsK6P4P49XCJYP4PVdwiJW/+fikA9GR:cCawSEi4TghV/xakIGR
|
| Size: |
2180
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120110v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120110v4.xml
|
| Category: |
dropped
|
| Dump: |
rule120110v4.xml.3.dr
|
| ID: |
dr_935
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.7979606654893825
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d0cbdJpIqGvlYrptc7XwzPbqVctTP1u7:c0On3mYtyAvj+
|
| Size: |
1012
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120112v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120112v1.xml
|
| Category: |
dropped
|
| Dump: |
rule120112v1.xml.3.dr
|
| ID: |
dr_937
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.925273258562081
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdNTogoPln55QPwYHyj39Kmlwy+QMfiuficglVb5E7PNWXf/0//TfhmMNO/HNK:2dNkbd5yIqGvlMQ0HgPtEPQ7Y
|
| Size: |
707
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120119v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120119v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120119v0.xml.3.dr
|
| ID: |
dr_939
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.555072319833569
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dfdXaIqmlXeWrZr2Q6P4Pv9kCkP4P/wd5ijh:cfQyOWthh
|
| Size: |
1330
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120120v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120120v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120120v0.xml.3.dr
|
| ID: |
dr_941
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.821523960139548
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd0kogoPliPPwYHyj3HerHqHfiq/i7uiX7PNWAPJNf/0//4fhmMRiX7PNWQAJL:2dIbdEIqrrHqEuiLPRPrwLPQJ7
|
| Size: |
861
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120125v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120125v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120125v0.xml.3.dr
|
| ID: |
dr_942
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.629259990506597
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdvn7PwYHyj3vAQ2Kmlwyi0s+u/qNO5fX/c//wVrMpONdiO+kXqNObfX/c//wT:2d/7IqhvlXjuy0j4TqjG/6
|
| Size: |
935
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120126v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120126v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120126v0.xml.3.dr
|
| ID: |
dr_955
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.4777365974062833
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdjYberNmO+u/jOzeKNug3/8//AcJuNH/M//KNuxvsK3/8//AcJuN5eNX/c//p:2djhrCuA1xDl+2KApxD+zK8
|
| Size: |
1660
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120126v8.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120126v8.xml
|
| Category: |
dropped
|
| Dump: |
rule120126v8.xml.3.dr
|
| ID: |
dr_957
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.719006786338845
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdjAbermer/erG+kXjOaNese4H/M//J5eNX/c//aNese4H/M//fw5eNpONd+wf:2djpr5r2r1axewZTxewwtwOaAPfHMs6B
|
| Size: |
1172
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120127v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120127v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120127v0.xml.3.dr
|
| ID: |
dr_959
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.9234314786976854
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd/bc3fXFJFfiOzOeF/iweu5xlWLPNmjOP/k//bPN2Lx//U//cBGNx2Nf/0//y:2d+vvVFUbPnsPyXcPiSMPSM
|
| Size: |
1177
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120128v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120128v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120128v0.xml.3.dr
|
| ID: |
dr_961
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.176719630355306
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd89Xx1PwYHyj3vAQ3mlwyerNbx+/oVrz6+/ntW+/CNO2su:2d01IqVlYrzFoJX
|
| Size: |
657
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule12019v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule12019v1.xml
|
| Category: |
dropped
|
| Dump: |
rule12019v1.xml.3.dr
|
| ID: |
dr_963
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.60180606792738
|
| Encrypted: |
false
|
| Ssdeep: |
48:csPRgeauyLxQtV7h6HOHQLhBLibB6HOHGQdqJpwXEw5N7:HRgeausxQ7hMLh2Byx4XPj7
|
| Size: |
3816
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120201v14.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120201v14.xml
|
| Category: |
dropped
|
| Dump: |
rule120201v14.xml.3.dr
|
| ID: |
dr_965
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.9348078745429325
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d8d4A0Iqs2QYrAlKh4WApCt4BzAoJE9PfrZ1zY05GwsMOnvFEizIUhNySELwHOY:c84L8kgwt4BPJ4bzlfOtrICsCHtH894f
|
| Size: |
2640
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120205v11.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120205v11.xml
|
| Category: |
dropped
|
| Dump: |
rule120205v11.xml.3.dr
|
| ID: |
dr_967
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.783329374973241
|
| Encrypted: |
false
|
| Ssdeep: |
48:c7fsfEt4BX79qPJ4sUbVn1VO50TOtrICsL:IKE+X5kKVpYrIDL
|
| Size: |
3029
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120300v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120300v3.xml
|
| Category: |
dropped
|
| Dump: |
rule120300v3.xml.3.dr
|
| ID: |
dr_969
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.4482435960164395
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdmObxpSEXKudrU0x/x7PNWUZtZf/0//ExhmMspS7PNWUMTf/0//ahmMp1xpS8:2dmwXKWQwPp/VNZPpMD11uP+x
|
| Size: |
961
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120305v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120305v3.xml
|
| Category: |
dropped
|
| Dump: |
rule120305v3.xml.3.dr
|
| ID: |
dr_971
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.684191125363692
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdRYoPlR6VPwYHyj3vAQMm2Ni0G+u/5lOrX/c//l4pONdc8BjEaCw8/Lg5/e1N:2dRzdyIqG2X1uQYbF4M6PapU3ZbBT9
|
| Size: |
1453
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120307v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120307v1.xml
|
| Category: |
dropped
|
| Dump: |
rule120307v1.xml.3.dr
|
| ID: |
dr_972
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.749564309320366
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdqoPlr0PwYHyjLm2NVcefQjEBi+wsvX5lO8xX/c//PpON+PvXcOp1lVYFjuDs:2dtdr0IqR2nYOJwOfVqrPaQUsv2Bv
|
| Size: |
1249
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule12035v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule12035v0.xml
|
| Category: |
dropped
|
| Dump: |
rule12035v0.xml.3.dr
|
| ID: |
dr_985
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.218494123729328
|
| Encrypted: |
false
|
| Ssdeep: |
48:cvERgeLTvS8TYovpiqxOYs60s59lf0sA7:5Rgenb0gpik/s60sVf0sA7
|
| Size: |
2467
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120402v21.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120402v21.xml
|
| Category: |
dropped
|
| Dump: |
rule120402v21.xml.3.dr
|
| ID: |
dr_987
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.955693169986947
|
| Encrypted: |
false
|
| Ssdeep: |
48:cMoMLaYeYg05WdhSsw0zeQgNg8NgRkUlrtvzxEd0NiRgiR3Si:nzQg5EhS+ZvzRUX3F
|
| Size: |
3787
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120501v17.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120501v17.xml
|
| Category: |
dropped
|
| Dump: |
rule120501v17.xml.3.dr
|
| ID: |
dr_989
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.311164534979612
|
| Encrypted: |
false
|
| Ssdeep: |
48:cXuXqt11wux1Jx95XicChw1c1Ny3aCNnuv:cuXqNhxnxfScChAMNk0
|
| Size: |
7806
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120600v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120600v4.xml
|
| Category: |
dropped
|
| Dump: |
rule120600v4.xml.3.dr
|
| ID: |
dr_991
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.991513830301989
|
| Encrypted: |
false
|
| Ssdeep: |
48:c8L1wcNgUZNZDhC5PrGHYzZGCXhf1by0/h9Jr9Jm6:HpH/DczQyZlhjJpJm6
|
| Size: |
2979
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120601v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120601v3.xml
|
| Category: |
dropped
|
| Dump: |
rule120601v3.xml.3.dr
|
| ID: |
dr_993
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.997102990206506
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dqzdiIq4lVJd572lGA7CzB5HAqlAc/R4R32rN/u2IXCT/22/lHicLNZblqv:cSEwx5ilbK5HAqlAhR2rX2o2ulicL5qv
|
| Size: |
3341
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120602v8.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120602v8.xml
|
| Category: |
dropped
|
| Dump: |
rule120602v8.xml.3.dr
|
| ID: |
dr_995
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.075257657360688
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dmdHA2rIqVloWI7+EegleGOexv94g+Z9sCfdOcwbikA2VkwekmNqO7QEzemm4EM:cmDF/LcreGNh2hYUkXu3bSZ1U4o
|
| Size: |
2590
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120603v8.xml
|
XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120603v8.xml
|
| Category: |
dropped
|
| Dump: |
rule120603v8.xml.3.dr
|
| ID: |
dr_653
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
|
| Entropy: |
5.104787639829218
|
| Encrypted: |
false
|
| Ssdeep: |
24:JdJdHjIqUlsGjPvy3iFcKaXbPICtKuQqo1ZKTvCkqy8qGHwxF0soh/N0aeZ44L:3JrMsGjPvy3IMLt4MTIaGj4L
|
| Size: |
2128
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120603v9.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120603v9.xml
|
| Category: |
dropped
|
| Dump: |
rule120603v9.xml.3.dr
|
| ID: |
dr_997
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.090316412928055
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dkvdHjIqUlsGjPvy3iFcKaXbPICtKuQqo1ZKTvCkqy8qGHwxF0soh/N0aeZ48De:cSrMsGjPvy3IMLt4MTIaGj8De
|
| Size: |
2230
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120604v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120604v1.xml
|
| Category: |
dropped
|
| Dump: |
rule120604v1.xml.3.dr
|
| ID: |
dr_999
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.591118413981684
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdyqxuOeF/iuSspS7PNWEVxf/0//8hmMNOjsu:2dQFrSTP5P2
|
| Size: |
424
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120605v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120605v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120605v0.xml.3.dr
|
| ID: |
dr_1001
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.651543954286572
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdwoPlbPwYHyj3vAQ4mlwyuOeF/i3iceuXlOaNeQfH/M//05eNX/c//bfpONyZ:2dLdbIqSlYFIDsgR7
|
| Size: |
876
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120607v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120607v1.xml
|
| Category: |
dropped
|
| Dump: |
rule120607v1.xml.3.dr
|
| ID: |
dr_1002
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.878690652619822
|
| Encrypted: |
false
|
| Ssdeep: |
3:vFWWMNHU8LdgCcsp780670B6f7TDsdKuNFeiehYH1gkkrPgKbo5K55xbSJNaKqBz:TMVBd7/n8fQerhsCrPPb/On2sby
|
| Size: |
203
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120608v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120608v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120608v0.xml.3.dr
|
| ID: |
dr_1013
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.9073233641894265
|
| Encrypted: |
false
|
| Ssdeep: |
24:2do8OUuFjFejNFqdxCS6/SIBoxJQRxtamqNMw+Fq6cemM+SOP0x+7:c9u8ACBuUtajwq6dmM+L7
|
| Size: |
2159
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120609v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120609v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120609v0.xml.3.dr
|
| ID: |
dr_1014
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.6572794887278315
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7ubi0xe4nC/p4SPeEdsV7C/5YHM9ndtq+/B49NOn2sby:TMHdKbi0x9SpFDspS5ndrBkNO2su
|
| Size: |
407
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120610v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120610v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120610v0.xml.3.dr
|
| ID: |
dr_1015
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.205975317519947
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdUbi06T/qNOm/hFsNX/c//bLMpONyuRiNOjsu:2dmKyeiWqN
|
| Size: |
473
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120611v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120611v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120611v0.xml.3.dr
|
| ID: |
dr_1016
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.674386030617272
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd76UlNbi0vSPMA4UM+xfq/HJSPeEdsV7C/5YHM9ndtq+/vJ9NOn2sby:TMHdjLbi06Ogf64DspS5ndrvNO2su
|
| Size: |
414
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120612v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120612v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120612v0.xml.3.dr
|
| ID: |
dr_1017
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.1951580617514095
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdGNbi05/T/qNOm/hFsNX/c//bLMpONyuoNOjsu:2dw5yeiWu
|
| Size: |
470
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120613v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120613v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120613v0.xml.3.dr
|
| ID: |
dr_1018
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.603788936312325
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdhbi05/QN4WGQ+ThE4DspS7PNWJYf/0//W1YhmMdrvNO2su:2dba8Q4hHTPCQ9ux
|
| Size: |
631
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120614v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120614v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120614v0.xml.3.dr
|
| ID: |
dr_1019
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.193004288778686
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd/Ybi0LT/qNOm/hFsNX/c//bLMpONyuLNOjsu:2d/CnyeiWX
|
| Size: |
466
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120615v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120615v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120615v0.xml.3.dr
|
| ID: |
dr_1020
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.632533717029051
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd76QpZbi0YW/Q/HJSPeEdsV7C/5YHM9ndtq+/vJ9NOn2sby:TMHdnLbi0LQ4DspS5ndrvNO2su
|
| Size: |
406
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120616v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120616v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120616v0.xml.3.dr
|
| ID: |
dr_1021
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.281880348798365
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdCbi09/T/qNOm/hFsNX/c//bLMpONyuCK0NOjsu:2dE9ryeiWu
|
| Size: |
485
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120646v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120646v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120646v0.xml.3.dr
|
| ID: |
dr_333
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.242917853424237
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdjbi00fT/qNOm/hFsNX/c//bLMpONyupNOjsu:2d1ayeiWB
|
| Size: |
474
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120647v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120647v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120647v0.xml.3.dr
|
| ID: |
dr_335
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.822977286433141
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7Mrbi00uSEUq+G+7N5o+F0/HJSPeEdsV7C/5YHM9ndtq+/vJ9NOn2sby:TMHd4bi00fG+NgoU4DspS5ndrvNO2su
|
| Size: |
447
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120648v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120648v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120648v0.xml.3.dr
|
| ID: |
dr_338
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.336439364850335
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdhbi04T/qNOm/hFsNX/c//bLMpONyugLLKNOjsu:2dbUyeiWxl
|
| Size: |
490
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120649v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120649v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120649v0.xml.3.dr
|
| ID: |
dr_341
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.708166014987959
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7eJY4bi0SfmAN/pqH/HJSPeEdsV7C/5YHM9ndtq+/vJ9NOn2sby:TMHdCrbi04mAN/pU4DspS5ndrvNO2su
|
| Size: |
415
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120650v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120650v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120650v0.xml.3.dr
|
| ID: |
dr_344
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.271258224632099
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdvYbi0YfT/qNOm/hFsNX/c//bLMpONyuvNOjsu:2dKYLyeiWr
|
| Size: |
478
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120651v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120651v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120651v0.xml.3.dr
|
| ID: |
dr_347
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.692996362198924
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7+ULbi0Yfpbf4p/HJSPeEdsV7C/5YHM9ndtq+/vJ9NOn2sby:TMHd3Lbi0YfC4DspS5ndrvNO2su
|
| Size: |
414
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120652v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120652v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120652v0.xml.3.dr
|
| ID: |
dr_349
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.2089329821017705
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSbi0l/T/qNOm/hFsNX/c//bLMpONyublKNOjsu:2dUlryeiWYl
|
| Size: |
470
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120653v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120653v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120653v0.xml.3.dr
|
| ID: |
dr_351
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.707441332702557
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7+WlzZbi0cU/txde+iH/HJSPeEdsV7C/5YHM9ndtq+/vJ9NOn2sby:TMHdjZbi0l/tx0+if4DspS5ndrvNO2su
|
| Size: |
418
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120654v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120654v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120654v0.xml.3.dr
|
| ID: |
dr_353
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.2639253454828845
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdcNbi0/T/qNOm/hFsNX/c//bLMpONyuNNOjsu:2d2ryeiW5
|
| Size: |
476
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120655v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120655v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120655v0.xml.3.dr
|
| ID: |
dr_359
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.719055574263021
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7+QLbi0cWlNA09RrC/HJSPeEdsV7C/5YHM9ndtq+/vJ9NOn2sby:TMHdzLbi0/AA04DspS5ndrvNO2su
|
| Size: |
418
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120656v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120656v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120656v0.xml.3.dr
|
| ID: |
dr_362
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.247714040651271
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdWbi0h/T/qNOm/hFsNX/c//bLMpONyu8NOjsu:2dAByeiWW
|
| Size: |
476
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120657v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120657v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120657v0.xml.3.dr
|
| ID: |
dr_365
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.717740715102454
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7+SLbi0cQ/cwXfn7C/HJSPeEdsV7C/5YHM9ndtq+/vJ9NOn2sby:TMHdxbi0h/cwvu4DspS5ndrvNO2su
|
| Size: |
418
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120658v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120658v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120658v0.xml.3.dr
|
| ID: |
dr_368
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.228778217940084
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdIbi0zT/qNOm/hFsNX/c//bLMpONyuPY1NOjsu:2dyPyeiWZ8
|
| Size: |
471
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120659v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120659v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120659v0.xml.3.dr
|
| ID: |
dr_373
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8714291926289155
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7+clzZbi0cS/ZhM+x4OTSivmO4aMp/HJSPeEdsV7C/5YHM9ndtq+/vJ9NOQ:TMHd/Lbi0zMYRL/Bg4DspS5ndrvNO2su
|
| Size: |
467
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120660v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120660v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120660v0.xml.3.dr
|
| ID: |
dr_375
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.296339986640134
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdC4bi0t/T/qNOm/hFsNX/c//bLMpONyuYCimKNOjsu:2dCitryeiWTCiml
|
| Size: |
484
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120661v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120661v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120661v0.xml.3.dr
|
| ID: |
dr_377
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.646408713691851
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7f4bi0cclNZFI/HJSPeEdsV7C/5YHM9ndtq+/vJ9NOn2sby:TMHdr4bi0t/E4DspS5ndrvNO2su
|
| Size: |
410
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120662v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120662v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120662v0.xml.3.dr
|
| ID: |
dr_379
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.194064506144483
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdiYbi0sT/qNOm/hFsNX/c//bLMpONyu1NOjsu:2d7YyeiW3
|
| Size: |
469
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120663v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120663v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120663v0.xml.3.dr
|
| ID: |
dr_380
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.7392703636081
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7Sbi0snIRIo+NF2+zF4WA/HJSPeEdsV7C/5YHM9ndtq+/vJ9NOn2sby:TMHdmbi0s2gFZPA4DspS5ndrvNO2su
|
| Size: |
426
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120664v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120664v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120664v0.xml.3.dr
|
| ID: |
dr_383
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.344663057090138
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdrbi0rST/qNOm/hFsNX/c//bLMpONyucU2NOjsu:2dtOyeiWUx
|
| Size: |
501
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120665v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120665v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120665v0.xml.3.dr
|
| ID: |
dr_385
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.6411784830495595
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7CZbi0rSna/Z/HJSPeEdsV7C/5YHM9ndtq+/vJ9NOn2sby:TMHdgbi0rSa/B4DspS5ndrvNO2su
|
| Size: |
406
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120666v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120666v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120666v0.xml.3.dr
|
| ID: |
dr_387
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.217923487613823
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd04bi0gT/qNOm/hFsNX/c//bLMpONyuaNOjsu:2d0i8yeiWS
|
| Size: |
473
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120667v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120667v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120667v0.xml.3.dr
|
| ID: |
dr_389
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.675144216115545
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7h4bi0g7W/HJSPeEdsV7C/5YHM9ndtq+/vJ9NOn2sby:TMHdF4bi0gC4DspS5ndrvNO2su
|
| Size: |
407
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120668v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120668v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120668v0.xml.3.dr
|
| ID: |
dr_391
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.2031880617577935
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdHbi0yT/qNOm/hFsNX/c//bLMpONyu7NOjsu:2dxiyeiWv
|
| Size: |
468
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120669v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120669v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120669v0.xml.3.dr
|
| ID: |
dr_393
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.6857727650984105
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7Ibi0yEANZT+/HJSPeEdsV7C/5YHM9ndtq+/vJ9NOn2sby:TMHdMbi0yEANZ64DspS5ndrvNO2su
|
| Size: |
415
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120670v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120670v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120670v0.xml.3.dr
|
| ID: |
dr_396
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.207510286120392
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdguYbi0NST/qNOm/hFsNX/c//bLMpONyuYTY1NOjsu:2dguCwyeiWT
|
| Size: |
471
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120671v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120671v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120671v0.xml.3.dr
|
| ID: |
dr_398
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.753551727724934
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd78UlNbi0NSfS+VR/qp/HJSPeEdsV7C/5YHM9ndtq+/vJ9NOn2sby:TMHdgaNbi0NSfNr/e4DspS5ndrvNO2su
|
| Size: |
431
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120672v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120672v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120672v0.xml.3.dr
|
| ID: |
dr_399
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.23626016395163
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdg7bi0eaNT/qNOm/hFsNX/c//bLMpONyuu+eVNOjsu:2dg9eQyeiWg
|
| Size: |
474
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120673v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120673v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120673v0.xml.3.dr
|
| ID: |
dr_402
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.745665849136667
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd78WLbi0eUlN/7WU33bNC/HJSPeEdsV7C/5YHM9ndtq+/vJ9NOn2sby:TMHdgWLbi0eaNt3pS4DspS5ndrvNO2su
|
| Size: |
426
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120674v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120674v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120674v0.xml.3.dr
|
| ID: |
dr_404
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.248875269975603
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdgRbi0eW/T/qNOm/hFsNX/c//bLMpONyuENOjsu:2dgLeWryeiWE
|
| Size: |
473
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120675v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120675v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120675v0.xml.3.dr
|
| ID: |
dr_406
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.732537564749622
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd78QpZbi0eW/K+fDOp/HJSPeEdsV7C/5YHM9ndtq+/vJ9NOn2sby:TMHdg2bi0eW/lrq4DspS5ndrvNO2su
|
| Size: |
418
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120676v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120676v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120676v0.xml.3.dr
|
| ID: |
dr_408
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.227442357041803
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdgfbi0e4T/qNOm/hFsNX/c//bLMpONyuhNOjsu:2dg5eUyeiWT
|
| Size: |
471
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120677v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120677v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120677v0.xml.3.dr
|
| ID: |
dr_410
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.661785998382742
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd78SlNbi0eQ/qo4UMpF/HJSPeEdsV7C/5YHM9ndtq+/vJ9NOn2sby:TMHdgSlNbi0e4qlj4DspS5ndrvNO2su
|
| Size: |
404
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120678v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120678v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120678v0.xml.3.dr
|
| ID: |
dr_412
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.197534104082195
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdg1bi0eSlNT/qNOm/hFsNX/c//bLMpONyusNOjsu:2dgXe8tyeiW4
|
| Size: |
467
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120679v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120679v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120679v0.xml.3.dr
|
| ID: |
dr_414
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.672551969702864
|
| Encrypted: |
false
|
| Ssdeep: |
3:vFWWMNHU8LdgCcsp8cS0BHyvsdKuNFLe0H+SlAo5K55xbSJNaKqBsby:TMVBd78cLbi0eSlUOn2sby
|
| Size: |
173
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120680v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120680v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120680v0.xml.3.dr
|
| ID: |
dr_416
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.4239352185415433
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdlOyVfiB+tNY//OEvoYX/c///pONd+kX4OEvoYX/c///pONGD7PNWLPNm1u28:2drtcgpiP4PY2X+BLkLXAX+Ii7F
|
| Size: |
1951
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120681v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120681v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120681v0.xml.3.dr
|
| ID: |
dr_418
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.7910096944673426
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd6Oi0zizONlOaNe2/YFcNH/M//rLM5eNX/c//aNe2/xFcNH/M//rLM5eNpONd:2dv/VPyzTOyn4
|
| Size: |
957
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120682v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule120682v0.xml
|
| Category: |
dropped
|
| Dump: |
rule120682v0.xml.3.dr
|
| ID: |
dr_419
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.749671363510405
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdDO+QMfiufAVSu7PNW6Bf/0//OXNhmMNO52su:2dbQ0POPfdxD
|
| Size: |
500
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule130009v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule130009v0.xml
|
| Category: |
dropped
|
| Dump: |
rule130009v0.xml.3.dr
|
| ID: |
dr_422
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.2674047932916945
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7S/ck/XrhGQXulJDZSa94BDhbYlAS8lLerhB4On2sby:TMHdm/BI2qSawSCLerT4O2su
|
| Size: |
296
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule130010v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule130010v0.xml
|
| Category: |
dropped
|
| Dump: |
rule130010v0.xml.3.dr
|
| ID: |
dr_424
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.954621155916417
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdm80nXFCjSawSCLerKXFJiQj9DFNXJjXFbEtMqcXHaSMNO5AHNUlu:2dmDXGlwArCv5RV+9c07
|
| Size: |
674
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140000v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140000v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140000v0.xml.3.dr
|
| ID: |
dr_426
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.28814420957801
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7CGkz9Q1+slte/GbOSIxSpRMFpAQUHperh7nPodXIg2NOn2sby:TMHdtrO/GbaAQierZIXIfNO2su
|
| Size: |
403
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140003v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140003v3.xml
|
| Category: |
dropped
|
| Dump: |
rule140003v3.xml.3.dr
|
| ID: |
dr_428
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.777293404555712
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dIbcrfrvPnZeAZvBQZ0UlkYNMOMML6bvJ5:cdzZvWSlYTdLCj
|
| Size: |
2018
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140010v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140010v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140010v0.xml.3.dr
|
| ID: |
dr_430
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.285917442502543
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7Yvkz9Q1ONeqCHHte/GbOSIdHperhydsVlrcXdF/+yYs9NOn2sby:TMHd8tcRCHg/GbSer6sQXdN+ENO2su
|
| Size: |
411
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140011v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140011v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140011v0.xml.3.dr
|
| ID: |
dr_432
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.8018281542445833
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdHQsW5U/GbaAQier5OerrO+tNjOzeRH/ueMk/3/8//UJuNH/M//RH/ueMko3g:2dg5vir5hrrNtdv61t1vL1MrnPq7Tl7s
|
| Size: |
1808
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140012v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140012v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140012v0.xml.3.dr
|
| ID: |
dr_434
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.1490876291245
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdgQmLn/GbSerm/QP4+e/Y+yd3wM9QMfdydbNrdl4ZOYZyNO2su:2djFrmC4+eQ+i3fGbDlKpi
|
| Size: |
708
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140104v6.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140104v6.xml
|
| Category: |
dropped
|
| Dump: |
rule140104v6.xml.3.dr
|
| ID: |
dr_436
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.8585403228797364
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d5r5uaQMx0tdNgjmYd1wOo2YqRbYajqF19Km5KNqfkcLuS:c5duaBx0tgnVve79XsE8caS
|
| Size: |
3643
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140105v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140105v4.xml
|
| Category: |
dropped
|
| Dump: |
rule140105v4.xml.3.dr
|
| ID: |
dr_440
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.661918439385953
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdogrj0r/GbaAQ4Wni0DScWQjEBzDysOLpf46OkPW/f22ByMOPnt5FNxuZWyp9:2dooDynOPWi1f2q9+rSxcNgNY+TNC+
|
| Size: |
2047
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140106v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140106v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140106v1.xml.3.dr
|
| ID: |
dr_445
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.177743933901629
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdaqvrcGf/GbaAQierCYbKOerTASNah63XhNeINOcsu:2dXmirCVrTfbhB
|
| Size: |
540
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140107v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140107v3.xml
|
| Category: |
dropped
|
| Dump: |
rule140107v3.xml.3.dr
|
| ID: |
dr_447
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.9011088407184245
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdb4rn/GbaAQ4WnergD2hwSSZ7rIM9IS25fCYu8M4xEqGNdGtbUf6VhwsGTO94:2dbzRrp0OpwI8o1r+rQahNhzE7VkiAr
|
| Size: |
1904
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140108v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140108v2.xml
|
| Category: |
dropped
|
| Dump: |
rule140108v2.xml.3.dr
|
| ID: |
dr_449
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.976237681727216
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdVkrw/GbaAQ4WnerIYHwxSWIVZa7QPASiM96GMREEfoOs4xwXSUbdvAmEUiOt:2dQRrdqIqjRUewagoX1t7NyL
|
| Size: |
1273
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140109v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140109v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140109v1.xml.3.dr
|
| ID: |
dr_451
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.299345286860191
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdEPrQox+g/GbaAQ4WnerPX2S/rmNO2su:2dEnx+RrPXJC
|
| Size: |
440
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140112v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140112v2.xml
|
| Category: |
dropped
|
| Dump: |
rule140112v2.xml.3.dr
|
| ID: |
dr_453
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.004038191933016
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd7rXXXuv/GbaAQ4WnGherVXer+YHCeri4qfivXIfsDC/MzXcF6/MzXQ9oUFNm:2dX7jMrVOrH1risjygXG
|
| Size: |
935
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140113v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140113v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140113v1.xml.3.dr
|
| ID: |
dr_454
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.127330522111042
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdMRUrbZxv/GbaAQ4Wnerx3j0CUxyFMZjReUxfMM91uDfjfuUxK4xXPydIAzSx:2dMRAx2Rrp0/wWx90zRVYzhA
|
| Size: |
997
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140114v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140114v2.xml
|
| Category: |
dropped
|
| Dump: |
rule140114v2.xml.3.dr
|
| ID: |
dr_455
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.243161723233018
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdzAErk12QcMxv/GbaAQ4Wnerbv8WDLfJDL1ZzrHyQ9oUFNO2su:2dzAP2Mx2RrbvVhvRL
|
| Size: |
684
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140115v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140115v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140115v0.xml.3.dr
|
| ID: |
dr_456
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.777443347474166
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdWr6r/GbaAQii0DScWQjEBi+wsvXqNO5FX/c//rEpON+PvXDS/fzwwYSRn+w4:2d6xnOJwOaE3AEcDSl
|
| Size: |
1000
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140116v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140116v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140116v1.xml.3.dr
|
| ID: |
dr_457
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.949807346371998
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdLzcrc0/1+/GbaAQiervferkfermeryferMLvjE8nN/qHaSMg/mHhSMpz/E/c:2dHV6nirurNr5ryWrEvVMejL1XTkq
|
| Size: |
1203
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140117v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140117v2.xml
|
| Category: |
dropped
|
| Dump: |
rule140117v2.xml.3.dr
|
| ID: |
dr_458
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.299462862937642
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dHNirPr6r+rGmwOfff/TZXJWULuV1+jD4iAWh1PJgr:cHkjWiSmtrlJLuV1IM4gr
|
| Size: |
1931
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140119v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140119v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140119v1.xml.3.dr
|
| ID: |
dr_459
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.978098488313763
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdXrvj1+/GbaAQierLBOferIB6erpBVermNtajELvnb1jmHaSMW1jE/SHhSMpv:2dzLir1OWr8NrvArBghy5TPFt
|
| Size: |
1034
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140120v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140120v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140120v0.xml.3.dr
|
| ID: |
dr_460
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.003925199667457
|
| Encrypted: |
false
|
| Ssdeep: |
48:cTcFEpIwh3hB+EcNP/tSHjzbUnnK7HDI1Ur+:EpZf2a6
|
| Size: |
2653
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140121v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140121v2.xml
|
| Category: |
dropped
|
| Dump: |
rule140121v2.xml.3.dr
|
| ID: |
dr_461
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.132790536497373
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdh7y4gI9/GbaAQjersnxo7PNWOf/0//MyhmMNO2su:2ddy4gD3rbPJY
|
| Size: |
578
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140122v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140122v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140122v1.xml.3.dr
|
| ID: |
dr_462
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.9855463392163655
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdCJcrUf+/GbaAQier5NerZer/ereajELvn/5HaSMk7/SHhSMpJUHISMKeHfSI:2dCJnirSrEr2rLg/ncIGFt
|
| Size: |
1024
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140123v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140123v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140123v0.xml.3.dr
|
| ID: |
dr_463
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.968420990343637
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dHRrH6rEvrldrrqerTFrRDIJE4/5JvPgVVJ:cx2oTrfdx850J
|
| Size: |
1217
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140124v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140124v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140124v1.xml.3.dr
|
| ID: |
dr_464
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.134623892075426
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd3rLv/GbaAQier8UtXOmynutnt4fEdwMnF92gO8ynHDg+3vqNxYNO2su:2dOir8UtX/k8d12BZqk
|
| Size: |
853
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140125v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140125v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140125v0.xml.3.dr
|
| ID: |
dr_465
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.289882463660771
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdLrFDl+/GbaAQier/uRBfnqdOcuyNO2su:2d53ir/v
|
| Size: |
554
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140126v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140126v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140126v1.xml.3.dr
|
| ID: |
dr_466
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.092598990133606
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdOAvrMFtBg/GbaAQieroLO+yXCWZTMWrX0TMpJlXSTMTnfhN1x06X1aNO2su:2ddyt5irh+ySWZLEUlCS1e6s
|
| Size: |
828
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140127v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140127v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140127v1.xml.3.dr
|
| ID: |
dr_467
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.093481470033898
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdYrFtBg/GbaAQierbMMf/xno1X1xntXLnVOUPynHDayXTxnAL6MgnfhNO2su:2ds5irgMHK5/PAhDGWB
|
| Size: |
989
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140128v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140128v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140128v0.xml.3.dr
|
| ID: |
dr_468
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.18696905694695
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd2rTS/GbSerEHeEXveTMpXxMp9jeEXUcjeTMn9vj4WNUTvj3NO2su:2d8Fr+eEfem6jeEEcje2PKHd
|
| Size: |
733
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140129v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140129v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140129v0.xml.3.dr
|
| ID: |
dr_469
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.187467731194211
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdPrx9g/GbaAQier3XFJjEQyuPf8XHaSMNO5AHNUlu:2d/irnvLY07
|
| Size: |
578
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140130v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140130v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140130v0.xml.3.dr
|
| ID: |
dr_470
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.878593802257296
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHddrWg/GbaAQier2erASerhuLZH5GwYZH56+ZHrOHHf6XZHgHMfHHgHwxn9/bH:2d4rirJrYrhGf4VkHM4HwftvF
|
| Size: |
1198
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140131v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140131v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140131v0.xml.3.dr
|
| ID: |
dr_471
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.2688169763676305
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdULrqZE/GbaAQier5upjNyMnoOIavMnt4UVLNO2su:2dJZfirXlG6
|
| Size: |
640
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140132v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140132v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140132v0.xml.3.dr
|
| ID: |
dr_472
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.802490852423277
|
| Encrypted: |
false
|
| Ssdeep: |
48:cmVlbmqNtA9szrLWKdZ4+ugoZ64rYpGTVsgDNX63:H7poZqA63
|
| Size: |
2691
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140133v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140133v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140133v0.xml.3.dr
|
| ID: |
dr_473
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.169823506179181
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdgtriLn/GbaAQierisfI6fQxyI6fntjtNIuZNO2su:2duiris5Qq
|
| Size: |
573
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140134v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140134v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140134v1.xml.3.dr
|
| ID: |
dr_474
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.080875759809467
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSvrcG2/GbaAQierHdbKOerEwSNahWf3XtdCNWO+f/0//7GqhmMNOcsu:2dExirH6rEP1y2s
|
| Size: |
680
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140135v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140135v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140135v1.xml.3.dr
|
| ID: |
dr_475
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.345223252979194
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdQ2rt/GbaAQXerHTukc8iNETc8qNO2su:2dQdjrHTTXDq
|
| Size: |
488
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140136v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140136v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140136v0.xml.3.dr
|
| ID: |
dr_476
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.981160837242438
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdHr+P/GbaAQierwercuSSNah09+KmOf+Eyxnt9qtNCuNnneBzQzCNWOyf/0/Q:2dyWirXr31COhybme7aZ
|
| Size: |
914
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140139v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140139v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140139v0.xml.3.dr
|
| ID: |
dr_477
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.096934451963977
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdcltrgaA/GbSer8dnXKGXE6SpHXTyNXVxNO2su:2diWIFrunHU6Yc1
|
| Size: |
634
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140140v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140140v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140140v0.xml.3.dr
|
| ID: |
dr_478
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.033439418133993
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdgrhS/GbaAQierAerINter/NXahI8ek6XUMQ9nfgNOBsu:2dcirnrlrw6G
|
| Size: |
749
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140141v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140141v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140141v0.xml.3.dr
|
| ID: |
dr_479
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.911782077732711
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dhFrQAu65BUdbA8A46dxo1/2XGNFL3/NMASYswHVNOX:cL0Au6WM8A46dxVGbLPHSPX
|
| Size: |
1844
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140142v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140142v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140142v0.xml.3.dr
|
| ID: |
dr_480
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.175818179217634
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdDar/MRRY/GbaAQierNerGer1ONXahIWVM0XJOI/IsMn+M0XJQxScMnt9M0X8:2dDnRDirYrZrtOIl5E9MaKsN
|
| Size: |
839
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140147v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140147v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140147v1.xml.3.dr
|
| ID: |
dr_481
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.191634893578794
|
| Encrypted: |
false
|
| Ssdeep: |
96:zQ3uutbz3dM1HdhfJqmt5Fr5Vh+/tBSYf:znuAo1f
|
| Size: |
4104
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140148v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140148v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140148v0.xml.3.dr
|
| ID: |
dr_482
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.636294505575934
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdYr9L1/GbaAQ4Wner8+u/qNO1oxfX/c//wVrMpONd+tNqNOocX/c//wVrMpOy:2dfRrzuy1jqt4KjqT9jGgAgdbF7
|
| Size: |
1380
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140149v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140149v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140149v0.xml.3.dr
|
| ID: |
dr_729
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.4592023361460935
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdBrMEzS/GbaAQierTnfXFJjEQi+kXqNOguA7X/c//bLMpONd+wsvXlOguA7XO:2d9irTvvLJTliAwOdTahyVcGNGX9J7
|
| Size: |
1501
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140150v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140150v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140150v1.xml.3.dr
|
| ID: |
dr_732
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.189797337599085
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdEvr/d/GbaAQ4Wnerbo4HfqqfxppfMXxwy6XV3nUNS/7mxxf+/AVK30FaNO2z:2dpRrE1Sp0X7Wqq0M
|
| Size: |
833
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140151v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140151v3.xml
|
| Category: |
dropped
|
| Dump: |
rule140151v3.xml.3.dr
|
| ID: |
dr_735
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.282414686908371
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd84rB/GbaAQier8BL+//LlMdLw/9JfNO2su:2d8Dirm+blw0/bV
|
| Size: |
539
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140152v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140152v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140152v1.xml.3.dr
|
| ID: |
dr_738
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.41199643458718
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd734kz9Q1+sH3Bg4Yte/GbOSIxSpRMFpAQUHperhC8TroeOn2sby:TMHdD4rXD/GbaAQierVf/O2su
|
| Size: |
366
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140153v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140153v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140153v1.xml.3.dr
|
| ID: |
dr_741
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.219217760934546
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdARUrcUkU/GbaAQierpH9lrfOPfydt/9JfntgXslNO2su:2digQir5ruKt/bSy
|
| Size: |
632
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140155v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140155v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140155v1.xml.3.dr
|
| ID: |
dr_744
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.264436781611096
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdXciQBVk//GboWnerlHSsPAQ/r/M+0ivmNO2su:2ds5BOGmrdSmAQj/c
|
| Size: |
521
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140156v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140156v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140156v0.xml.3.dr
|
| ID: |
dr_747
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.044313988565724
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdtrl/GboWnersXFJiQjL/juhNXDE/shNXp0WXHaSMNOA/HNUlu:2dOmr4v5fLsdEG8Wy7
|
| Size: |
791
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140158v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140158v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140158v0.xml.3.dr
|
| ID: |
dr_749
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.314502750835963
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7dvkz9Q1+sUQnQgDTqte/GbOSIxSpRMFpAQUHperhbAJwLKBsfE39NOn2su:TMHdptrUyv/GbaAQier9BfEtNO2su
|
| Size: |
417
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140159v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140159v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140159v1.xml.3.dr
|
| ID: |
dr_751
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.032661361955447
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdrrU8II0/GbaAQ4WneriSerifSNahW6+/CNWOyf/0//YShmMKH1StAntf7nLZ:2dLRryriq5qaPXX
|
| Size: |
846
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140172v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140172v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140172v0.xml.3.dr
|
| ID: |
dr_752
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.272339482404428
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdPr+Lc/GbaAQierCznWgry+sGyFN5NO2su:2dQ3irmP4FV
|
| Size: |
523
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140173v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140173v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140173v0.xml.3.dr
|
| ID: |
dr_759
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.0595656786277035
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd2rR1Ys9S/GbaAQ4Wner6fer8erI/BjEano+HaSMjmqXHhSMpDXHISMNO3XGo:2dq6s9NRrLrjrIJFoFmqko
|
| Size: |
901
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140174v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140174v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140174v0.xml.3.dr
|
| ID: |
dr_762
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.285572522102252
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd1rcQpgu/GbaAQXeriHszn8fAGpgMaBuf6cBJNO2su:2dGQQjriH48lpg1uycB/
|
| Size: |
571
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140176v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140176v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140176v0.xml.3.dr
|
| ID: |
dr_765
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.910689079143839
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdBxcfG/GbSerZerIOSNahWgCNWOyf/0//qehmMNOcsu:2dBafBFrEripaM
|
| Size: |
586
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140177v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140177v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140177v1.xml.3.dr
|
| ID: |
dr_768
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.4244336604179884
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d3mr5uAQQ9RQSLQtSQldTLQdRQILQ6yJYrZm1VKTKnAd:c2duAQYjd2nAp7yJFVw7
|
| Size: |
3424
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140178v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140178v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140178v0.xml.3.dr
|
| ID: |
dr_771
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.128233984713664
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdRrc92Wmo//GbHer8qzuHRyoXMWHRyHaaeXM9ady9uHRcbMWHRcsadVpMSaMM:2dRI92oG+rUcCcgF58w+xExM
|
| Size: |
852
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140180v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140180v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140180v0.xml.3.dr
|
| ID: |
dr_774
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.198716261807297
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd16rm4jm/GbSerqWIFI9G1xOxxkNO2su:2dWFraxExM
|
| Size: |
507
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140181v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140181v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140181v0.xml.3.dr
|
| ID: |
dr_777
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.106123546265731
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdk6rJg/GbSerPgBL+//LlMnG3DntLrnFTQnHDaCqNYCSNO2su:2dkSrFrPq+bl3uVoC
|
| Size: |
752
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140200v12.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140200v12.xml
|
| Category: |
dropped
|
| Dump: |
rule140200v12.xml.3.dr
|
| ID: |
dr_779
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.836208373168191
|
| Encrypted: |
false
|
| Ssdeep: |
48:c2T+Mzqp3Jp1Tys5vf1TyD8F1TZi2sW4+hwpHCCx8hsb4kywydlunHaHNHtG:6jBFJWEkrf+a1zxV4kXMlunHatHtG
|
| Size: |
4672
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140202v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140202v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140202v0.xml.3.dr
|
| ID: |
dr_781
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.566207672414695
|
| Encrypted: |
false
|
| Ssdeep: |
48:cFtjbuyBtt4IX+CQEJPX8vdsCKjqIKB+2epDtCm:uVbuutbOC3ds1HH+Nym
|
| Size: |
2821
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140203v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140203v2.xml
|
| Category: |
dropped
|
| Dump: |
rule140203v2.xml.3.dr
|
| ID: |
dr_782
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.9501327758640326
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dxGmr6rQr5rVrXrELuyu1bJUG1Sx4+95Jmz+EfpNn3my0K:cxpeUlJbwu3bqGUDmz7RVZ
|
| Size: |
2185
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140204v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140204v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140204v0.xml.3.dr
|
| ID: |
dr_785
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.196477647638832
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdnrNIfv/GbSerKVHCZUiHCqMnIB3IyvB4MNO2su:2djFrOnKhX4k
|
| Size: |
514
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140228v6.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140228v6.xml
|
| Category: |
dropped
|
| Dump: |
rule140228v6.xml.3.dr
|
| ID: |
dr_787
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.293393566897461
|
| Encrypted: |
false
|
| Ssdeep: |
48:chZLFkt4epvQcpuGuVPvVq7b8L/BXhCFrIiXDGYxrdHq9oeIpmYpb:THSGg0bcpxC99zZrxq9oeIpmqb
|
| Size: |
3713
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140230v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140230v3.xml
|
| Category: |
dropped
|
| Dump: |
rule140230v3.xml.3.dr
|
| ID: |
dr_789
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.28484202668851
|
| Encrypted: |
false
|
| Ssdeep: |
48:c+Gkt4epvQcpuGuVPvVq7b8L/BXhCFrIiXDGYxrdHq9ZeCpScb:bHSGg0bcpxC99zZrxq9ZeCpScb
|
| Size: |
3607
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140231v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140231v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140231v0.xml.3.dr
|
| ID: |
dr_791
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.036558389004573
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdTrtQCM/GbaAQierioUFqU5OpYxuFnvuXnN1D1oWNHP3gxhhHk2uBl7PffNOQ:2dHnirCIwbcSN1ujYJ
|
| Size: |
1239
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140232v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140232v2.xml
|
| Category: |
dropped
|
| Dump: |
rule140232v2.xml.3.dr
|
| ID: |
dr_793
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.982618281035085
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdecKg/GbHerD8rGUF9tDGhp9Ov8c45oICbvioCkN1xG/v/eHCbvMRRkrPrDbW:2dvy+r+353Z1ujkRw3bUHyK4nrZId
|
| Size: |
1600
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140233v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140233v2.xml
|
| Category: |
dropped
|
| Dump: |
rule140233v2.xml.3.dr
|
| ID: |
dr_795
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.930376611453916
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d8fi+r953zw8ND1MYL0o3QcscoYTnZeb2cNMh6b1U:ceHJ53vNJMJidsjwnZeb2cSa1U
|
| Size: |
1974
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140242v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140242v2.xml
|
| Category: |
dropped
|
| Dump: |
rule140242v2.xml.3.dr
|
| ID: |
dr_797
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.246439366164944
|
| Encrypted: |
false
|
| Ssdeep: |
48:c1Mkt4epvQcpuGuVPvVq7b8L/BXhCFrIiXDGYxrdHI91ek4kX:iHSGg0bcpxC99zZrxI91ek4kX
|
| Size: |
3240
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140243v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140243v3.xml
|
| Category: |
dropped
|
| Dump: |
rule140243v3.xml.3.dr
|
| ID: |
dr_799
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.71259475911388
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d6P9Y9NYrXuyKgFt4KbrGwOacJfrUPhZZaDr+:c39mzuyht4caQcpUZZaDr+
|
| Size: |
1394
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140244v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140244v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140244v1.xml.3.dr
|
| ID: |
dr_801
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.3157223941675715
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHducbjxp/GbaAQzWnerwOzq7SVHyaiuCyp9zsf2YlfQxNO2su:2df3x4Yr74usOYlI3
|
| Size: |
652
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140245v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140245v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140245v1.xml.3.dr
|
| ID: |
dr_802
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.285508226864837
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdvcbjx5HFS/GbaAQzWnereFDz287SVHya28uCyp92lsf2YlfQxNO2su:2dE3xZFNYr3zLsOYlI3
|
| Size: |
655
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140246v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140246v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140246v1.xml.3.dr
|
| ID: |
dr_805
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.275566365775326
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdQcfnxp/GbaAQzWnerYzq7SVHyaYoSYyNO2su:2dVfnx4Yr0BPi
|
| Size: |
534
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140247v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140247v2.xml
|
| Category: |
dropped
|
| Dump: |
rule140247v2.xml.3.dr
|
| ID: |
dr_807
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.254694770968369
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdGVcfnx5HFS/GbaAQzWnerZDz287SVHyaYoSYyNO2su:2dbfnxZFNYrZQBPi
|
| Size: |
535
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140248v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140248v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140248v0.xml.3.dr
|
| ID: |
dr_809
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.684847748827976
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dscYrNrIt4eJfrbwOacJyx9I65hkY+lyUpQ660F7:cU5kt4epvQcC915hkJ0L50F7
|
| Size: |
1658
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140251v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140251v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140251v0.xml.3.dr
|
| ID: |
dr_811
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.346250070198749
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdZLberF/+u/xH/Os6IA7YNX/c//tpONGDGIA7YMNOjsu:2dZOrFGuVr72J
|
| Size: |
444
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140252v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140252v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140252v0.xml.3.dr
|
| ID: |
dr_813
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.840539938667753
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdGcbAVzv/GbSi0D/erEer2+kXqNOWNX/c//gBpONG+AVFnXBytVFnXHhSMNOR:2dXbqaGD2rLrlTTJF8qJYJO7
|
| Size: |
779
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140254v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140254v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140254v1.xml.3.dr
|
| ID: |
dr_815
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.320886199638668
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdi4cC7dv/GbaAQ4WnerwykWu/Eo0NO2su:2di9TRrwyVL
|
| Size: |
451
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140255v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140255v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140255v0.xml.3.dr
|
| ID: |
dr_817
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.326994704705937
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHddLr+BaSi/GbSerFHsQPkXQBxNO2su:2dsaSdFrFhMo
|
| Size: |
424
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140259v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140259v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140259v0.xml.3.dr
|
| ID: |
dr_819
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.54858487637551
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dRLTN+rVrilNWriVwU7P4PHcm6cpd0LKexuP4PQxnzxkOxR1uWjPXOsPqOdpg:c5ToxoYuV3EXWZe19fuWbwMpg
|
| Size: |
1900
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140460v5.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140460v5.xml
|
| Category: |
dropped
|
| Dump: |
rule140460v5.xml.3.dr
|
| ID: |
dr_821
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.967517664272118
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dDuJtrwCkOWNx3eAI8A1Pw5vOy5jvEQHWJNe+Y0P2LNAqyUqGGBerCltB8I0bI4:ceTHWN9SEeJCU2LuCFVClt1fZ9k
|
| Size: |
3030
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140461v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140461v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140461v0.xml.3.dr
|
| ID: |
dr_822
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.870980703158486
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdP6cfXwm1/GbSerSOerterpferBajELvnEwdXHaSMxwPWaXHhSMpOwyKnXHIA:2dPj10Frgr4r8rcgLmaYKnCbFU
|
| Size: |
982
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140479v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140479v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140479v1.xml.3.dr
|
| ID: |
dr_825
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.999012752783924
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdfzcc5m5/Gb2erANcL7QjEBzD+eXsM9dTsGXMxjuGXNO5AdHNUlu:2dfz5sIJrWOZzej7
|
| Size: |
902
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140480v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140480v2.xml
|
| Category: |
dropped
|
| Dump: |
rule140480v2.xml.3.dr
|
| ID: |
dr_827
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.917802340431483
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdp1c5mx/GbjWnerdcL7QjEBzD+eXsM9dTsGXMxjuGXRkzHaSM4xWOXAWNYVKs:2dpWsgtrrOZzeyNQ37
|
| Size: |
1115
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140481v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140481v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140481v1.xml.3.dr
|
| ID: |
dr_830
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.0029286235310435
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdaxUc57/Gb2ergcL7QjEBzD+eXsM9dTsGXMxjuGXNO5AdHNUlu:2deEJrkOZzej7
|
| Size: |
906
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140482v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140482v2.xml
|
| Category: |
dropped
|
| Dump: |
rule140482v2.xml.3.dr
|
| ID: |
dr_833
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.961246295439378
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5c5MH8/GbjWnervcL7QjEBzD+eXsM9dTsGXMxjuGXRz337HaSMNO5AdHNUlu:2dCO3trZOZzeBG7
|
| Size: |
1005
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140483v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140483v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140483v0.xml.3.dr
|
| ID: |
dr_836
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.171913036821227
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd2c5yS/Gb2erPSsM9dOq6ntoGUqhGYNO2su:2dnANJrazf0f
|
| Size: |
611
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140484v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140484v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140484v0.xml.3.dr
|
| ID: |
dr_839
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.173053121823797
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdtLc5a/Gb2erOAsM9ddLw99dy9ZMjNO2su:2dGDJrOAzp0Z7J
|
| Size: |
612
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140485v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140485v0.xml
|
| Category: |
dropped
|
| Dump: |
rule140485v0.xml.3.dr
|
| ID: |
dr_842
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.264387267241579
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdmJxc5h3fv/GbSerqsS8NQrdLR3pbOXWNO2su:2dmJaaFrqtJDQm
|
| Size: |
524
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140496v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule140496v1.xml
|
| Category: |
dropped
|
| Dump: |
rule140496v1.xml.3.dr
|
| ID: |
dr_845
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.373780524995946
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7Dkz9Q3zENzAZte/GbOSIxSpRMFpAQ/CCHperheHneOn2sby:TMHdV3zYn/GbaAQjer+neO2su
|
| Size: |
336
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule142305v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule142305v2.xml
|
| Category: |
dropped
|
| Dump: |
rule142305v2.xml.3.dr
|
| ID: |
dr_848
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.057773214766845
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdfr2LqIVHg/GbaAQierxerHtSNah6s1S7PNWcQf/0//XFhmMNOcsu:2dwnVLircr0He6PoO
|
| Size: |
662
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule142314v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule142314v2.xml
|
| Category: |
dropped
|
| Dump: |
rule142314v2.xml.3.dr
|
| ID: |
dr_850
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.997027031007727
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdkEr2Lqv8v/GbaAQ4Wner4NerHLSNah6s1S7PNW1f/0//ThmM8ZqNEEdy9Egh:2dk/+RrBrOHe6PiBfIcARAfLWo
|
| Size: |
966
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule142321v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule142321v0.xml
|
| Category: |
dropped
|
| Dump: |
rule142321v0.xml.3.dr
|
| ID: |
dr_855
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.187220234148482
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHduUr2LqX//GbaAQ4WnermdOerHZSNahlg/OadL1SZnNOcsu:2dwbRrYroTWKxof
|
| Size: |
645
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule142322v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule142322v0.xml
|
| Category: |
dropped
|
| Dump: |
rule142322v0.xml.3.dr
|
| ID: |
dr_857
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.173978463456477
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdubr2LqmvYBj/GbaAQ4WnermBerHySNahlg/OadL1SBBvNOcsu:2dTdYBKRr7r1TWKx0BX
|
| Size: |
667
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule142323v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule142323v0.xml
|
| Category: |
dropped
|
| Dump: |
rule142323v0.xml.3.dr
|
| ID: |
dr_860
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.0548705366424675
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHduSr2LqBv/GbaAQierm/erHGSNah6s1S7PNWDf/0//bhmMNOcsu:2d6lirtrxHe6PSm
|
| Size: |
665
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150007v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150007v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150007v1.xml.3.dr
|
| ID: |
dr_863
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.034952855946616
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSG/A/GbaAQ4WnerPtANRAEZiI8K1IynM9fEiIYfcJDNa4xlvXd3wu25pU2Tw:2dnRrPF6AErVD/VgJDTvArki
|
| Size: |
1193
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150010v9.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150010v9.xml
|
| Category: |
dropped
|
| Dump: |
rule150010v9.xml.3.dr
|
| ID: |
dr_866
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.856264284981315
|
| Encrypted: |
false
|
| Ssdeep: |
48:cIRkI/P+V9rxtQ6zlAclDFuhIF637Ef/I:7sVVv9Puhi637EXI
|
| Size: |
3098
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150013v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150013v2.xml
|
| Category: |
dropped
|
| Dump: |
rule150013v2.xml.3.dr
|
| ID: |
dr_869
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.0820368786318415
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd6MQA2A2/GbSerF/ercjszVWXTbaaCK1Xabap9G2XSaTohN1xLX4an6isFNOP:2dzQyxFrF2rcjoWDgK1qyC15D
|
| Size: |
997
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150101v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150101v4.xml
|
| Category: |
dropped
|
| Dump: |
rule150101v4.xml.3.dr
|
| ID: |
dr_872
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.199248360362553
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dfvr8rWGt4/aKT/akT7nr7n/B+DFwVs5+v:cfvoyGt4lTHT7r7ZXv
|
| Size: |
1461
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150102v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150102v3.xml
|
| Category: |
dropped
|
| Dump: |
rule150102v3.xml.3.dr
|
| ID: |
dr_875
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.785298009557103
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d37yTOJwObbN6UeAdTUO7mUd1G2Uq5ebMduz84iqqm1Y11Xf5h+A:c8OJBo2bRzdf5R
|
| Size: |
4405
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150114v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150114v0.xml
|
| Category: |
dropped
|
| Dump: |
rule150114v0.xml.3.dr
|
| ID: |
dr_878
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.013794068972846
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdVJacsB/GboWnerPVOSYVHydilfMxdy9QMj1/JMNO2su:2dHD1mrPVOS6iilkr1Q1Bk
|
| Size: |
612
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150117v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150117v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150117v1.xml.3.dr
|
| ID: |
dr_880
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.959023296232263
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dtHmRrPGrn9x97JPk6i1lkrZJMDoJJ1nYl:c1mjGb97RAlkVvhnW
|
| Size: |
1056
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150118v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150118v2.xml
|
| Category: |
dropped
|
| Dump: |
rule150118v2.xml.3.dr
|
| ID: |
dr_893
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.85377009469081
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdV6Vyg/GbaAQ4WnerPPer9+tNqNOpX/c//4ypON+HNcfVfj05iekynUCpyntQ:2d0yrRrPGrst4UrQq9PEpl10Yj
|
| Size: |
1134
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150119v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150119v2.xml
|
| Category: |
dropped
|
| Dump: |
rule150119v2.xml.3.dr
|
| ID: |
dr_894
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.853292143588998
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dSYRrPGrst4UXL4q9GQ2Ep8Xp35WnHYj:c1jGIt4qL4Mq35WHw
|
| Size: |
1271
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150124v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150124v0.xml
|
| Category: |
dropped
|
| Dump: |
rule150124v0.xml.3.dr
|
| ID: |
dr_896
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.27880446992319
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7AULkz9Q1eNEqMqte/GbOSIdHperh0JrCxsf0NOn2sby:TMHdV5M+v/GbSerW/0NO2su
|
| Size: |
385
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150131v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150131v2.xml
|
| Category: |
dropped
|
| Dump: |
rule150131v2.xml.3.dr
|
| ID: |
dr_898
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8695817954270995
|
| Encrypted: |
false
|
| Ssdeep: |
48:cFo9SIjYaJ0UeLg6+7Ag/FSUJCC0GzU+mopiiw5:0+jYaJ0U6gfAg/5JCC0Gz3mopZw5
|
| Size: |
3346
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150132v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150132v3.xml
|
| Category: |
dropped
|
| Dump: |
rule150132v3.xml.3.dr
|
| ID: |
dr_900
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.909943063843178
|
| Encrypted: |
false
|
| Ssdeep: |
48:c09RVWfPF6V7gLGQutTkEgotUdfiCAbVal5gMTu1X+6AXr:RWFAgLGQ8Xg4UdfiCAbVazgMEOt
|
| Size: |
3841
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150133v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150133v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150133v1.xml.3.dr
|
| ID: |
dr_902
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.2516595897799556
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dxTrXttVgfE+ThWXOgfE+ThWCwOaR2DpQhWOThWpOfKXIsPgp7sPHXOcPQR1cP4:cxTLttVfih6Ofih5QRYQhDh/G6N
|
| Size: |
3624
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150134v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150134v0.xml
|
| Category: |
dropped
|
| Dump: |
rule150134v0.xml.3.dr
|
| ID: |
dr_904
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.527355595087324
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d1y2mrXttVgf/ThWXTDKwOeu2sa/s229CL219T2d6gdW2Rfn1rIClIUDBt5kw:c8ZLttVsh6TeZaED1xGtrNlIUDBt5kw
|
| Size: |
4489
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150135v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150135v0.xml
|
| Category: |
dropped
|
| Dump: |
rule150135v0.xml.3.dr
|
| ID: |
dr_906
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.569115881633309
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dCV2mrXttVgf/ThWXTDPpwOeu2sa/s229CL219T2d6gdW2RfniCly4Cw:cgZLttVsh6TbpZaED1xG7ly4Cw
|
| Size: |
4521
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150136v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150136v0.xml
|
| Category: |
dropped
|
| Dump: |
rule150136v0.xml.3.dr
|
| ID: |
dr_908
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.5687041537074995
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dsui2mrXttVgf/ThWXTDDEpwOeu2sa/s229CL219T2d6gdW2RfnvzuClsyR/3RR:csBZLttVsh6TnEpZaED1xGblBhUw
|
| Size: |
4529
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150137v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150137v0.xml
|
| Category: |
dropped
|
| Dump: |
rule150137v0.xml.3.dr
|
| ID: |
dr_910
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.5427960508460714
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dsaF0H2mrXttVgf/ThWXTDjwOeu2d6/dW2WCy2B9v2yge21fja0q0NmJ0t0ii01:cT6HZLttVsh6TnNWg9sLnQmCif4Lw
|
| Size: |
4509
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150138v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150138v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150138v1.xml.3.dr
|
| ID: |
dr_923
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.615153153569248
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d6Px2VYrkmtV9f/TLXO9f/TLCwOf9fhTLXc9fhTLzcj9fE+TLM6hrxX2XK:cQxFImtV1rO1etLrcLsjmiYcH
|
| Size: |
3529
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150140v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150140v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150140v1.xml.3.dr
|
| ID: |
dr_924
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.0403932598502035
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdVycFD91/GbSerKoha0wuXwFap97XDna40HdN1xrXPae0DXRrODoX3HaHs04d:2dxF90FrRvAYMD1JuDooH8j4SPUo3i
|
| Size: |
1499
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150207v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150207v0.xml
|
| Category: |
dropped
|
| Dump: |
rule150207v0.xml.3.dr
|
| ID: |
dr_926
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.954705113594458
|
| Encrypted: |
false
|
| Ssdeep: |
24:2digmraPnd9b1LmFePc8oRD/NZAzBUdQPyNACrv2xhNbO9SNc9:cGe9RsyvOD/H3eymCKhU9S29
|
| Size: |
3422
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150208v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150208v0.xml
|
| Category: |
dropped
|
| Dump: |
rule150208v0.xml.3.dr
|
| ID: |
dr_928
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.938258859381422
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dj7traP5l56Cjj1e87/RjScCekNemTQ/N+sAoa8MbEEcfFcKTmSWnYOA:clG6Cjpe8rFSfekNdQ/IspDM+T5ei
|
| Size: |
3023
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150209v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150209v0.xml
|
| Category: |
dropped
|
| Dump: |
rule150209v0.xml.3.dr
|
| ID: |
dr_930
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.927373928216011
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dghtraPndXs61Lmam2zcUo5lNezGdYPmbt5v+FZLb4R9SjC:caeXsOxmktsl/mmxWZg9SW
|
| Size: |
3405
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150210v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150210v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150210v1.xml.3.dr
|
| ID: |
dr_932
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.908251642603629
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dpetraP5l56KjE61eFQ7pTjccCckHemLeN+5oPMDFX+QrbXBpw0:cqG6KjNeFQlncfckHheIuPMRXRb80
|
| Size: |
2797
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150213v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150213v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150213v1.xml.3.dr
|
| ID: |
dr_934
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.961741557764059
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdErUcOPR4e//GbjWnerPqSernerJNXahIJogagyoXKOHaM9GQ/fKoO4N1xTNM:2dErxOPR4rtrPqFrerZwG1PJ136hgg
|
| Size: |
1195
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150214v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150214v0.xml
|
| Category: |
dropped
|
| Dump: |
rule150214v0.xml.3.dr
|
| ID: |
dr_936
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.108562635776414
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdFAa4Dcv/GbaAQzWnerlHSkEfMMyjlHStpKLIVjls+aSbO9N1Dp+YLbOYVNOQ:2dFAHYrdSV6nk1BM1VXLb
|
| Size: |
831
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150217v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150217v0.xml
|
| Category: |
dropped
|
| Dump: |
rule150217v0.xml.3.dr
|
| ID: |
dr_938
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8328136742864825
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdux26A/GbaAQzWnerLnerIVDROW8/ROfzE+a6G/b8OKX/c//fpONkMdOfCxN0:2du46LYrar3Ya6G2Be7
|
| Size: |
873
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150218v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150218v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150218v1.xml.3.dr
|
| ID: |
dr_940
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.226986235423353
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdhWW1vS/GboWnerF3JdMMlKxjLt/wLHNO2su:2dF5NmrFkh4h
|
| Size: |
492
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150219v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150219v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150219v1.xml.3.dr
|
| ID: |
dr_953
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.1488332166447766
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdQl4d//GbaAQXerLnertF26nXHaSMNO/HNUlu:2dQvjryrfnp7
|
| Size: |
492
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150220v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150220v0.xml
|
| Category: |
dropped
|
| Dump: |
rule150220v0.xml.3.dr
|
| ID: |
dr_954
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.050609474350326
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdwJS/GbjWner2erjDxMfX/fiMyjgXESHaSMwc/juc6BjiOXNOjsu:2dGNtrJrS/1jXEFLf6BA
|
| Size: |
729
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150221v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150221v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150221v1.xml.3.dr
|
| ID: |
dr_956
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.041740598960227
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dSWGtrqOB1BjX2G19DjOU5s7n8CBE5vNn5zdq5n:cSWQuOvJ9XP5scFc
|
| Size: |
1398
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150222v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150222v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150222v1.xml.3.dr
|
| ID: |
dr_958
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.082906286436789
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dEXr+tr2B1Bp02sG1rpOU5spn88Bxy1nVWvxmNrS5oxzn5zc35n:cxSvgkFP5sjBgVl5FE
|
| Size: |
1914
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150224v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150224v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150224v1.xml.3.dr
|
| ID: |
dr_960
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.028871737902808
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dbtrqB1BjX2G19DjOU5s7n8OxEdNnVdq5:chWvJ9XP5s1MVY
|
| Size: |
1467
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150225v7.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150225v7.xml
|
| Category: |
dropped
|
| Dump: |
rule150225v7.xml.3.dr
|
| ID: |
dr_962
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.940789708509866
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d4UqYr1/pSpXYgaaNxJ0JQLe5bgjxuPyx5Oxc1QN70Dl2u9VVl:cLVpSp1aYMWI2rGpZylZ9VVl
|
| Size: |
2050
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150227v11.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150227v11.xml
|
| Category: |
dropped
|
| Dump: |
rule150227v11.xml.3.dr
|
| ID: |
dr_964
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.923883496260181
|
| Encrypted: |
false
|
| Ssdeep: |
48:cX4ApSpAvXniujOzbLikeNrGWHek/vjltlq9VV+F:MYIRNrGMlsVVs
|
| Size: |
2748
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150228v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150228v0.xml
|
| Category: |
dropped
|
| Dump: |
rule150228v0.xml.3.dr
|
| ID: |
dr_966
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.458146001921315
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d6urYrHgr+Wrtd08FwrNrxTvU8iAsU8jEd65Kld65KABg0Mcec9eeVLDvhERb8Y:czc0/BSVZtvUesUmEJMekeeVLDvCbAI
|
| Size: |
2158
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150232v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150232v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150232v1.xml.3.dr
|
| ID: |
dr_968
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.056407463460544
|
| Encrypted: |
false
|
| Ssdeep: |
48:cq62cnwOyCuotwrV0eMmWAXrwunuBQAFqd5agt8DzrA1Vb9SOQzT:wLJzLdaMrR
|
| Size: |
3864
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150233v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150233v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150233v1.xml.3.dr
|
| ID: |
dr_970
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.055627476314231
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dwRx0cNtrmPnd51i1khcsFodF7PNM3m1EyFbbLGU6vPDA9SOWBOUD:cyx6XgujFKFD1Eyd2U689SOYT
|
| Size: |
3836
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150234v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150234v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150234v1.xml.3.dr
|
| ID: |
dr_983
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.0365242359372635
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d3KrtrmP5l56zyDJ1eIOQG1puYajCtcC4FtQAajhmN+O6o3Fj6LeScfFcKs5UD:cMC6ebexQGaFYfC2fIIMVjJsK
|
| Size: |
2423
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150235v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150235v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150235v1.xml.3.dr
|
| ID: |
dr_984
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.050759692222842
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dcEcNtrmP5l560t1eaP1rjMcCMMtReDPN+FoN4dwucfFcKs5UD:cWC60Tea9vMfMMverICN4WsK
|
| Size: |
2408
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150236v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150236v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150236v1.xml.3.dr
|
| ID: |
dr_986
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.093509787046252
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d7rtrmP5l5b+61fEdfMOFOczQfwqDQUD:cNCr8on
|
| Size: |
1732
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150237v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150237v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150237v1.xml.3.dr
|
| ID: |
dr_988
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.1120057954624105
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd02McS/GbjWner1D0lVz5/lO69oUFp96eT74VTUN1xvaTee6RTyr3oT+IHsYp:2dicNtrmP5l5w611EonFc5Bs/GhUD
|
| Size: |
1722
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150238v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150238v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150238v1.xml.3.dr
|
| ID: |
dr_990
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.0947499866925465
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdZ4cIg/GbjWner1D0lVz5/lO69oUFp9GmB4G6GN1xGMXKYIeGGYrGooXoIHsa:2dZ9IrtrmP5l5j1JzDHOeQxVUD
|
| Size: |
1309
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150239v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150239v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150239v1.xml.3.dr
|
| ID: |
dr_992
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.098629857396343
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd7cacS/GbjWner1D0lVz5/lO69oUFp9GdTs74Gd9sUN1xGdvXseeGdVsyrGdX:2d4acNtrmP5l5IGR1cvrcqI9FebxVUD
|
| Size: |
1302
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150240v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150240v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150240v1.xml.3.dr
|
| ID: |
dr_994
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.171595363412108
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdjXwg/GbjWner1D0lVz5/lO69oUFp9y5Kc45/5KjN1xu5KhYIey5K1r5/5K/t:2d0rtrmP5l5JkJ1VOvUBOUD
|
| Size: |
1235
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150241v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150241v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150241v1.xml.3.dr
|
| ID: |
dr_996
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.176255074477817
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdtUXycS/GbjWner1D0lVz5/lO69oUFp9645E746b/5EUN1x6o5Eee61e5EyrK:2dlcNtrmP5l5IjJ1cS111fOUD
|
| Size: |
1229
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150242v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150242v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150242v1.xml.3.dr
|
| ID: |
dr_998
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.122064125865966
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdxvMyg/GbjWner1D0lVz5/lO69oUFp9uO8p4uC8uN1xuG8SYIeuX8wrucEU8U:2dxUyrtrmP5l5wzDf018LrSsvJYOUD
|
| Size: |
1216
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150243v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150243v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150243v1.xml.3.dr
|
| ID: |
dr_1000
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.130314113657754
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdnUM3McS/GbjWner1D0lVz5/lO69oUFp9I8E7448EUN1xle8EeeV8EyrlUEUo:2dnh8cNtrmP5l5/1D1fDbthbOUD
|
| Size: |
1210
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150246v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150246v2.xml
|
| Category: |
dropped
|
| Dump: |
rule150246v2.xml.3.dr
|
| ID: |
dr_211
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.134499676463893
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dzUYrH/WAvWAVmRjTAD/GNGDLMrlHh9YsMpMdOsi:cnaHZIOWGBhdiz
|
| Size: |
1501
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150249v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150249v0.xml
|
| Category: |
dropped
|
| Dump: |
rule150249v0.xml.3.dr
|
| ID: |
dr_214
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.903732768966267
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdfcz1/GbHerbxerYAferoer5ivXIfgD3nfW8/ufMoxycndp9POGnyR2ooQNHM:2dUz0+rIrWrPr6V3mBxZ51CPv6
|
| Size: |
1185
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150259v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150259v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150259v1.xml.3.dr
|
| ID: |
dr_218
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.7388495821236
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d6YGYrtu0GvsGitWGTsGBpG5sG1wO8GBsGnjG6sG/QG7sGOomYfJjGXVT1rcCx6:cF5uGtvy/neGfJ+QKJ+7
|
| Size: |
4317
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150262v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule150262v1.xml
|
| Category: |
dropped
|
| Dump: |
rule150262v1.xml.3.dr
|
| ID: |
dr_222
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.145841692479477
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdnvcrLb/cA/GbaAQOWnerJhCNWEyf/0//+kKhmMNO2su:2dErP/cLhra52EE
|
| Size: |
561
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170000v6.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170000v6.xml
|
| Category: |
dropped
|
| Dump: |
rule170000v6.xml.3.dr
|
| ID: |
dr_226
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.066654795394057
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSdjTMFCkoCAvQierBnfXFJiQjFTTXHaSMNO5AHNUlu:2duTMFlHAvcr9v5V07
|
| Size: |
517
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170002v6.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170002v6.xml
|
| Category: |
dropped
|
| Dump: |
rule170002v6.xml.3.dr
|
| ID: |
dr_229
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.560543374557417
|
| Encrypted: |
false
|
| Ssdeep: |
48:ciPgvcMuyltVxCRc3pp4gYfIrAySEFA/o3GPQiZUN1GUT25I8hJ:PPgzu64WIf7ySEA/o3gQGQwU25Ii
|
| Size: |
5980
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170003v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170003v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170003v1.xml.3.dr
|
| ID: |
dr_232
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.988669315276604
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSEGkoCAvQiiHXFJiQjEciRDaXOUdyXHaSMNO35csu:2d75HAvMv5p/IS
|
| Size: |
695
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170005v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170005v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170005v2.xml.3.dr
|
| ID: |
dr_234
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.025811692997561
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSMxk3we7koCAvQqAQierLNerHQiBjFJQXHaSM4cQXHhSMNOAdHNS7lu:2d7kAPHAvfrLYrwo4vDr
|
| Size: |
706
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170007v5.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170007v5.xml
|
| Category: |
dropped
|
| Dump: |
rule170007v5.xml.3.dr
|
| ID: |
dr_236
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.99472127077792
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSiZyui4pkoCAvQierDsysSN1UdLKftkw9CFIl1fnzle+Dl9osxxroqoocfrq:2d7Zyui4iHAvcrDRjz4ORh9JIdnWk9s
|
| Size: |
1081
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170009v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170009v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170009v1.xml.3.dr
|
| ID: |
dr_237
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.101483793033583
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSzsZgJi4pkoCAvQier2riKMAe+DlMyrMfXfxxrdyd+DVfIltNO2su:2d0sZIi4iHAvcrSiK/hSZni+BK
|
| Size: |
739
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170011v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170011v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170011v2.xml.3.dr
|
| ID: |
dr_253
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.826457377074059
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSJggikoCAvQierhferFMYD2EfW8/2EfMOHWIab/b8O2X/c//FpONkMNOjsu:2dODFHAvcr8rFf3rWbau
|
| Size: |
820
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170012v12.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170012v12.xml
|
| Category: |
dropped
|
| Dump: |
rule170012v12.xml.3.dr
|
| ID: |
dr_256
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.880790943619387
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dQsCHAvfr1uyqCZnr7sQCz6lINzKHOEW:ckgvfZuyHnXsQCz6lxW
|
| Size: |
1352
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170013v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170013v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170013v1.xml.3.dr
|
| ID: |
dr_259
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.227853114045981
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7mvEkI2JMBBKMyxqb0c7oCDLChvRCUHperhLnPoURfI6vxxNOn2sby:TMHdSvyuwMkoCAvQierRhfI6ZxNO2su
|
| Size: |
378
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170014v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170014v4.xml
|
| Category: |
dropped
|
| Dump: |
rule170014v4.xml.3.dr
|
| ID: |
dr_262
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.794620389997292
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dmt20OOO5HAv8huXGHsSt4BGHsm+/9RQ0q+kaqwYGqe:cUNKgv8huXIXt4BIk1RtYGb
|
| Size: |
1373
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170016v7.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170016v7.xml
|
| Category: |
dropped
|
| Dump: |
rule170016v7.xml.3.dr
|
| ID: |
dr_266
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.294503887640287
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dMi4iHAvcrgvLJT6DqwONo6JIJAPuaTDquVDDSywoT1x7:cMYgvcMvLJT8qXodJgquVnfx7
|
| Size: |
1777
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170019v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170019v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170019v1.xml.3.dr
|
| ID: |
dr_270
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.951307118216317
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d3koHAv3r/PazmmQ13IdJLzcM7HhzORMOwizjNMbYzzmMTS:cUogv3V3I3
|
| Size: |
1398
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170021v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170021v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170021v0.xml.3.dr
|
| ID: |
dr_273
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.056172629241999
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSWZber3nf+u/qNOTfX/c//PpONd+tNqNOGX/c//uDpONQlVD4NOcsu:2d/UrXmuyQvKt4rTPG
|
| Size: |
601
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170022v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170022v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170022v2.xml.3.dr
|
| ID: |
dr_275
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.6580088883765125
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdS12ukoCAvQrer59XFJ5C/7PNWyNmu/vENP/k//zLMx2Nf/0//jLMhmMNOSjz:2d7RHAv7r5hvYTPP+KL6G
|
| Size: |
755
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170024v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170024v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170024v2.xml.3.dr
|
| ID: |
dr_277
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.865007630199703
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dUPHAvcrEPA2r1u4lRW8x6AVd7ZNeMCnTAjAG81Eqjpw:cUPgvcKZlblcTAjAGmpw
|
| Size: |
1978
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170026v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170026v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170026v0.xml.3.dr
|
| ID: |
dr_278
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.624076210416062
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dWgGi4iHAvcrl2rBMTTP5amwOaBzASJvfS60J:cPGYgvc8uTPPQBXJXCJ
|
| Size: |
1397
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170027v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170027v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170027v0.xml.3.dr
|
| ID: |
dr_291
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.144590977150849
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSCZ7koCAvQierBFVKI2dn+KufydytUdNO2su:2d+HAvcrgaa1T
|
| Size: |
582
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170030v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170030v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170030v1.xml.3.dr
|
| ID: |
dr_293
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.969728038448219
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSKa8rkoCAvQieroereVv8X7PNWYuEf/0//OEhmMNOSjsu:2dmHAvcrPr48PoEPq
|
| Size: |
553
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170032v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170032v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170032v2.xml.3.dr
|
| ID: |
dr_294
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.903636660795986
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdS0rkoCAvQiernerXNQiBjF4LEXHaSM7qOXHhSMNOAdHNS7lu:2doHAvcrerXqoBaDr
|
| Size: |
641
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170033v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170033v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170033v0.xml.3.dr
|
| ID: |
dr_296
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.136853677559959
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7mxkq4Yb0c7oCDLChvRCUHperhDpJrzVlrzwyXPfPSSMNOn2sby:TMHdSrCkoCAvQierpXzHtXHaSMNO2su
|
| Size: |
385
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170034v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170034v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170034v1.xml.3.dr
|
| ID: |
dr_298
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.019036184216836
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSB0tRnIkoCAvQierrgydvFRKcXFJzDaXOUdyXHaSMNO/HNUlu:2d3HAvcrrfLlvm/Ip7
|
| Size: |
697
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170035v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170035v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170035v1.xml.3.dr
|
| ID: |
dr_300
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.856392286032534
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdS/xl6rkoCAvQierIiH+SXFJzDP4ydXtt/AGqdrNedynm/3ROXHaSMNO/HNUw:2dKrHAvcrfvXrttF6r0cmsp7
|
| Size: |
809
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170037v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170037v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170037v1.xml.3.dr
|
| ID: |
dr_303
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.822742548829354
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dt9lHAvcrtr5rxrq2rWNKAnOQ8jH15TDkD:ct9lgvcBdle2iNKAkFkD
|
| Size: |
1169
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170038v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170038v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170038v0.xml.3.dr
|
| ID: |
dr_304
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.0149827785161785
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSFiCkoCAvQier1eruerJVCGONan+i0GnNant9PGoNaNOS5csu:2dCilHAvcrgrBrIc/Wn
|
| Size: |
702
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170039v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170039v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170039v0.xml.3.dr
|
| ID: |
dr_306
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.9230249967709785
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSICkoCAvQij+u/qNO8yX/c//kpONUVrGnNaNOjsu:2dPlHAvAuyBG01
|
| Size: |
600
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170040v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170040v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170040v0.xml.3.dr
|
| ID: |
dr_307
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.168654440867369
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7mR2mkULl8qb0c7oCDLChvRCUHperhztEnPNVlr8L7C/BLlW9NOn2sby:TMHdSRNlCkoCAvQier2V+uVlaNO2su
|
| Size: |
389
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170041v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170041v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170041v2.xml.3.dr
|
| ID: |
dr_310
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.845207902572627
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSpkoCAvQJerQ1sN+u/xH/OlKbX/c//8pONwsAlaOXyKQp9lSCNOjsu:2d/HAv3rQK8uRZua
|
| Size: |
755
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170042v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170042v4.xml
|
| Category: |
dropped
|
| Dump: |
rule170042v4.xml.3.dr
|
| ID: |
dr_312
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.037196898720328
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdS0ttokoCAvQier8NXFJiQj5szgxCfhxSn+zghOhhrIpygxocXHaSMNO5AHN9:2dhtdHAvcrCv5lcNdSurzw07
|
| Size: |
715
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170043v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170043v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170043v1.xml.3.dr
|
| ID: |
dr_314
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.07230516973807
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSIUpkoCAvQJer3glVZ6C7cXHaSMNO2su:2dXRHAv3rwPj7cK
|
| Size: |
473
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170044v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170044v4.xml
|
| Category: |
dropped
|
| Dump: |
rule170044v4.xml.3.dr
|
| ID: |
dr_316
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.066486734278268
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSVqaIkoCAvQier2XFJiQjF0uXHaSMNO5AHNUlu:2dFMHAvcrmv5W7
|
| Size: |
519
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170048v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170048v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170048v0.xml.3.dr
|
| ID: |
dr_318
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.162787367717548
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSZfkoCAvQierHBuV9NkW+n+uL73nt9t8SfCdNO2su:2dqMHAvcrH46W8qq4
|
| Size: |
578
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170050v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170050v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170050v2.xml.3.dr
|
| ID: |
dr_320
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.9871689157577395
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dtvxIHAvcrANSWvHuEj2Kd10gwRedOQpgMSgenvtNc1gdE/Y7uT3w8fE4WUEHWb:cpxIgvc6gAIqUj1lgcbl2GMwLfw
|
| Size: |
2976
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170052v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170052v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170052v2.xml.3.dr
|
| ID: |
dr_322
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.000787995445468
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSnGqkoCAvQJerHhXFJiQjXlVZ6iDXHaSMNO5AHNUlu:2dTHAv3rHtv5rPX07
|
| Size: |
607
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170053v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170053v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170053v1.xml.3.dr
|
| ID: |
dr_323
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.144547003197568
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSfrZ7koCAvQJerE5G+EpbOSZtM4lNO2su:2dgrqHAv3rlL
|
| Size: |
453
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170054v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170054v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170054v1.xml.3.dr
|
| ID: |
dr_325
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.155859118419826
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSsTKpkoCAvQqAQ+erhjG+EpbOt6ZCiuXAedy9z/s+NO2su:2dZKiHAvHrhOyjk0+
|
| Size: |
627
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170056v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170056v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170056v0.xml.3.dr
|
| ID: |
dr_326
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.165545586320683
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSBIVKpkoCAvQierDKvOUddLz/St9dBXeQXMNsAn/3ZMNO2su:2d6IgiHAvcrev///gjc1u
|
| Size: |
653
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170058v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170058v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170058v1.xml.3.dr
|
| ID: |
dr_329
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.057892482651669
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSgVekoCAvQiergOXFJiQjFDlcXHaSMNO5AHNUlu:2dFVhHAvcrfv5Xc07
|
| Size: |
523
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170059v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170059v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170059v1.xml.3.dr
|
| ID: |
dr_331
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.0963759077169914
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdS1za+7koCAvQierWXFJiQjFk6RXHaSMNO5AHNUlu:2do4HAvcrGv5j07
|
| Size: |
525
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170060v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170060v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170060v1.xml.3.dr
|
| ID: |
dr_334
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.241455521463736
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7mLHykZTqb0c7oCDLChvRCtRMFpAQUHperhF7dxkUSwNOn2sby:TMHdSprkoCAvQqAQierfJOUdNO2su
|
| Size: |
391
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170061v5.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170061v5.xml
|
| Category: |
dropped
|
| Dump: |
rule170061v5.xml.3.dr
|
| ID: |
dr_336
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.495890781581802
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdS0NkoCAvQier0XFJiQjE+kXqNOjPNewHYH/M//jrM5eNX/c//QQnpONG/RX3:2d3GHAvcrgv5vTAPuaTDQD7
|
| Size: |
841
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170065v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170065v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170065v0.xml.3.dr
|
| ID: |
dr_339
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.131476606472836
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSeYyYs7koCAvQier5zQyXjXHaSMNO2su:2dIyYs4HAvcr7jK
|
| Size: |
390
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170068v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170068v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170068v0.xml.3.dr
|
| ID: |
dr_342
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.224378013807265
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSro9koCAvQierQzQyN3OXHaSMNO2su:2dwoWHAvcri+K
|
| Size: |
412
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170069v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170069v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170069v1.xml.3.dr
|
| ID: |
dr_345
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.056234104340099
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSHokoCAvQierCXFJiQjFbywXHaSMNO5AHNUlu:2dUvHAvcrav5307
|
| Size: |
523
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170070v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170070v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170070v2.xml.3.dr
|
| ID: |
dr_348
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.088954158136153
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdS5gUlGkpkoCAvQierZzGi0dLzNfI6UVxnt9tIDNO2su:2dogaGkiHAvcrY/N2Va
|
| Size: |
552
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170071v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170071v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170071v2.xml.3.dr
|
| ID: |
dr_350
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.062611791411667
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSrvG2koCAvQier8HszVYaGSTwdy9zNfI6U3nstIDNO2su:2dgvGJHAvcr8HnYN2b
|
| Size: |
669
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170072v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170072v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170072v2.xml.3.dr
|
| ID: |
dr_352
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.210519152134
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7mEpkyeuqb0c7oCDLChvRCUHperhbGHkdsVlrcyRO/SXRI9NOn2sby:TMHdSEXpkoCAvQiergHSsQyA2iNO2su
|
| Size: |
392
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170073v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170073v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170073v2.xml.3.dr
|
| ID: |
dr_356
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.138112127312645
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdShXLg8rkoCAvQierwHFAoszFMdL75fuDnt9tIDNO2su:2d6XmHAvcrWNPBh
|
| Size: |
597
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170074v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170074v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170074v2.xml.3.dr
|
| ID: |
dr_357
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.121041291659901
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSqXLSrkoCAvQiersXzf8dLzNfI6U3nt9tIDNO2su:2dxXvHAvcrsE/N2s
|
| Size: |
589
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170075v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170075v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170075v2.xml.3.dr
|
| ID: |
dr_360
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.028116295023816
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdS7VdkoCAvQierIYA+jPntbKNx1X5S9gN1DyDuMMIfxxT/OdyNO2su:2dKV2HAvcrIG4zT1yhbZJ/2i
|
| Size: |
933
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170076v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170076v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170076v1.xml.3.dr
|
| ID: |
dr_363
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.186798035649007
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7mXlkVVJb0c7oCDLChvRCUHperhdpJrCZXM7yXPfPSSMNOn2sby:TMHdSM4koCAvQiervXQMOXHaSMNO2su
|
| Size: |
385
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170077v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170077v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170077v1.xml.3.dr
|
| ID: |
dr_366
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.237558642548256
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7md4kD1mab0c7oCDLChvRCUHperhpkdsVlrfnst/+sgs9NOn2sby:TMHdSXs7koCAvQierqsznG/+8NO2su
|
| Size: |
389
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170078v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170078v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170078v2.xml.3.dr
|
| ID: |
dr_369
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.20477265199328
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdS2JVm7koCAvQqAQierSN/UzaTbIONO2su:2dFJ9HAvfrSNMUF
|
| Size: |
483
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170080v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170080v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170080v1.xml.3.dr
|
| ID: |
dr_371
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.158593051010716
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7mlSkDoab0c7oCDLChvRCUHperhXbpJrCI2R2NyXPfPSSMNOn2sby:TMHdSl/o7koCAvQierZM2EXHaSMNO2su
|
| Size: |
385
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170081v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170081v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170081v2.xml.3.dr
|
| ID: |
dr_374
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.004801070488056
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSI6Kk3rkoCAvQierAr7PNWY6Nxf/0//Y6PdYhmMNO2su:2dB6/3IHAvcrAPeN2U
|
| Size: |
547
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170082v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170082v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170082v1.xml.3.dr
|
| ID: |
dr_376
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.157378070735827
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7mn2FkSHxYb0c7oCDLChvRCUHperhyHfWNkJrC6HFyXPfPSSMNOn2sby:TMHdSuH7koCAvQierEhGXHaSMNO2su
|
| Size: |
403
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170083v6.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170083v6.xml
|
| Category: |
dropped
|
| Dump: |
rule170083v6.xml.3.dr
|
| ID: |
dr_378
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.941903364756859
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSrRkoCAvQierbGF0tt/UzZ66OIPkM96AXIla4Rlf4jHxp5onvxDoy5uiEGsz:2dQaHAvcr80ttMcJACl0HmNrRRDHO
|
| Size: |
1087
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170086v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170086v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170086v2.xml.3.dr
|
| ID: |
dr_381
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.935067632892513
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSEwokoCAvQierSXFJjEQzDABHf2k+HyLXHaSMntiStNQLNO5AHNUlu:2dXwvHAvcrqvLYBHv+HiFf7
|
| Size: |
837
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170087v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170087v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170087v2.xml.3.dr
|
| ID: |
dr_382
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.008606900129766
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSudkoCAvQierHkAsatNE8aPcqop9LDuM9oOWfrxxOOdkd3zN6NO2su:2dN2HAvcrHvlMofh9mFg2oDg
|
| Size: |
842
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170088v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170088v3.xml
|
| Category: |
dropped
|
| Dump: |
rule170088v3.xml.3.dr
|
| ID: |
dr_384
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.025216526423468
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdStT7LGANkoCAvQqAQ+Qf7iuXFJiQj9DaXOUd+McSxp5XHaSMNO5AHNUlu:2doyAGHAvVi+v5A/G207
|
| Size: |
821
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170089v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170089v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170089v1.xml.3.dr
|
| ID: |
dr_386
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.250708539150798
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7mdFkxQdO4MIHb0c7oCDLChvRCUHperhTdClrCsHVlv//USwNOn2sby:TMHdS5OWIkoCAvQier9dqD1lfUdNO2su
|
| Size: |
381
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170091v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170091v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170091v2.xml.3.dr
|
| ID: |
dr_388
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.9447351696321915
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSV4i1UkoCAvQiertq/EAdsDE6M9tN4AnwI/wnHDOUnn+E4ZnV7TdNhDxH901:2dgHAvcrtqc8J6bbqqi7TJDhCwSl
|
| Size: |
1064
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170095v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170095v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170095v1.xml.3.dr
|
| ID: |
dr_390
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.042936927823301
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdS1UxIkoCAvQiery+iVthjcdLfNady9tSRdVYNEINO2su:2dKqHAvcry+cjg8p+z
|
| Size: |
674
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170096v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170096v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170096v1.xml.3.dr
|
| ID: |
dr_392
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.232298743887801
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7m64kYcAFb0c7oCDLChvRCUHperh8NJrzVlrcS5W9NOn2sby:TMHdSNIkoCAvQierCDz4SgNO2su
|
| Size: |
385
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170097v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170097v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170097v1.xml.3.dr
|
| ID: |
dr_394
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.163018688316438
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSPyUkoCAvQierRz4AEhndLukdoNO2su:2d9HAvcrWjd+
|
| Size: |
459
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170098v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170098v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170098v2.xml.3.dr
|
| ID: |
dr_395
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.220784057366084
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7mr0kA4Yb0c7oCDLChvRCUHperhch+2nqUmvApx7IkUSwNOn2sby:TMHdSr7koCAvQierc/nqvA5UdNO2su
|
| Size: |
427
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170099v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170099v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170099v2.xml.3.dr
|
| ID: |
dr_397
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.9717830381726476
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d30HAvfrBrFreFryVdr5AedezA97oMz3IJ:ckgvf9paFuVdkMLIJ
|
| Size: |
972
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170103v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170103v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170103v1.xml.3.dr
|
| ID: |
dr_400
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.96713371845371
|
| Encrypted: |
false
|
| Ssdeep: |
96:ag5NkwRDjRq9vRh3R2j++sZ+KGGsQ+0JoHJVsDJn+nJ6Ju:aggwRDjRq9vRh3R2C+swlGs/0JEJVsDG
|
| Size: |
3951
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170104v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170104v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170104v1.xml.3.dr
|
| ID: |
dr_401
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.08129738073591
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSYti4koCAvQierDRpSXFJiQjFwcXHaSMNO5AHNUlu:2dztifHAvcrNpqv56c07
|
| Size: |
520
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170105v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170105v3.xml
|
| Category: |
dropped
|
| Dump: |
rule170105v3.xml.3.dr
|
| ID: |
dr_403
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.12679608720651
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSNY3qkoCAvQierrH9HPG1dmKu0ady9AUBNO2su:2dEAHAvcrpeCmH
|
| Size: |
595
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170106v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170106v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170106v2.xml.3.dr
|
| ID: |
dr_405
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.237791233136849
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSiqkNQzkoCAvQiertysSdOUDNO2su:2dxCgHAvcrtyTd/p
|
| Size: |
388
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170107v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170107v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170107v1.xml.3.dr
|
| ID: |
dr_407
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.008918737836408
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSYBrkoCAvQierXPXFJiQjF0OXHaSM+0XGNO5AHNUlu:2dhSHAvcrvv5GOag7
|
| Size: |
601
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170110v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170110v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170110v0.xml.3.dr
|
| ID: |
dr_409
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.047932031129572
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSNciu7koCAvQier5fXFJiQjFHmXHaSMn+uNyant9BoavlInsN6nHxGV7d3S7:2dUci/HAvcrNv5tm5loiKm7
|
| Size: |
1023
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170111v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170111v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170111v2.xml.3.dr
|
| ID: |
dr_411
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.005017077268136
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSNa1koCAvQierhNXFJiQjFwcXHaSMYZSdy96LNO5AHNUlu:2dUlHAvcrrv56ccf7
|
| Size: |
690
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170112v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170112v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170112v1.xml.3.dr
|
| ID: |
dr_413
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.050041213245167
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSNxxkoCAvQierIXFJiQjFwcXHaSMdL6bNO5AHNUlu:2dUkHAvcr8v56caS7
|
| Size: |
609
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170113v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170113v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170113v0.xml.3.dr
|
| ID: |
dr_415
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.1494512612021985
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7mNekh2FJb0c7oCDLChvRCUHperheNlrzVlrE+F/G+Vs9ndtqsVlrT6/Ulz:TMHdSN5bkoCAvQierwzoKEdL6UDNO2su
|
| Size: |
472
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170114v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170114v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170114v1.xml.3.dr
|
| ID: |
dr_417
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.015492524119104
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSNS6koCAvQierdXFJiQjFqRXHaSMaMHfndy9dIb43Mi8nNO5AHNUlu:2dUStHAvcrBv50gdj37
|
| Size: |
822
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170115v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170115v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170115v1.xml.3.dr
|
| ID: |
dr_420
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.117813499836631
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSNzMg4pkoCAvQiDA520OXHaSMdXUddy9McScoNO2su:2dUwniHAvRA5XOaE/4pA
|
| Size: |
593
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170116v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170116v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170116v0.xml.3.dr
|
| ID: |
dr_421
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.232831662269484
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd7mN1Dkd+4MwwYb0c7oCDLChvRCUHperhdCdxVe/EpnyNOn2sby:TMHdSN1p4MkoCAvQierHAq/EANO2su
|
| Size: |
383
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170117v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170117v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170117v0.xml.3.dr
|
| ID: |
dr_423
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.023617146178391
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSN83HpkoCAvQierHlNXFJiQjFwcXHaSMarfI1NO5AHNUlu:2dU8SHAvcrHlxv56cF87
|
| Size: |
608
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170118v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170118v1.xml
|
| Category: |
dropped
|
| Dump: |
rule170118v1.xml.3.dr
|
| ID: |
dr_425
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.0378639054893295
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSNp/HpkoCAvQierBXFJiQjFwcXHaSMarfI1NO5AHNUlu:2dUp6HAvcrNv56cF87
|
| Size: |
615
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170127v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170127v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170127v0.xml.3.dr
|
| ID: |
dr_427
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.041553102711772
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSYeXIkoCAvQierOOXFJnqRXHaSMCf5xNO/HNUlu:2d3wHAvcrOevmfRS7
|
| Size: |
533
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170129v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170129v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170129v0.xml.3.dr
|
| ID: |
dr_429
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.089351679566497
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSaOCkoCAvQqAQier9fXFJnqRXHaSMawEuiENO/HNUlu:2dFOlHAvfr9vvmCEdz7
|
| Size: |
584
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170130v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170130v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170130v0.xml.3.dr
|
| ID: |
dr_431
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.0528345816430535
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSPqepkoCAvQierGXFJnqRXHaSMaG+/fbOg8NO/HNUlu:2d8UHAvcr2vmDTHb7
|
| Size: |
564
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170133v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170133v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170133v0.xml.3.dr
|
| ID: |
dr_433
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.121640629689538
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSpB7koCAvQiermZXFJnV9nXHaSMNO/HNUlu:2dy4HAvcrYvbp7
|
| Size: |
464
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170134v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170134v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170134v0.xml.3.dr
|
| ID: |
dr_435
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.068829243379877
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSqj0koCAvQier8XFJnV9nXHaSMNO/HNUlu:2d77HAvcrIvbp7
|
| Size: |
454
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170135v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170135v4.xml
|
| Category: |
dropped
|
| Dump: |
rule170135v4.xml.3.dr
|
| ID: |
dr_437
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.040958428955208
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSaKWI1okoCAvQierMJXFJn/XHaSMIIupPNQ9PINO/HNUlu:2daWIVHAvcrM1v/tQ7
|
| Size: |
653
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170136v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170136v3.xml
|
| Category: |
dropped
|
| Dump: |
rule170136v3.xml.3.dr
|
| ID: |
dr_438
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.072618292926917
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSJ5KZDkoCAvQieraXFJn/XHaSM+cDmpPNQ9PINO/HNUlu:2dqtHAvcrSv/NAiQ7
|
| Size: |
662
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170137v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170137v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170137v0.xml.3.dr
|
| ID: |
dr_439
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.085893402940255
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdS4ZkoCAvQierrXFJnqRXHaSMnd/9aNO/HNUlu:2daHAvcrjvmsl57
|
| Size: |
559
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170138v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170138v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170138v0.xml.3.dr
|
| ID: |
dr_441
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.114277201077218
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSsTcIkoCAvQierzXFJnqRXHaSMNO/HNUlu:2dnTeHAvcrLvmp7
|
| Size: |
465
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170139v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170139v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170139v0.xml.3.dr
|
| ID: |
dr_442
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.1236575579002785
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSOfIkoCAvQierVXFJnqRXHaSMNO/HNUlu:2djXHAvcr5vmp7
|
| Size: |
467
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170140v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170140v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170140v0.xml.3.dr
|
| ID: |
dr_443
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.114441792324692
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdS6koCAvQiernXFJnqRXHaSMNO/HNUlu:2diHAvcrXvmp7
|
| Size: |
467
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170141v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170141v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170141v0.xml.3.dr
|
| ID: |
dr_444
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.116568979660504
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSSBrkoCAvQierg19purzUpElFrF5NXFJzDaXOUdyXHaSMNO/HNUlu:2dXSHAvcrg19p64kr1vm/Ip7
|
| Size: |
695
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170142v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170142v2.xml
|
| Category: |
dropped
|
| Dump: |
rule170142v2.xml.3.dr
|
| ID: |
dr_446
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.070273196820279
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdS7TbkoCAvQierVXFJTRcSp9yXHaSMNO/HNUlu:2dy8HAvcr5vSKop7
|
| Size: |
537
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170143v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170143v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170143v0.xml.3.dr
|
| ID: |
dr_448
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.077204796891536
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSTLkoCAvQier3XFJnLXHaSMNO/HNUlu:2dTHAvcrnvLp7
|
| Size: |
451
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170144v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule170144v0.xml
|
| Category: |
dropped
|
| Dump: |
rule170144v0.xml.3.dr
|
| ID: |
dr_450
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.057924970005646
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSdm64rkoCAvQierL+MfXFJnLXHaSMdLRUDNO/HNUlu:2dGmrIHAvcrVvvLaqk7
|
| Size: |
547
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule180063v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule180063v1.xml
|
| Category: |
dropped
|
| Dump: |
rule180063v1.xml.3.dr
|
| ID: |
dr_452
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.884913033347324
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdOp7IlFgKbfcHxp8er0+u/qNOhfX/c//rzKpONQlVZd9H/gypV2zZe/DzZydq:2dOyd0Hjr7uyYEmPlYeMeZix+t7tioB
|
| Size: |
1236
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule180064v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule180064v1.xml
|
| Category: |
dropped
|
| Dump: |
rule180064v1.xml.3.dr
|
| ID: |
dr_637
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.898716261022594
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdaS7zlFgKbfcHxp8er0+u/qNOhfX/c//r9pONQlVZd9H/gypV2zZe/DzZydV9:2dDd0Hjr7uyYyPlYeMeZix+Pg
|
| Size: |
1050
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule180178v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule180178v0.xml
|
| Category: |
dropped
|
| Dump: |
rule180178v0.xml.3.dr
|
| ID: |
dr_640
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.92696250027353
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd+FuEFgKbfcHxp8eBSNahozCP+6bdy9kOw7dVVtN6R1p1x76NOcsu:2dw0HAItKB1O
|
| Size: |
917
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule220004v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule220004v0.xml
|
| Category: |
dropped
|
| Dump: |
rule220004v0.xml.3.dr
|
| ID: |
dr_643
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.89119988639781
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdKNMLp6AQierQSerrQjEBiPQOcg5lVZmgHaSMpAXHhSMNOFfAdHNS7lu:2dKNBrQFrEOsPXa2r
|
| Size: |
838
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule220035v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule220035v0.xml
|
| Category: |
dropped
|
| Dump: |
rule220035v0.xml.3.dr
|
| ID: |
dr_646
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.3457963623438385
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBdsvkjKrYRHb3w+YWNkUpmERMFpAQUHperhgcOpiVlr7hie/I6BMNOn2sby:TMHdsxsR8MLp6AQierBPhFIyMNO2su
|
| Size: |
422
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule220036v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule220036v0.xml
|
| Category: |
dropped
|
| Dump: |
rule220036v0.xml.3.dr
|
| ID: |
dr_649
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.358585455462098
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBdBlvkjKrcSE63w+YWNkUpmERMFpAQUHperhRIEiVlr7hie/I6BMNOn2sby:TMHdFoScMLp6AQierLaPhFIyMNO2su
|
| Size: |
418
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule222015v6.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule222015v6.xml
|
| Category: |
dropped
|
| Dump: |
rule222015v6.xml.3.dr
|
| ID: |
dr_651
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.052627368675133
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dd0VeMY8rx3owzQ4oNFo4rOxmoi71c7muogcUDoMdHWzogXcOK:cweF8NYwz8koA3i7a7mvgcU8MdvgXcN
|
| Size: |
1358
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule222042v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule222042v0.xml
|
| Category: |
dropped
|
| Dump: |
rule222042v0.xml.3.dr
|
| ID: |
dr_654
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.225258869256733
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdrcx/tySjtG9JU7PqLKEerCsntSjtg/AGqdLNSjtg/6NO2su:2dr0A+tmMY8rCCt+tgF6p+tgC
|
| Size: |
548
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule222043v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule222043v0.xml
|
| Category: |
dropped
|
| Dump: |
rule222043v0.xml.3.dr
|
| ID: |
dr_656
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.212456246069162
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd7bx/tRV9JU7PqLKEer1s+FnY6dVdKp4wyNO2su:2d1RMY8r13
|
| Size: |
619
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule222049v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule222049v1.xml
|
| Category: |
dropped
|
| Dump: |
rule222049v1.xml.3.dr
|
| ID: |
dr_658
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.197205363382414
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdBJex/tJ49JU7PqLKEerHlykvMfgdhRZPMfyt3RrfMfkn0hMfIm78xNO2su:2dunMMY8rHlyEM07hMIrfMVMdw3
|
| Size: |
805
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule222100v7.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule222100v7.xml
|
| Category: |
dropped
|
| Dump: |
rule222100v7.xml.3.dr
|
| ID: |
dr_659
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.082434400405127
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dk8MY8rjzQzKxr81JV71c7mPcUC+syHF6D:cxF8fzDgr7a7mPcUM
|
| Size: |
1344
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule222101v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule222101v3.xml
|
| Category: |
dropped
|
| Dump: |
rule222101v3.xml.3.dr
|
| ID: |
dr_663
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.0902287582059165
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dSqaDMY8rY3p+dF1GtvD/0jscm7dHwGNMXcR:cwDF8s0pKdwG2XcR
|
| Size: |
1741
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule222102v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule222102v1.xml
|
| Category: |
dropped
|
| Dump: |
rule222102v1.xml.3.dr
|
| ID: |
dr_665
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.099058382662732
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dfoZMY8rHmxEdO1ftAbW/dSsj3adHwGNFXcR:cqF8yxEAmvdwGvXcR
|
| Size: |
1754
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule222200v5.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule222200v5.xml
|
| Category: |
dropped
|
| Dump: |
rule222200v5.xml.3.dr
|
| ID: |
dr_667
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.103797470026722
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dh4eMY8rPSFNoebdrNtxei71c7m2gcU1MdHM:cueF8LOCebdBnei7a7m2gcU1MdM
|
| Size: |
1229
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224008v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224008v0.xml
|
| Category: |
dropped
|
| Dump: |
rule224008v0.xml.3.dr
|
| ID: |
dr_669
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.267547289812924
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd1C2uj4D5Mtlj87ereMfA+LwxNO2su:2dlucVMvj8irBI3
|
| Size: |
414
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224010v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224010v0.xml
|
| Category: |
dropped
|
| Dump: |
rule224010v0.xml.3.dr
|
| ID: |
dr_672
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.254582578930078
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdjMC2/nXW5Mtlj87erklVBR2FMNO2su:2dOP0Mvj8irkPia
|
| Size: |
451
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224011v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224011v0.xml
|
| Category: |
dropped
|
| Dump: |
rule224011v0.xml.3.dr
|
| ID: |
dr_675
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.004221928187262
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdDC2jN4D5Mtlj87erderAfer9w6dke/Nydy0mRakX+e/iX+yp1DXgS+/nSSx6:2drjWVMvj8irorAWr9Bke1ik+eM+k12K
|
| Size: |
999
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224012v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224012v0.xml
|
| Category: |
dropped
|
| Dump: |
rule224012v0.xml.3.dr
|
| ID: |
dr_678
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.239081682219337
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBdNktC2tk45MqaIajECChHperh0cwNjxPVCx3AA+/LylNOn2sby:TMHd2C2N5Mtlj87erQxlV0o6NO2su
|
| Size: |
427
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224013v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224013v0.xml
|
| Category: |
dropped
|
| Dump: |
rule224013v0.xml.3.dr
|
| ID: |
dr_680
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.066086618929864
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5C2Ok5Mtlj87er7er3Nere/er5lVr6jlWKfdjlV9BfLjlEnsfe/4NOScsu:2dhOOMvj8irir3YrRr5POnrYia
|
| Size: |
818
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224059v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224059v0.xml
|
| Category: |
dropped
|
| Dump: |
rule224059v0.xml.3.dr
|
| ID: |
dr_682
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.886380355747692
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dfOyMvj8ir9rDrurPrtrwi5/S79Q1lM7:cmjtRvyzBX5/UclM7
|
| Size: |
1266
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224060v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224060v0.xml
|
| Category: |
dropped
|
| Dump: |
rule224060v0.xml.3.dr
|
| ID: |
dr_685
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.766413313999244
|
| Encrypted: |
false
|
| Ssdeep: |
48:cMOjqF0qoZTCOFH6Elr/lpXdKRyJHt8/w7:KAiBC/w7
|
| Size: |
2244
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224061v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224061v0.xml
|
| Category: |
dropped
|
| Dump: |
rule224061v0.xml.3.dr
|
| ID: |
dr_687
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.3803114020730005
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dtNMvj8trB8rFhrLrkdr9mFrkr3Bl9Zrj9ZvSEg9Soy3c:c8jqV87vgd5uYDBl9p999g9Z0c
|
| Size: |
1512
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224062v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224062v0.xml
|
| Category: |
dropped
|
| Dump: |
rule224062v0.xml.3.dr
|
| ID: |
dr_689
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8742487780544455
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdPNCeuE5Mtlj8HAQierBRerSfOS+tNqNOsX/c//tpON+HNPTff44KGmydkoXt:2deuMvj8trB8rSm5t4jeFT4vGmWkorZ
|
| Size: |
859
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224068v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224068v0.xml
|
| Category: |
dropped
|
| Dump: |
rule224068v0.xml.3.dr
|
| ID: |
dr_691
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.964290580121227
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d22Mvj8irErZrnr/gTjkTogqwy4VuYF3wBzFwIhMKN+UFfYMF7:c29jtYNLbgTeogNutwyjfF7
|
| Size: |
2037
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224072v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224072v0.xml
|
| Category: |
dropped
|
| Dump: |
rule224072v0.xml.3.dr
|
| ID: |
dr_693
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.271508382564369
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdNberPO+u/qNOPX/c//spONwspSZNOjsu:2dQrPNuygNo
|
| Size: |
419
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224073v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224073v1.xml
|
| Category: |
dropped
|
| Dump: |
rule224073v1.xml.3.dr
|
| ID: |
dr_695
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.279287793372496
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd2yberJHferT+tNqNOGmfX/c//+pONU5oVrzNOAHNUlu:2d2TrJ2rit4DmvI97
|
| Size: |
482
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224074v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224074v1.xml
|
| Category: |
dropped
|
| Dump: |
rule224074v1.xml.3.dr
|
| ID: |
dr_697
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.280853950015988
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdgberJHferT+tNqNOGmfX/c//apONU5oVrzNOAHNUlu:2dJrJ2rit4Dmvk97
|
| Size: |
482
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224075v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224075v1.xml
|
| Category: |
dropped
|
| Dump: |
rule224075v1.xml.3.dr
|
| ID: |
dr_699
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.866322685671609
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dsWMvj8xqrW2r9mFrcrvvg9Jcmr79mu/37:csdj7y25uwTvg9Gdu/37
|
| Size: |
1160
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224082v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224082v0.xml
|
| Category: |
dropped
|
| Dump: |
rule224082v0.xml.3.dr
|
| ID: |
dr_701
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.200872545078664
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd/CFKp5Mtlj87ersAXXMSM3O9YPEmyNO2su:2dG2Mvj8irsAXXOLMmi
|
| Size: |
504
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224083v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224083v0.xml
|
| Category: |
dropped
|
| Dump: |
rule224083v0.xml.3.dr
|
| ID: |
dr_702
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.066160040947317
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdcCvr95Mtlj87erDer8erWBjEaSrYS69czvXa/9+UNe+NO5A3XGHNUlu:2drr7Mvj8irqrjrUFSrYlvi7
|
| Size: |
829
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224084v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224084v0.xml
|
| Category: |
dropped
|
| Dump: |
rule224084v0.xml.3.dr
|
| ID: |
dr_705
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.017010499705265
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdpCD5Mtlj87erDerXndYS69ezZdyJHCdh30N1Dglfn9xNO/HNUlu:2dwMvj8irqrNYlkzYyha1clv9S7
|
| Size: |
812
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224085v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224085v0.xml
|
| Category: |
dropped
|
| Dump: |
rule224085v0.xml.3.dr
|
| ID: |
dr_707
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.341998590848822
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dMMvj8trsrerKbigJujQauvjfsjw8lQaGDfUGve6rF16ntF7:cPjaoC+GgJujQvvTsk8lQTD76ntF7
|
| Size: |
2463
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224086v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224086v0.xml
|
| Category: |
dropped
|
| Dump: |
rule224086v0.xml.3.dr
|
| ID: |
dr_709
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.414808067265105
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dAMvj8trsrerKbigJujQaevjOslQa2FUGI1q1tF7:cDjaoC+GgJujQjvislQK1+tF7
|
| Size: |
1921
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224087v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224087v1.xml
|
| Category: |
dropped
|
| Dump: |
rule224087v1.xml.3.dr
|
| ID: |
dr_711
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.403513241689896
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd35Mtlj8HAQ4Wner5erXN+tNlOJeMfH/M//aO5eNX/c//JeaOH/M//x5eNpOk:2dJMvj8OrkrMt4fzrjPTKEMjwtVj7
|
| Size: |
1404
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224900v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224900v0.xml
|
| Category: |
dropped
|
| Dump: |
rule224900v0.xml.3.dr
|
| ID: |
dr_713
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.387335043604801
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdu4berA+u/qNOCER+X/c//RpONaDjERBNOjsu:2dGr/uyiK5I
|
| Size: |
442
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224901v11.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224901v11.xml
|
| Category: |
dropped
|
| Dump: |
rule224901v11.xml.3.dr
|
| ID: |
dr_715
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.823043803033768
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dn28R9MMvj8FvlX4nWrZWra87rRKVopwH2ca1Q1qCwJrJdfZSruGNh3rHK0S:cn2A9PjCMWtWv79KVerc2cqCrfPrLS
|
| Size: |
2283
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224902v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224902v2.xml
|
| Category: |
dropped
|
| Dump: |
rule224902v2.xml.3.dr
|
| ID: |
dr_717
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.885360338479295
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd11bi0eferrNu87rRKfwSK6dXSGyINOSjsu:2d1XeWrro87rRKsqb
|
| Size: |
449
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224903v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224903v0.xml
|
| Category: |
dropped
|
| Dump: |
rule224903v0.xml.3.dr
|
| ID: |
dr_719
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.8608030462994796
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dsTuJlB/98Klx0k9cqlhRpTKlR1ZR+mjlR1ZhPcpsJpDYpZ11uMTX0oG:cYuJD1fzx9/jXmTcaT6Mf
|
| Size: |
3212
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224906v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224906v1.xml
|
| Category: |
dropped
|
| Dump: |
rule224906v1.xml.3.dr
|
| ID: |
dr_721
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.983842431164816
|
| Encrypted: |
false
|
| Ssdeep: |
48:csT3jnuJDh7z25joT8Tht/Diz9z6s0js0E0JIJUDO:pTTnu9h/IAshNKp65NRaGDO
|
| Size: |
4566
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224910v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule224910v1.xml
|
| Category: |
dropped
|
| Dump: |
rule224910v1.xml.3.dr
|
| ID: |
dr_722
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.277290268081167
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBdwMkB45MqaIajECCORMFpAQ/yWnerhUNlrzVlrqyiMH/XyiwxNOn2sby:TMHdX5Mtlj8HAQqWnerOzUMfbwxNO2su
|
| Size: |
442
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule226000v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule226000v0.xml
|
| Category: |
dropped
|
| Dump: |
rule226000v0.xml.3.dr
|
| ID: |
dr_725
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.870041544620127
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd94NgZQQUWCgerTcDQiBjEPQ3D0VSmiXl1lVZmwcSj9tpb/rtdVGw/d+xGC7T:2d2fQ1irloKqPiEJbB+co
|
| Size: |
1123
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule226003v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule226003v1.xml
|
| Category: |
dropped
|
| Dump: |
rule226003v1.xml.3.dr
|
| ID: |
dr_727
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.147263789391309
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBdNvEk2c4n0zJDxS9QUQHLuzOHperhVJrzVlrre/OVyndtqsVlrZ/MPNOn2su:TMHdlp40z7QQUWCger5zmTdLV6NO2su
|
| Size: |
484
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule226009v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule226009v0.xml
|
| Category: |
dropped
|
| Dump: |
rule226009v0.xml.3.dr
|
| ID: |
dr_730
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.033843064015127
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdfy4hQQUWCger9MgZTNoCydy9yDNO2su:2dEQ1irri9
|
| Size: |
525
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule230161v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule230161v0.xml
|
| Category: |
dropped
|
| Dump: |
rule230161v0.xml.3.dr
|
| ID: |
dr_733
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.841183079259023
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdRaK1VNneryYerTAOerw2erx1/ivXahIfs6fBNOXasu:2dRakNery/rTmrwJrxGf
|
| Size: |
577
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule23070v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule23070v1.xml
|
| Category: |
dropped
|
| Dump: |
rule23070v1.xml.3.dr
|
| ID: |
dr_736
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.269047223186581
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBdbV/lkzv4tXIGgkahzmhdFoIzoIPc1RMFpAQUHperhIRnyNjxPVCEULylNOQ:TMHdlm46GhMo/VzPAQier8olVg6NO2su
|
| Size: |
424
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule23120v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule23120v0.xml
|
| Category: |
dropped
|
| Dump: |
rule23120v0.xml.3.dr
|
| ID: |
dr_739
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.806434422690667
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dqzLmo/VmrF2rNt4BzTTkA4ycqjcqAcqi0D0cqa2TqqD6AS/inSdnutiXNQfLOE:cqdNms5t4BvTMyJjJAJz0JRWcN0LtC
|
| Size: |
2309
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule23122v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule23122v0.xml
|
| Category: |
dropped
|
| Dump: |
rule23122v0.xml.3.dr
|
| ID: |
dr_742
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.790203622565363
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d+tzL3Ggo/VmrUrmNt4BzTTkA4ycqjcqAcqi0D0cqa2TqqD6AS1W:cE2HNmwKNt4BvTMyJjJAJz0JRWcQW
|
| Size: |
1904
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule23123v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule23123v0.xml
|
| Category: |
dropped
|
| Dump: |
rule23123v0.xml.3.dr
|
| ID: |
dr_745
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.815157222080249
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dgMko/VmrIWrft4BzTTkA4ycqjcqAcqi0D0cqa2TqqD6AS/5Kpb2:cbNm8WTt4BvTMyJjJAJz0JRWcOb
|
| Size: |
2011
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule23124v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule23124v0.xml
|
| Category: |
dropped
|
| Dump: |
rule23124v0.xml.3.dr
|
| ID: |
dr_748
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.827858462335743
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dyp8o/VmrlWrEt4BzTTkA4ycqjcqAcqi0D0cqa2TqqD6AS/wFqkpb2:cyNNmZWwt4BvTMyJjJAJz0JRWcap
|
| Size: |
2040
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule23125v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule23125v0.xml
|
| Category: |
dropped
|
| Dump: |
rule23125v0.xml.3.dr
|
| ID: |
dr_750
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.786432532959283
|
| Encrypted: |
false
|
| Ssdeep: |
24:2duxo/VmrxrTt4BzTTkA4ycqjcqAcqi0D0cqa2TqqD6AS/Ld:cLNm9Pt4BvTMyJjJAJz0JRWcC
|
| Size: |
1890
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240005v8.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240005v8.xml
|
| Category: |
dropped
|
| Dump: |
rule240005v8.xml.3.dr
|
| ID: |
dr_755
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.96243667727836
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dqFl94dVrzqP3F83dIC0b0+9r+RRv+k+KawS:coWVL3d+AQgvFO
|
| Size: |
1213
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240006v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240006v2.xml
|
| Category: |
dropped
|
| Dump: |
rule240006v2.xml.3.dr
|
| ID: |
dr_757
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.159607339821488
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdLHik2Yl2U4dier1lVh16Z/BZdLINO2su:2dL1l94dVr1Ph43ds
|
| Size: |
474
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240007v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240007v2.xml
|
| Category: |
dropped
|
| Dump: |
rule240007v2.xml.3.dr
|
| ID: |
dr_760
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.819354673822056
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d2yl94dVr1r0rer5rnalv9mKYX1VtFRn4HcgNthXa+vi:c24WVBAK9LY1mKYlTFvCn9i
|
| Size: |
1489
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240008v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240008v1.xml
|
| Category: |
dropped
|
| Dump: |
rule240008v1.xml.3.dr
|
| ID: |
dr_763
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.831014635904131
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdAFEk2Yl2U4dierAfereOerFer9er8erdfCahIffONfSlVZkIu3NOgsu:2dUXl94dVr9rUrwrIrjrdjqPU
|
| Size: |
802
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240009v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240009v3.xml
|
| Category: |
dropped
|
| Dump: |
rule240009v3.xml.3.dr
|
| ID: |
dr_766
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.150720505795691
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdppaak2Yl2U4dierRNMONlVZ6hfIxNO2su:2dpul94dVrRNMONP6Q3
|
| Size: |
500
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240010v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240010v2.xml
|
| Category: |
dropped
|
| Dump: |
rule240010v2.xml.3.dr
|
| ID: |
dr_769
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.13262305364165
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdNMlUZk2Yl2U4dieriIylVZ6dQTPNOATPNyntOR9cs7AlNO2su:2d2lnl94dVrCP0QTTTf9k
|
| Size: |
672
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240012v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240012v1.xml
|
| Category: |
dropped
|
| Dump: |
rule240012v1.xml.3.dr
|
| ID: |
dr_772
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.0595822943463995
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdMyk2Yl2U4dqAQierqqlVZ6neqqOzyntDI2lm5fNTHNO2su:2dMll94dSrqqP0ogt
|
| Size: |
688
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240013v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240013v1.xml
|
| Category: |
dropped
|
| Dump: |
rule240013v1.xml.3.dr
|
| ID: |
dr_775
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.181641897379635
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdOMk2Yl2U4dqAQierXNlVZ6n4ZSfbuxNO2su:2dO/l94dSrdPPSzu3
|
| Size: |
497
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240014v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240014v1.xml
|
| Category: |
dropped
|
| Dump: |
rule240014v1.xml.3.dr
|
| ID: |
dr_778
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.174408507922367
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdM9Drk2Yl2U4dqAQierelVZ6neqqOzyNO2su:2dM9Dkl94dSreP0i
|
| Size: |
500
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240015v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240015v1.xml
|
| Category: |
dropped
|
| Dump: |
rule240015v1.xml.3.dr
|
| ID: |
dr_780
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.2807690978522235
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBdcU2zMkQpmOMgwH4JBPW5d2XI7hn2U4dtRMFpAQUHperh7NjxPVCIJA+/Lyr:TMHdK6Xrk2Yl2U4dqAQierrlVZ6NO2su
|
| Size: |
425
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240016v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240016v0.xml
|
| Category: |
dropped
|
| Dump: |
rule240016v0.xml.3.dr
|
| ID: |
dr_783
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.263687858779708
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdLErk2Yl2U4dqAQierP5lVZ6d1x2XtHMNO2su:2dLfl94dSrP5P0X2m
|
| Size: |
518
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240018v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240018v0.xml
|
| Category: |
dropped
|
| Dump: |
rule240018v0.xml.3.dr
|
| ID: |
dr_784
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.158077005948144
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdG9V+k2Yl2U4dqAQierJ3NlVZ6Z/BZdLIdy9I0b/Ic0+INO2su:2d6Tl94dSrJ9P83dIZ0b0+g
|
| Size: |
637
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240020v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240020v0.xml
|
| Category: |
dropped
|
| Dump: |
rule240020v0.xml.3.dr
|
| ID: |
dr_786
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.117041119471356
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdE4Qk2Yl2U4dqAQierE76JOvkdofwtBsfIiJENO2su:2dEkl94dSrE7gQo
|
| Size: |
607
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240021v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240021v1.xml
|
| Category: |
dropped
|
| Dump: |
rule240021v1.xml.3.dr
|
| ID: |
dr_788
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.168393642237472
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdFvoo9rk2Yl2U4dqAQierNPsQuUIRLIiUwt2XM9tNO2su:2dFwo9kl94dSrNP/IRSKx
|
| Size: |
611
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240025v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240025v1.xml
|
| Category: |
dropped
|
| Dump: |
rule240025v1.xml.3.dr
|
| ID: |
dr_790
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.9621845209574555
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdRalrk2Yl2U4dierlsPB/L8N/IiXnpdl3m9IibfN1Df8NNE35n3YgQ9xJ5NNX:2dTl94dVrwB8Rg7F1IahdSvmb0b
|
| Size: |
1305
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240026v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240026v0.xml
|
| Category: |
dropped
|
| Dump: |
rule240026v0.xml.3.dr
|
| ID: |
dr_792
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.267690316369607
|
| Encrypted: |
false
|
| Ssdeep: |
96:4WaiJqpeUKwhMHPytYPz9qjixvqFXHanb4nd:43iJ3mzRHanb4nd
|
| Size: |
6692
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240029v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240029v0.xml
|
| Category: |
dropped
|
| Dump: |
rule240029v0.xml.3.dr
|
| ID: |
dr_794
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.129653497869513
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd6J0pk2Yl2U4dqAQiersfer1OSNah6O/K0NOcsu:2dEl94dSrsWrfHOi+
|
| Size: |
511
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240030v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240030v0.xml
|
| Category: |
dropped
|
| Dump: |
rule240030v0.xml.3.dr
|
| ID: |
dr_796
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.147125217335964
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdn/5k2Yl2U4dqAQierEkRqqOzynSCXPuGXPlMp13Duz3DSNO2su:2dn/Sl94dSrEteBNu+u
|
| Size: |
612
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240031v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240031v0.xml
|
| Category: |
dropped
|
| Dump: |
rule240031v0.xml.3.dr
|
| ID: |
dr_798
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.209510880922825
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdneJEMPCZk2Yl2U4dqAQieru1RqqOzynSCXPuGXPlMNO2su:2dn9Byl94dSrukeBNk
|
| Size: |
508
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240032v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240032v0.xml
|
| Category: |
dropped
|
| Dump: |
rule240032v0.xml.3.dr
|
| ID: |
dr_800
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.034294155560994
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdnvjJk2Yl2U4dqAQieri/KyneqqOzyntkypFIVyp3vcynHDJCXPuGXPlM23Dz:2dnvjCl94dSriCGWp5p0AOBNH+u
|
| Size: |
857
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240033v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240033v0.xml
|
| Category: |
dropped
|
| Dump: |
rule240033v0.xml.3.dr
|
| ID: |
dr_803
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.986787084387682
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dnglPWtCl94dSr2GWp5pwtKaaBNCF1k+u:cUWSWSLWzxMU+u
|
| Size: |
1032
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240034v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240034v0.xml
|
| Category: |
dropped
|
| Dump: |
rule240034v0.xml.3.dr
|
| ID: |
dr_804
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.240886248173541
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdnSWF0xmak2Yl2U4dierHIHJ9NO2su:2dnm6l94dVrgz
|
| Size: |
394
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240038v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240038v0.xml
|
| Category: |
dropped
|
| Dump: |
rule240038v0.xml.3.dr
|
| ID: |
dr_806
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.075970820784445
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdnyOQk2Yl2U4dqAQierDGJUICYneqqOzyntFI2fjykNAygd+xU/E4NO2su:2dnbrl94dSrcErIT+OcQ
|
| Size: |
754
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240039v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule240039v0.xml
|
| Category: |
dropped
|
| Dump: |
rule240039v0.xml.3.dr
|
| ID: |
dr_808
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.100744436625914
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdn2FKkak2Yl2U4dqAQierDFRqqOzynaI2fp+ykNAygdVmbSEmyNO2su:2dnEl94dSrwDMITYvmi
|
| Size: |
665
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule241000v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule241000v0.xml
|
| Category: |
dropped
|
| Dump: |
rule241000v0.xml.3.dr
|
| ID: |
dr_810
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.330772075499042
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dTuXRFXzRFUmDqRF4zRFnVxRFnkzRFNngqRFlzRFG/f0PcpsJpDYpZ11uMTX0oG:cTuXRpRqm2RaRpRiRrzRjRQMf
|
| Size: |
4112
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule241001v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule241001v0.xml
|
| Category: |
dropped
|
| Dump: |
rule241001v0.xml.3.dr
|
| ID: |
dr_812
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.705321959343666
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dwdwQc11mMl94dk30chKouyPjRF4qLPD3RfT0cV0sOczioc8cg:cwiQI1jWW0qFuybRF4q90w0q59j
|
| Size: |
1972
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule241002v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule241002v0.xml
|
| Category: |
dropped
|
| Dump: |
rule241002v0.xml.3.dr
|
| ID: |
dr_814
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.6738198932573845
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9wQc10l94dk30cYIouyPiKpFYhLPD3RfT0cTqC8vwfu+cjcg:cCQICWW01uyPFYh900qLiWj
|
| Size: |
2042
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule310000v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule310000v1.xml
|
| Category: |
dropped
|
| Dump: |
rule310000v1.xml.3.dr
|
| ID: |
dr_816
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.551500891656751
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dWmbSrGUrZBFJJKvsuKvCvKvg8PXfI8X1+:crSSUFBFJJ7u1vEI8l+
|
| Size: |
1535
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320001v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320001v2.xml
|
| Category: |
dropped
|
| Dump: |
rule320001v2.xml.3.dr
|
| ID: |
dr_818
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.983834335315003
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd51vSnpYoAQ8nerMer+erhSNXahISlVZLacSp9XS/xpMs3f7SVfO9N1xFzbrO:2dHvSrrzrRrpPXnRvD1bzPznCuE
|
| Size: |
1024
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320002v5.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320002v5.xml
|
| Category: |
dropped
|
| Dump: |
rule320002v5.xml.3.dr
|
| ID: |
dr_820
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.915226921571471
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5FvWe6npYunerYferferK/NXahI0zcS+CTpk7t9zldsxOgCkp1x++66IHrnv:2d/vs6rYWrWrKQgqgm1GsChH4vZZWulm
|
| Size: |
1558
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320003v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320003v1.xml
|
| Category: |
dropped
|
| Dump: |
rule320003v1.xml.3.dr
|
| ID: |
dr_823
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.956671743952537
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd52+jnpYunerffer3er7NXahISlVZLacSp9yyfpxs3f7SVfO9NOBsu:2dgU6rururQPJvi
|
| Size: |
810
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320004v6.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320004v6.xml
|
| Category: |
dropped
|
| Dump: |
rule320004v6.xml.3.dr
|
| ID: |
dr_824
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.801127268927651
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dyErB5uM9vtYRE1uX+NDkQiTAoWfloMUw6NIP3:c5DugthuX+5wifRUw6uP3
|
| Size: |
1633
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320005v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320005v3.xml
|
| Category: |
dropped
|
| Dump: |
rule320005v3.xml.3.dr
|
| ID: |
dr_826
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.884444624618638
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5S1HTPnpYoAQBerjferTSerKfNXahISlVZL95YQwTSq7OryaDet8cS69UsBG:2diHTPwrSrTFr5PiTm8lKe++A1
|
| Size: |
1121
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320006v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320006v2.xml
|
| Category: |
dropped
|
| Dump: |
rule320006v2.xml.3.dr
|
| ID: |
dr_828
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.929111956214167
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dirKrrhrYlPqH1IJXvZvlzZv9CTSE+77znkGIGbF:ci8dcaYvZtzZ1CeE+L7IGJ
|
| Size: |
1194
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320007v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320007v2.xml
|
| Category: |
dropped
|
| Dump: |
rule320007v2.xml.3.dr
|
| ID: |
dr_831
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.972548927273034
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5E8InpYoAQierJxNGAkd0QlXXwK+odNvAPxKfOb9sDp1N9LKMhUzPNO2su:2dqZrJxNGnnXs9+Tzrup
|
| Size: |
899
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320009v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320009v1.xml
|
| Category: |
dropped
|
| Dump: |
rule320009v1.xml.3.dr
|
| ID: |
dr_834
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.248473934644969
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5V8s5hnpYoAQ/nerJ/GAkOpfP5xNO2su:2djqrJ/G0p353
|
| Size: |
532
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320016v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320016v0.xml
|
| Category: |
dropped
|
| Dump: |
rule320016v0.xml.3.dr
|
| ID: |
dr_837
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.149485476742115
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5s8anpYoAQ8nerVK7GAkfuwdyTPNO2su:2d8rrg7GvG
|
| Size: |
567
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320021v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320021v0.xml
|
| Category: |
dropped
|
| Dump: |
rule320021v0.xml.3.dr
|
| ID: |
dr_840
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.258568738062466
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5gHn5hnpYoAQ8nerVGAkOpfP5xNO2su:2dCDrrVG0p353
|
| Size: |
526
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320022v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320022v0.xml
|
| Category: |
dropped
|
| Dump: |
rule320022v0.xml.3.dr
|
| ID: |
dr_843
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.304259006004121
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd5umkJL3B/ED3BH3g0gZiRSjwRwRMFpAQ8nerhbMNkdxYJ1OSj4yNOn2sby:TMHd5uPEdnpYoAQ8neryAGAkNO2su
|
| Size: |
426
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320029v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320029v0.xml
|
| Category: |
dropped
|
| Dump: |
rule320029v0.xml.3.dr
|
| ID: |
dr_846
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.090994225069874
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5lIVnpYoAQ8nerwi9dPAstOHO8Hyfa/S+p1Dr7SRO9NO2su:2dUVrrwc412a641f7gOz
|
| Size: |
783
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320032v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320032v0.xml
|
| Category: |
dropped
|
| Dump: |
rule320032v0.xml.3.dr
|
| ID: |
dr_853
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.1809592445794275
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5d8FnpY9s18nerlUf7SE3fO9dLIAkdy9y1AuHnF1uM1SNO2su:2dQFWs13rqL2fcnjfo
|
| Size: |
691
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320033v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320033v0.xml
|
| Category: |
dropped
|
| Dump: |
rule320033v0.xml.3.dr
|
| ID: |
dr_854
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.085567761626465
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5OBnpY9s18nerrSso9dLIAkdy9y1AuH/HO8HynHDtI+NO2su:2dQBWs13rrSncnjfv1AZ
|
| Size: |
778
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320034v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320034v0.xml
|
| Category: |
dropped
|
| Dump: |
rule320034v0.xml.3.dr
|
| ID: |
dr_856
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.876370023266758
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd53bSnpY1nerRer9fSNah03f/HaSMGHhSMNOcsu:2dczr8r9qvf1
|
| Size: |
589
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320035v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule320035v0.xml
|
| Category: |
dropped
|
| Dump: |
rule320035v0.xml.3.dr
|
| ID: |
dr_858
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.782006038078938
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5PFs0npY1ner8NerzOerMer4erSfzahIffO0iHaSMfACWjHhSMpJN7SHISMg:2dnNzr8Yrzhrzrfr8AbN7657M1Z1P0NJ
|
| Size: |
1079
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule322001v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule322001v0.xml
|
| Category: |
dropped
|
| Dump: |
rule322001v0.xml.3.dr
|
| ID: |
dr_861
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.984519219711497
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5AlPnpYxnerbOSermSNah6ued+MTtigDNNOgD5NOcsu:2dKBNrbOFrxHmyQI
|
| Size: |
666
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule322006v5.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule322006v5.xml
|
| Category: |
dropped
|
| Dump: |
rule322006v5.xml.3.dr
|
| ID: |
dr_864
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.90876199662902
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dBv7nDr4kV4Z79m+Un1heA+U+e5w1DYWn:cxnEjUEYWn
|
| Size: |
1358
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324001v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324001v4.xml
|
| Category: |
dropped
|
| Dump: |
rule324001v4.xml.3.dr
|
| ID: |
dr_867
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.28524267291355
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5hLtrnpYoAQ8nerO8AuUdaGodHMNO2su:2dnLtrrrOHfpUE
|
| Size: |
512
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324001v6.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324001v6.xml
|
| Category: |
dropped
|
| Dump: |
rule324001v6.xml.3.dr
|
| ID: |
dr_870
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.287539366754239
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5ftrnpYoAQ8nerzuUdaGodHMNO2su:2ddtrrrzfpUE
|
| Size: |
512
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324002v5.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324002v5.xml
|
| Category: |
dropped
|
| Dump: |
rule324002v5.xml.3.dr
|
| ID: |
dr_873
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.072286939466072
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd55hZOnpYunerOYuUdaGodHMp9SufJSx4moXDsnHDhFIyF3wX2MNO2su:2dhZO6rOYfpUWw9oTeVBA9
|
| Size: |
832
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324003v5.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324003v5.xml
|
| Category: |
dropped
|
| Dump: |
rule324003v5.xml.3.dr
|
| ID: |
dr_876
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.184670233151106
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5u/tetnpYunerOp7uUdaGodHMp9VJYGJ9yVeacX6eabMNO2su:2d8ct6rOp7fpU059/1vd
|
| Size: |
715
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324004v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324004v4.xml
|
| Category: |
dropped
|
| Dump: |
rule324004v4.xml.3.dr
|
| ID: |
dr_84
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.19037429827684
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5CLDDUhnpYunerOquUdaGodHMp9VEIpyXOXclMNO2su:2dwLsh6rOqfpUKF9
|
| Size: |
737
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324005v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324005v2.xml
|
| Category: |
dropped
|
| Dump: |
rule324005v2.xml.3.dr
|
| ID: |
dr_87
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.220281387352167
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5/D+enpYoAQ8nerOVHSuUdaGodHMpEXBMNO2su:2dNVrrOVyfpUTO
|
| Size: |
598
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324005v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324005v3.xml
|
| Category: |
dropped
|
| Dump: |
rule324005v3.xml.3.dr
|
| ID: |
dr_90
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.228447488495804
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5QzD+enpYoAQ8nerFAuUdaGodHMpEXBMNO2su:2dOzVrrFAfpUTO
|
| Size: |
598
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324006v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324006v2.xml
|
| Category: |
dropped
|
| Dump: |
rule324006v2.xml.3.dr
|
| ID: |
dr_92
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.230232099526286
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd59gvoTxsnpYoAQ8nerOZuUdaGodHMpeXnMNO2su:2djSsxsrrOZfpUVU
|
| Size: |
598
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324006v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324006v3.xml
|
| Category: |
dropped
|
| Dump: |
rule324006v3.xml.3.dr
|
| ID: |
dr_94
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.237526852680604
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd59gAzoTxsnpYoAQ8ner9PuUdaGodHMpeXnMNO2su:2djvzsxsrrJfpUVU
|
| Size: |
598
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324007v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324007v2.xml
|
| Category: |
dropped
|
| Dump: |
rule324007v2.xml.3.dr
|
| ID: |
dr_96
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.241176697150625
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5ZZkEnpYoAQ8nerOiuUdaGodHMpfBrOXIMrlMNO2su:2dDZfrrOifpU+pOHC
|
| Size: |
610
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324007v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324007v3.xml
|
| Category: |
dropped
|
| Dump: |
rule324007v3.xml.3.dr
|
| ID: |
dr_98
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.251418148678797
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5CzZkEnpYoAQ8nertSuUdaGodHMpfBrOXIMrlMNO2su:2dczZfrrQfpU+pOHC
|
| Size: |
610
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324008v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324008v2.xml
|
| Category: |
dropped
|
| Dump: |
rule324008v2.xml.3.dr
|
| ID: |
dr_100
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.2518417029045175
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5OTnpYoAQierOgAuUdaGodHMpFzOXDzlMNO2su:2d0TZrODfpUoOPC
|
| Size: |
606
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324008v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324008v3.xml
|
| Category: |
dropped
|
| Dump: |
rule324008v3.xml.3.dr
|
| ID: |
dr_102
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.259590054998113
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5P7zTnpYoAQierZuUdaGodHMpFzOXDzlMNO2su:2dRzTZrZfpUoOPC
|
| Size: |
606
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324009v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324009v2.xml
|
| Category: |
dropped
|
| Dump: |
rule324009v2.xml.3.dr
|
| ID: |
dr_103
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.235810343917564
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5Cg3lPnpYoAQ8nerORHSuUdaGodHMp0RXMBCMNO2su:2dgg1PrrOhSfpUrcf
|
| Size: |
610
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324009v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324009v3.xml
|
| Category: |
dropped
|
| Dump: |
rule324009v3.xml.3.dr
|
| ID: |
dr_114
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.244242937990392
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5C1z3lPnpYoAQ8neruuUdaGodHMp0RXMBCMNO2su:2dg1z1PrrufpUrcf
|
| Size: |
610
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324010v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324010v2.xml
|
| Category: |
dropped
|
| Dump: |
rule324010v2.xml.3.dr
|
| ID: |
dr_117
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.215451463140198
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5uMtcnpYoAQ8nerONuUdaGodHMpOqXMHhMNO2su:2dztcrrONfpUbqcHe
|
| Size: |
610
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324010v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324010v3.xml
|
| Category: |
dropped
|
| Dump: |
rule324010v3.xml.3.dr
|
| ID: |
dr_120
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.221173849484883
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5u5ztcnpYoAQ8nerj7uUdaGodHMpOqXMHhMNO2su:2dMztcrrj7fpUbqcHe
|
| Size: |
610
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324011v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324011v1.xml
|
| Category: |
dropped
|
| Dump: |
rule324011v1.xml.3.dr
|
| ID: |
dr_123
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.1613159159603486
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5JxEzi4snpYunerFuUdaGodHMp9LbSOkxzSALW9NO2su:2dyzi4s6rFfpU96z
|
| Size: |
665
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324012v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324012v3.xml
|
| Category: |
dropped
|
| Dump: |
rule324012v3.xml.3.dr
|
| ID: |
dr_125
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.922924554720851
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd50z7npYoAQjerZferXerONXahI6uLauMfap9SzfsS4eCf1yN1xaXAFMeIvfV:2d+z7erZWrOrl/hzUiCtY1sbv5Q2QU
|
| Size: |
1164
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324013v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324013v0.xml
|
| Category: |
dropped
|
| Dump: |
rule324013v0.xml.3.dr
|
| ID: |
dr_127
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.08414497026305
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5di4snpYoAQjer1uUddlndytzs8nUUhMnHDd32UAA2YnmZcAwwnVd4AdNO2z:2dzi4ser1f/zWgSh+ADpL
|
| Size: |
1023
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324014v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324014v0.xml
|
| Category: |
dropped
|
| Dump: |
rule324014v0.xml.3.dr
|
| ID: |
dr_129
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.186374014667383
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5l1OfhnpYoAQjersuUddAzy+e/wzy+ynteUImGYndKUveNO2su:2dv0fhersf/A2+eY2+DcGuG
|
| Size: |
715
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324015v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324015v0.xml
|
| Category: |
dropped
|
| Dump: |
rule324015v0.xml.3.dr
|
| ID: |
dr_131
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.191796263875905
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5V4xyfsuhnpYoAQjer6uUddAzy+e/wzy+yntdrrqX7rrenurnO5jrnynHDhP:2d3tfsuher6f/A2+eY2+mqTFEnAFpQ8
|
| Size: |
850
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324016v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule324016v0.xml
|
| Category: |
dropped
|
| Dump: |
rule324016v0.xml.3.dr
|
| ID: |
dr_133
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.198284707942154
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5YBdTsnpY0erLCyuUdnWQDSpfxQm9NO2su:2d6BxsurrfEY0pZz
|
| Size: |
466
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule325000v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule325000v0.xml
|
| Category: |
dropped
|
| Dump: |
rule325000v0.xml.3.dr
|
| ID: |
dr_134
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
2.636298184971013
|
| Encrypted: |
false
|
| Ssdeep: |
48:c/ulx9xPBDBeB1BdBJBgMBExdxFnBtBoBH9BUB4BfBHMf:SuvX51CPHLgA43nX0HYEJHy
|
| Size: |
8969
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule325001v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule325001v0.xml
|
| Category: |
dropped
|
| Dump: |
rule325001v0.xml.3.dr
|
| ID: |
dr_144
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.726824212334375
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d7lqwQc11mXV30chKHuyPjRF4qLPD3RfT0cV0sOczioc8cg:cBQI1s0qWuybRF4q90w0q59j
|
| Size: |
1984
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule325002v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule325002v0.xml
|
| Category: |
dropped
|
| Dump: |
rule325002v0.xml.3.dr
|
| ID: |
dr_147
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.694742156542357
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d1wQc1/V30cYIHuyPiKpFYhLPD3RfT0cTqC8vwfu+cjcg:caQIl0GuyPFYh900qLiWj
|
| Size: |
2054
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule360000v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule360000v3.xml
|
| Category: |
dropped
|
| Dump: |
rule360000v3.xml.3.dr
|
| ID: |
dr_150
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.282127875194043
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5TKO3m0P+ygAQjer5C/gSu87rRKfDAfnImTF1SDfnjNAoHyt6nCm/vnCqTa+:2dBKQLntr3b87rRK8Qsar9HJlHYti
|
| Size: |
873
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule360001v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule360001v3.xml
|
| Category: |
dropped
|
| Dump: |
rule360001v3.xml.3.dr
|
| ID: |
dr_153
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.29989390626452
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5cKOCP+ygAQjerCyOXAf8t/nHNO2su:2dCKZntrFOQEtF
|
| Size: |
447
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule370000v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule370000v1.xml
|
| Category: |
dropped
|
| Dump: |
rule370000v1.xml.3.dr
|
| ID: |
dr_156
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.2598361101997035
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd5UAlkYL0OCHsC4Bf7tSPshsSs0FUHpnGpCdx2cUSwnnqxy0UW5yNOn2sby:TMHd51NCk7gkVigA5UdyUkyNO2su
|
| Size: |
529
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule370001v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule370001v2.xml
|
| Category: |
dropped
|
| Dump: |
rule370001v2.xml.3.dr
|
| ID: |
dr_158
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.715233540446112
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dXcMkbrMrnrBrVhrZrLrx+pJt396fHk1xY/S7D8J1Ux54AN/RidGXH7E8/Nytt7:cXKbwj1DlXcpJJwL2LUdGrtu7
|
| Size: |
2270
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule370002v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule370002v2.xml
|
| Category: |
dropped
|
| Dump: |
rule370002v2.xml.3.dr
|
| ID: |
dr_160
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.069718902007382
|
| Encrypted: |
false
|
| Ssdeep: |
96:SSY1Q4Qr3QbQrrVQ2QrnQJQrY1QHQKVsbkddl47:udM6OHsUn1Yrsbki7
|
| Size: |
5775
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule370005v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule370005v1.xml
|
| Category: |
dropped
|
| Dump: |
rule370005v1.xml.3.dr
|
| ID: |
dr_162
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.86938725236406
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dyaMkbrkrMxYrtnTZZlHgN0oEKPkl7cF7:cysbYwxYBnTRgZTMqF7
|
| Size: |
1120
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule370006v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule370006v0.xml
|
| Category: |
dropped
|
| Dump: |
rule370006v0.xml.3.dr
|
| ID: |
dr_164
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.983569627399716
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5+A4Cwa7gkVierPb/erM4ert5BjEa/s8CnXXHaSMpqyXHISMNO3XGHNUlu:2dcNaMkbrPSrMfrtDF/2dya7
|
| Size: |
786
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule370007v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule370007v3.xml
|
| Category: |
dropped
|
| Dump: |
rule370007v3.xml.3.dr
|
| ID: |
dr_165
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.7725483241132505
|
| Encrypted: |
false
|
| Ssdeep: |
48:cFcEKUGge6phZjFjeYr3LnzXmLJf5Mo6ws3gDnsUFXYyV50g7XkW3487:OctMoFdHxp7
|
| Size: |
3344
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule370009v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule370009v0.xml
|
| Category: |
dropped
|
| Dump: |
rule370009v0.xml.3.dr
|
| ID: |
dr_175
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.136223556840137
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5Bvy07gkVierSjBiMfEIiwxP0diMfAGjdiwxdyc/yNOqHNUlu:2dS0Mkbry8iO7ljrr9o7
|
| Size: |
627
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule370011v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule370011v1.xml
|
| Category: |
dropped
|
| Dump: |
rule370011v1.xml.3.dr
|
| ID: |
dr_177
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.036697503394607
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5qrC07gkV2ws1SEernKMS0E7WNoSdR/SpidydtlImX/MDd+DrVJd3w7uX9kN:2dIBMkds1KrAsbRMyGKh+3Jg7utM
|
| Size: |
857
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule370012v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule370012v0.xml
|
| Category: |
dropped
|
| Dump: |
rule370012v0.xml.3.dr
|
| ID: |
dr_180
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.264707739167976
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd5lvkY+1xxqsC4Bf7tSPshsSs0FUHperhHzFFCx7IwLKBsfUSFNOn2sby:TMHd5t277gkVierFFFGfUINO2su
|
| Size: |
398
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule390004v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule390004v3.xml
|
| Category: |
dropped
|
| Dump: |
rule390004v3.xml.3.dr
|
| ID: |
dr_183
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.509322215022879
|
| Encrypted: |
false
|
| Ssdeep: |
48:c8NZ16WZ3FwW9ua3t72AYvLdqG1rdmq0kvmvaclGRwAV:1LtyQErT9heGRwAV
|
| Size: |
3282
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule390005v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule390005v1.xml
|
| Category: |
dropped
|
| Dump: |
rule390005v1.xml.3.dr
|
| ID: |
dr_186
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.297798715342976
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd5XJXA+NZ1S4Hs14WnervAlNEu2uNO2su:2dTXtNZ17Hs1WrvAlavu
|
| Size: |
449
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule440000v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule440000v3.xml
|
| Category: |
dropped
|
| Dump: |
rule440000v3.xml.3.dr
|
| ID: |
dr_189
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.962466047797236
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dAFcFwTS30cq3P5s5GkWhbhScX8h3fUc+FfT+Nc0KN0oOBzBB:cCOwTs0JRQGRFyMpiFB
|
| Size: |
1997
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule460008v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule460008v0.xml
|
| Category: |
dropped
|
| Dump: |
rule460008v0.xml.3.dr
|
| ID: |
dr_191
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.3318799789319815
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd0kMYG0XwNZoQSJIccJI0PFRMFpAQ/CCHperhKjxPVCIJA+/LylNOn2sby:TMHdGYGuHJhhOSAQjerGlVZ6NO2su
|
| Size: |
451
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule460009v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule460009v0.xml
|
| Category: |
dropped
|
| Dump: |
rule460009v0.xml.3.dr
|
| ID: |
dr_193
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.258553972975612
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd1YgJhhOSAQjerTbNlVfsXUTxNO2su:2d1Y4v2rTbNPfL7
|
| Size: |
418
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490002v13.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490002v13.xml
|
| Category: |
dropped
|
| Dump: |
rule490002v13.xml.3.dr
|
| ID: |
dr_195
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.957729381051681
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd9jX9GgeKPQjP5iACeroHf/xoW+tN5lOyX/c//KNpON2feIdLWt8Oj8kdy9WG:2d9T9oKPoiA1roEtvJ2ekrHo+G
|
| Size: |
1094
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490003v7.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490003v7.xml
|
| Category: |
dropped
|
| Dump: |
rule490003v7.xml.3.dr
|
| ID: |
dr_196
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.218650687808662
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdbjX9LPQjP5iUvAQ2Cer4SfUIdLWtlZQIdy99UXNO2su:2dbT9LPoiUm1r4NkHk39
|
| Size: |
644
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490004v7.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490004v7.xml
|
| Category: |
dropped
|
| Dump: |
rule490004v7.xml.3.dr
|
| ID: |
dr_207
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.232302719741035
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdKj4PQjP5iUvAQjer5O2ikl9IqI6bdSFYfI5NlFfUIdLWtiOZQIp9WtvMfZvM:2dKkPoiU6r53l2qI3iQbliknvM5M
|
| Size: |
758
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490005v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490005v3.xml
|
| Category: |
dropped
|
| Dump: |
rule490005v3.xml.3.dr
|
| ID: |
dr_209
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.132471131375387
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdW1OjXPQjP5iUvAQjerFfUIdLWtiOZQIdy99UXdVUS/rwNO2su:2dYOzPoiU6riknk3tds
|
| Size: |
694
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490009v5.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490009v5.xml
|
| Category: |
dropped
|
| Dump: |
rule490009v5.xml.3.dr
|
| ID: |
dr_212
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.858429693642566
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdrjX9zx6PQjP5iAGervHrOcer6Werm5NXahIUfedLm/6Wdy9yN7PNWSf/0//+:2drT9zsPoiAZrvHrkrwrmBi1tPfcPt0
|
| Size: |
1119
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490010v7.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490010v7.xml
|
| Category: |
dropped
|
| Dump: |
rule490010v7.xml.3.dr
|
| ID: |
dr_215
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.999452903396452
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dLT9b7PoiUm1rbmu++agGik3CD81gGJAl:cPhoidfmuH58gGJAl
|
| Size: |
1054
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490011v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490011v4.xml
|
| Category: |
dropped
|
| Dump: |
rule490011v4.xml.3.dr
|
| ID: |
dr_219
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.396572860245193
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdQ2jX913PQjP5iUvAQ2GerWlT4pJ8AoMfUINO2su:2dQ2T913PoiUmZrgT4pWN/g
|
| Size: |
522
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490014v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490014v2.xml
|
| Category: |
dropped
|
| Dump: |
rule490014v2.xml.3.dr
|
| ID: |
dr_223
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.1660163564825154
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd9ajX9DuPQjP5i8IerTgLfUIdLHABnt9ytFpKatmansyAuUpKaAuDaNO2su:2d9aT9DuPoi8vrcwkrKb5KYa
|
| Size: |
750
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490015v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490015v2.xml
|
| Category: |
dropped
|
| Dump: |
rule490015v2.xml.3.dr
|
| ID: |
dr_227
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.170559833928803
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdnzTjX9TPQjP5i8IerYxfUIdLWtlZQIdy99UXNO2su:2dzTT9TPoi8vrY+kHk39
|
| Size: |
590
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490015v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490015v3.xml
|
| Category: |
dropped
|
| Dump: |
rule490015v3.xml.3.dr
|
| ID: |
dr_230
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.203214093629336
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdnz1OjX9TPQjP5iAGerR86vfUIdLumDtODXdy9WtlZQIdV9UXNO2su:2dz1OT9TPoiAZrRwkymDgDt8kY9
|
| Size: |
756
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490015v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490015v4.xml
|
| Category: |
dropped
|
| Dump: |
rule490015v4.xml.3.dr
|
| ID: |
dr_233
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.201955000402187
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdnz42jX9TPQjP5iAGerR86vfUIdLumDtODXdy9WtlZQIdV9UXNO2su:2dz42T9TPoiAZrRwkymDgDt8kY9
|
| Size: |
756
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490015v5.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490015v5.xml
|
| Category: |
dropped
|
| Dump: |
rule490015v5.xml.3.dr
|
| ID: |
dr_235
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.216653685662024
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdnzOjX9TPQjP5iAGerR86WwfUIdLumDtODXdy9WtlZQIdV9UXNO2su:2dzOT9TPoiAZrRijkymDgDt8kY9
|
| Size: |
774
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490016v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490016v3.xml
|
| Category: |
dropped
|
| Dump: |
rule490016v3.xml.3.dr
|
| ID: |
dr_249
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.269995983314768
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdIOjX9K2OsPQjP5iAGerwEi2MaGxX0Y/hjfUIZTOXHnt9Jg+oZNO2su:2dIOT9SsPoiAZrwUMjX04I9joP
|
| Size: |
776
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490018v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490018v3.xml
|
| Category: |
dropped
|
| Dump: |
rule490018v3.xml.3.dr
|
| ID: |
dr_251
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.313452430415608
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdY7OjX9OXjCRPQjP5iUvAQXerQHFjQ8GfUIa3Cfm2NO2su:2dGOT9OXGRPoiU+r2jd3CuG
|
| Size: |
600
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490020v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490020v3.xml
|
| Category: |
dropped
|
| Dump: |
rule490020v3.xml.3.dr
|
| ID: |
dr_254
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.1585853149422425
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdFOjX9PMBPQjP5i8IerPwGb1/cACbAjfUIdLWtlAGnp9l/+b4RCffE2NO2su:2dFOT9UPoi8vr3btcbdkK1FCnEG
|
| Size: |
792
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490023v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490023v0.xml
|
| Category: |
dropped
|
| Dump: |
rule490023v0.xml.3.dr
|
| ID: |
dr_257
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.0162899219761075
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdTgjC5PQjP5iEereB6w5GfUIdLWtlZQIdy99UXnsSrF/LaoaxKf7PNWzcuf/3:2dMIPoiLreP5hkHk3D5ugzPscKv
|
| Size: |
909
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490024v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490024v0.xml
|
| Category: |
dropped
|
| Dump: |
rule490024v0.xml.3.dr
|
| ID: |
dr_260
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.227600293961609
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdpjX9wbUPPQjP5iAGer0hAfUIZyOTxfpKaOTLNO2su:2dpT9wwPPoiAZr0FENBKBd
|
| Size: |
537
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490025v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490025v0.xml
|
| Category: |
dropped
|
| Dump: |
rule490025v0.xml.3.dr
|
| ID: |
dr_263
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.250327563895679
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdCjX9PMiBPQjP5iAGerTHLGfUIdLWtlAGnNO2su:2dCT9FPoiAZrTHlkKN
|
| Size: |
532
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490027v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490027v1.xml
|
| Category: |
dropped
|
| Dump: |
rule490027v1.xml.3.dr
|
| ID: |
dr_267
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.2368508517516075
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdrjX9ZLPPQjP5iAFerudDGfUIdLStlIm/NO2su:2drT9JPPoiAwruddkOT
|
| Size: |
526
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490028v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490028v0.xml
|
| Category: |
dropped
|
| Dump: |
rule490028v0.xml.3.dr
|
| ID: |
dr_271
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.183641976679839
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdQgj2RBPQjP5iUvAQ2GerGfUIn+IWF/VWaody9WtlZQIdV9UXNO2su:2dQgwPoiUmZrhLA8kY9
|
| Size: |
723
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490029v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490029v0.xml
|
| Category: |
dropped
|
| Dump: |
rule490029v0.xml.3.dr
|
| ID: |
dr_274
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.2768580605666076
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBdj1mkgAxmX9GwWZbBPQe8u0RAUiG5rHperhJdM0upx7IwLKBsfUSFNOn2sby:TMHdBgjX9+PQjP5iAFerbSJfUINO2su
|
| Size: |
432
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490030v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490030v2.xml
|
| Category: |
dropped
|
| Dump: |
rule490030v2.xml.3.dr
|
| ID: |
dr_276
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.162562112883083
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdwpjbSBBPQjP5iUvAQjerKjfUIdLWtiOZQIdy99UX4WtvMfZvkNO2su:2dwpCBBPoiU6rKIknk3xM5M
|
| Size: |
715
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490031v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule490031v0.xml
|
| Category: |
dropped
|
| Dump: |
rule490031v0.xml.3.dr
|
| ID: |
dr_289
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.312769094340112
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdpVjIhPQjP5iEerq54FVlC3GxwOfUIdLWtlZQINO2su:2dHkhPoiLrHCPkHg
|
| Size: |
586
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500000v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500000v2.xml
|
| Category: |
dropped
|
| Dump: |
rule500000v2.xml.3.dr
|
| ID: |
dr_290
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.312139265456619
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd3SsbGPQjP5iUvAQierZ+u/lOaNeznfH/M//CK5eNX/c//aNeLfH/M//bU5eS:2d3SsbGPoiUFrAuXKf5TyfB
|
| Size: |
813
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500001v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500001v2.xml
|
| Category: |
dropped
|
| Dump: |
rule500001v2.xml.3.dr
|
| ID: |
dr_292
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.291095535715688
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdGpSsk7hPQjP5iUvAQierZ+u/lOaNeznfH/M//UU5eNX/c//aNeLfH/M//h5J:2dYSsk7hPoiUFrAuXKf5vTyfk
|
| Size: |
807
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500002v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500002v2.xml
|
| Category: |
dropped
|
| Dump: |
rule500002v2.xml.3.dr
|
| ID: |
dr_295
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.304696165971124
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdhSsDPQjP5iUvAQierZ+u/lOaNeznfH/M//UU5eNX/c//aNeLfH/M//rGs45J:2dhSsDPoiUFrAuXKf5vTyfqG7
|
| Size: |
811
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500003v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500003v2.xml
|
| Category: |
dropped
|
| Dump: |
rule500003v2.xml.3.dr
|
| ID: |
dr_297
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.30035311191936
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdaSsFTKPQjP5iUvAQierZ+u/lOaNeznfH/M//S5eNX/c//aNeLfH/M//bU5eS:2daSsFePoiUFrAuXKfQTyfB
|
| Size: |
811
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500004v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500004v2.xml
|
| Category: |
dropped
|
| Dump: |
rule500004v2.xml.3.dr
|
| ID: |
dr_299
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.309548301743047
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdzSs0XnPPQjP5iUvAQierZ+u/lOaNeznfH/M//E5eNX/c//aNeLfH/M//bU5J:2dzSs0fPoiUFrAuXKfCTyfB
|
| Size: |
811
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500005v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500005v2.xml
|
| Category: |
dropped
|
| Dump: |
rule500005v2.xml.3.dr
|
| ID: |
dr_301
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.300576973226168
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd6JTSsZPQjP5iUvAQierZ+u/lOaNeznfH/M//+5eNX/c//aNeLfH/M//bU5eS:2d6pSsZPoiUFrAuXKfUTyfB
|
| Size: |
810
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500006v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500006v2.xml
|
| Category: |
dropped
|
| Dump: |
rule500006v2.xml.3.dr
|
| ID: |
dr_305
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.9706193864986
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdMaSsnDHFPQjP5iUvAQierDNT+u/qNO8T/X/c//wVrMpONEOjsu:2ddSsxPoiUFrsuyBLjh
|
| Size: |
514
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500007v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500007v1.xml
|
| Category: |
dropped
|
| Dump: |
rule500007v1.xml.3.dr
|
| ID: |
dr_308
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.308582096223094
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdnSs3KBuPQjP5iUvAQierDFzpNfUINO2su:2dnSs3PoiUFrfKg
|
| Size: |
433
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500008v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500008v2.xml
|
| Category: |
dropped
|
| Dump: |
rule500008v2.xml.3.dr
|
| ID: |
dr_309
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.974150258924041
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdfSsuPQjP5iUvAQierDFK/+u/qNOCX/c//bLMpONEOjsu:2dfSsuPoiUFrLuyxin
|
| Size: |
511
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500009v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500009v4.xml
|
| Category: |
dropped
|
| Dump: |
rule500009v4.xml.3.dr
|
| ID: |
dr_311
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.952479754079968
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHduK2dBPQjP5iUvAQierDv+u/qNODX/c//J/pONUV3fIy8n+HZRIy6Cynt9TI/:2dH2XPoiUFrauykO//
|
| Size: |
899
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500022v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500022v4.xml
|
| Category: |
dropped
|
| Dump: |
rule500022v4.xml.3.dr
|
| ID: |
dr_313
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.207482801991389
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdUN2KiKBPQjP5iUvAQiercfUIdLEjdy9bGNO2su:2dUN2KvPoiUFrvkyZ
|
| Size: |
600
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500023v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500023v4.xml
|
| Category: |
dropped
|
| Dump: |
rule500023v4.xml.3.dr
|
| ID: |
dr_315
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.215264669354499
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdlN2lPQjP5iUvAQierDSVc6hz5i2YL2i28dLEj/1fUINO2su:2dn2lPoiUFrGVhjDM2DARg
|
| Size: |
635
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500024v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule500024v3.xml
|
| Category: |
dropped
|
| Dump: |
rule500024v3.xml.3.dr
|
| ID: |
dr_317
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.172608606212303
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdTOSsAPQjP5iUvAQier69iIXFFCXyk02cNfUIdLi/Hp94fhns3fIyVInHxHZW:2dTOSsAPoiUFr69hvCC1LKk+ge6Bq9
|
| Size: |
1151
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510000v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510000v1.xml
|
| Category: |
dropped
|
| Dump: |
rule510000v1.xml.3.dr
|
| ID: |
dr_319
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.877471008035092
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdwhR+NZ1S4OAQ/Wner7erEuSerJoferwck/LvjE8nAqHaSMjiOHhSMp6lEHIJ:2dwh0NZ17arirPFrmWrYDvBPxkU
|
| Size: |
1063
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510005v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510005v1.xml
|
| Category: |
dropped
|
| Dump: |
rule510005v1.xml.3.dr
|
| ID: |
dr_321
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.9829472302134485
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdXDa2x+NZ1S4OAQ/Wner5lV9S6dTE7WNoSdydtlImXdUMDd+D9tbImFdmrvio:2dzCNZ17yr5PRHbGb9h+RPcAgOa3
|
| Size: |
935
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510006v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510006v0.xml
|
| Category: |
dropped
|
| Dump: |
rule510006v0.xml.3.dr
|
| ID: |
dr_324
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.027376168514338
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdLZa2g+NZ1S4OAQ/WnerflVXS6dTE7WNoSdydtlImXdUMDaD6SIm8HNUlu:2ddPNNZ17yrfPfHbGb9WWR
|
| Size: |
754
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510008v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510008v0.xml
|
| Category: |
dropped
|
| Dump: |
rule510008v0.xml.3.dr
|
| ID: |
dr_327
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.059081210311511
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdbPg+NZ1S4OAQ/Wner27swTEhodLStbImFdy95rvirgM45rhirTd+xSMfrcxN:2dbPNNZ17yrkx1OPqAGaR+QMTc3
|
| Size: |
766
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510009v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510009v0.xml
|
| Category: |
dropped
|
| Dump: |
rule510009v0.xml.3.dr
|
| ID: |
dr_328
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.020221704375508
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdEUag+NZ1S4OAQ/WnerMAswTEhodLStbImFdy95rvirgM45rhirTd+xSMfrcY:2dEFNNZ17yrXx1OPqAGaR+QMTc8T
|
| Size: |
858
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510010v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510010v0.xml
|
| Category: |
dropped
|
| Dump: |
rule510010v0.xml.3.dr
|
| ID: |
dr_330
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.121186837956521
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdKXty+NZ1S4OAQ/WnerWH5KfHxdLStbImFdy95rvirgM45rhirTNO2su:2dKXBNZ17yrWHIvrOPqAGa5
|
| Size: |
697
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510012v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510012v1.xml
|
| Category: |
dropped
|
| Dump: |
rule510012v1.xml.3.dr
|
| ID: |
dr_332
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.310010877279268
|
| Encrypted: |
false
|
| Ssdeep: |
48:cWGNZ1h3uXDfktVDfCODfRXr22XvEwJLbCrs2llXT:DWLtuQetj
|
| Size: |
3550
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510014v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510014v2.xml
|
| Category: |
dropped
|
| Dump: |
rule510014v2.xml.3.dr
|
| ID: |
dr_337
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.642296307351512
|
| Encrypted: |
false
|
| Ssdeep: |
48:c8a0NZ1WxVdhplQcUo/LYmbnHT6Hze1acRNv1mHwhZ1y0SU8Zqa3WE91VHhcQ5BI:faALcQHwy6E9tT5BIp8+WEZG5O
|
| Size: |
5190
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510015v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510015v0.xml
|
| Category: |
dropped
|
| Dump: |
rule510015v0.xml.3.dr
|
| ID: |
dr_340
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.593271194347315
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdKZberpspSndLpSImFdy9pSirgM4pSirTNO2su:2dKUrplWGS5
|
| Size: |
456
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510016v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510016v0.xml
|
| Category: |
dropped
|
| Dump: |
rule510016v0.xml.3.dr
|
| ID: |
dr_343
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.3411610829488017
|
| Encrypted: |
false
|
| Ssdeep: |
24:2djHuypQ+O9sAjctindSoD7U19Km5FsaJUamWFpR:cjuycTW9XSA
|
| Size: |
3600
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510017v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510017v0.xml
|
| Category: |
dropped
|
| Dump: |
rule510017v0.xml.3.dr
|
| ID: |
dr_346
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.843318669148307
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdX1FM373R+NZ1S4OAQ4Wni0j+u/qNOZfX/c//bLMpONws2oydLStbYxdy95ri:2dX1XNZ17Wyuyovi8BOIq0l
|
| Size: |
814
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510018v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510018v0.xml
|
| Category: |
dropped
|
| Dump: |
rule510018v0.xml.3.dr
|
| ID: |
dr_354
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.855936026523147
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dy1+NZ17WyuyovjuBOIq0Q1OkiW0isq1zz:cO+NZ13uyo7J0chrH
|
| Size: |
1448
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510022v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510022v2.xml
|
| Category: |
dropped
|
| Dump: |
rule510022v2.xml.3.dr
|
| ID: |
dr_355
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.957794389842405
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dRLKNZ17VrkrIrTrdrDr3rCr6HH6DuD1D0kDqv62mM3AqDXDAfsYlEDUQw99NkA:cINZ1hI8PxvLWuHTJgk46839IOUQE9qE
|
| Size: |
2271
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510023v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510023v0.xml
|
| Category: |
dropped
|
| Dump: |
rule510023v0.xml.3.dr
|
| ID: |
dr_358
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.117216279155608
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdm/5eHR+NZ1S4OAQ4WnerMergNertZU/HaSMdLH+Qd/tOdy9wo/sONOS5csu:2doeUNZ17VrzrgYrDUyr+IQKa
|
| Size: |
784
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510046v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510046v0.xml
|
| Category: |
dropped
|
| Dump: |
rule510046v0.xml.3.dr
|
| ID: |
dr_361
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.3513162915558885
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdRKPL73R+NZ1S4Hs14WnerJ0FSxMNO2su:2dRKUNZ17Hs1WruFb
|
| Size: |
457
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510047v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510047v0.xml
|
| Category: |
dropped
|
| Dump: |
rule510047v0.xml.3.dr
|
| ID: |
dr_364
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.092829408423781
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdCO1i3R+NZ1S4Hs14WnerFer/erQ5ae/HaSMsHhSMnt9oSa9NOS5csu:2dC0BNZ17Hs1Wrwr2rrjq
|
| Size: |
748
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510062v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510062v0.xml
|
| Category: |
dropped
|
| Dump: |
rule510062v0.xml.3.dr
|
| ID: |
dr_367
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.151550434787676
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdiwZnKQBXR+NZ1S4Hs14WnersPs2ndLStbImFdy95rvirgM45rhirTNO2su:2diCntBENZ17Hs1WrsP7OPqAGa5
|
| Size: |
727
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510063v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule510063v0.xml
|
| Category: |
dropped
|
| Dump: |
rule510063v0.xml.3.dr
|
| ID: |
dr_370
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.342081553453761
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdiRnU3R+NZ1S4Hs14WnerKssQbSnNO2su:2diRnPNZ17Hs1WrK7
|
| Size: |
467
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule580000v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule580000v1.xml
|
| Category: |
dropped
|
| Dump: |
rule580000v1.xml.3.dr
|
| ID: |
dr_372
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.27198561301701
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd/NglkG5Rv92jWaEnhu+B5CHperhrknPoGmCmyNOn2sby:TMHdFEwanBaerklmPyNO2su
|
| Size: |
389
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule580001v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule580001v1.xml
|
| Category: |
dropped
|
| Dump: |
rule580001v1.xml.3.dr
|
| ID: |
dr_554
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.951938354043482
|
| Encrypted: |
false
|
| Ssdeep: |
24:2du8EQrrOS0/+0P6i+oltli2lBliK9c0+oMwwFlulcLqRtNLROmpSpa6mvnbS8F6:cu8EQFllzcS2M8TfpSpazbS8o/
|
| Size: |
2328
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule580004v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule580004v0.xml
|
| Category: |
dropped
|
| Dump: |
rule580004v0.xml.3.dr
|
| ID: |
dr_557
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.247175088835789
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdBQKcYwanBaerdb3KsjKg0XxKsEkXxKgNO2su:2dBfcE7r4jSNFI
|
| Size: |
532
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63028v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63028v4.xml
|
| Category: |
dropped
|
| Dump: |
rule63028v4.xml.3.dr
|
| ID: |
dr_559
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.714131828094441
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdeNJoIV+d8WuXV4Wni0ycDQjEBzDLg5/e1lVYFjupfXd3TofNxdymO3cXHaSI:2deNJoIUen/SOc6PaY3T6gcyBYg
|
| Size: |
1151
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63030v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63030v2.xml
|
| Category: |
dropped
|
| Dump: |
rule63030v2.xml.3.dr
|
| ID: |
dr_561
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.75723033832876
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d2sUenQrdrJrqYrmr+rrrhrp2rXkP0kS:c2sUenQhd/Civ1oDCS
|
| Size: |
1006
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63038v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63038v1.xml
|
| Category: |
dropped
|
| Dump: |
rule63038v1.xml.3.dr
|
| ID: |
dr_564
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.653908788373925
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdZb/ylySLjlertNereSeraer9kferDZahIffONf0SlVDH+6p1SbPSiNOFsu:2dNrtYreFrtrWWrmdPb
|
| Size: |
927
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63040v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63040v2.xml
|
| Category: |
dropped
|
| Dump: |
rule63040v2.xml.3.dr
|
| ID: |
dr_567
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.996991224242757
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdxljNi0ZPiJVluDLg5/W8/Lge1lVDBy+Nxdy9pSOn7PNW3mVP/k//Zx2Nf/07:2dz7Zq3BX5P/EPPD2+Y
|
| Size: |
934
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63041v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63041v2.xml
|
| Category: |
dropped
|
| Dump: |
rule63041v2.xml.3.dr
|
| ID: |
dr_569
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.315384231229811
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d3UenMZ3QTmTPFMdPIPu/PMsrOEzPvPmzP53E:c3UenZmTt/Ei6
|
| Size: |
1481
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63042v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63042v3.xml
|
| Category: |
dropped
|
| Dump: |
rule63042v3.xml.3.dr
|
| ID: |
dr_570
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.785986914937611
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdUAOber6QEQNerMSNahSlVD4+eIdy9pSCl5sdVpSCIpRNOcsu:2dUAnr6QE5rTlPjMHQtIT
|
| Size: |
670
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63046v10.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63046v10.xml
|
| Category: |
dropped
|
| Dump: |
rule63046v10.xml.3.dr
|
| ID: |
dr_585
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.71516383376384
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dfrx8ZNP0kKk1+rQQP4PuetyxK/EczQss:cfAG3r+7QV
|
| Size: |
1616
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63048v6.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63048v6.xml
|
| Category: |
dropped
|
| Dump: |
rule63048v6.xml.3.dr
|
| ID: |
dr_587
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.4616521769015565
|
| Encrypted: |
false
|
| Ssdeep: |
48:cjUenQ2TzXAvF3YqYKMfxQgQwat5ocQER4KMPB7:MfamfxjMocQERip7
|
| Size: |
3787
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63049v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63049v2.xml
|
| Category: |
dropped
|
| Dump: |
rule63049v2.xml.3.dr
|
| ID: |
dr_589
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.702490763905221
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdKBIV+d8WuXV4Wni0LcefQjEBzDLg5/eX1lVfp4SApfXjlpFjupfX/mNxvofZ:2dOIUen/PYOcoPfudp9UlV5Fslo
|
| Size: |
1251
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63051v5.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63051v5.xml
|
| Category: |
dropped
|
| Dump: |
rule63051v5.xml.3.dr
|
| ID: |
dr_591
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.891709249185111
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9o3COUenQrornhrXWwTnzP3/qi/McEF4P2LIUPj7sQl:c9yCOUenQ01SoEF4eLIZC
|
| Size: |
1605
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63052v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63052v3.xml
|
| Category: |
dropped
|
| Dump: |
rule63052v3.xml.3.dr
|
| ID: |
dr_594
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.676950301726056
|
| Encrypted: |
false
|
| Ssdeep: |
24:2diWp5J+AvyVndNoyF7EeY2bx9nyggtaJ8QDk2ScXVuWMHCEm1KVpRwC/6lP6co3:cBfqdPEj2ry3KwssHrmR6FyKQxE7
|
| Size: |
2757
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63053v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63053v1.xml
|
| Category: |
dropped
|
| Dump: |
rule63053v1.xml.3.dr
|
| ID: |
dr_596
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.704780431425281
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdzyb/adFX/lVD6+UIpxXxupSEjEN1DRMxREmyNO2su:2dzvP0f+1ysmi
|
| Size: |
646
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63054v5.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63054v5.xml
|
| Category: |
dropped
|
| Dump: |
rule63054v5.xml.3.dr
|
| ID: |
dr_599
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.76787668390286
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9CUen/ZqqOchJPQNKFTAfC8+7DnqQEVo+lmnm8TWPsgV/Nb6K:csUen4qOebnSQEGg9sK
|
| Size: |
2070
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63056v9.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63056v9.xml
|
| Category: |
dropped
|
| Dump: |
rule63056v9.xml.3.dr
|
| ID: |
dr_601
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.908269649381328
|
| Encrypted: |
false
|
| Ssdeep: |
48:cEUencIhUaNoYomMOkrddDVsKYQEVc+Xoh5VkQbJ7:RfgddDV9YQEV/YhkQl7
|
| Size: |
2869
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63057v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63057v3.xml
|
| Category: |
dropped
|
| Dump: |
rule63057v3.xml.3.dr
|
| ID: |
dr_603
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.905365060817116
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dFhQ+UenQrAKrdQrGrfCWrgkrETwr7cLEeQ+QnzVdjS+ynZFHlJylcnNXOH7:cg+UenQLyyrCW1oEruEexqOf/FOH7
|
| Size: |
2178
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63058v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63058v0.xml
|
| Category: |
dropped
|
| Dump: |
rule63058v0.xml.3.dr
|
| ID: |
dr_606
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.9065245255107826
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd6qf0V+d8WuXV4WnerHKScDQjEBzDp1lVsAPXNUIp5XHaSMjlljuPXNO5ABsu:2dbf0UenQrHKyOPPMCyzG
|
| Size: |
913
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63059v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63059v0.xml
|
| Category: |
dropped
|
| Dump: |
rule63059v0.xml.3.dr
|
| ID: |
dr_608
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.204052822096694
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdyAV+d8WuXV2xAQ4WnereQUUIOiXQPJMMliXAAJMNO2su:2dyAUenc8re+hiAPiG
|
| Size: |
616
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63063v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63063v1.xml
|
| Category: |
dropped
|
| Dump: |
rule63063v1.xml.3.dr
|
| ID: |
dr_610
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.793923039336871
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdOriQVbV+d8WuXV4WneroScDQjEBi+wsvXqNO6X/c///d0HYpON+PvX7fwXH0:2d6BUenQroyOJwOa16d0wsk
|
| Size: |
791
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63066v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63066v1.xml
|
| Category: |
dropped
|
| Dump: |
rule63066v1.xml.3.dr
|
| ID: |
dr_612
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.115968261770895
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdtBXWuV+d8WuXV2xAQ4WnerynQ93zvbH9ocDQjEBzDpiUIROHaSMNO5ABsu:2dt1Uenc8rRJjbdIOF0
|
| Size: |
787
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63067v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63067v4.xml
|
| Category: |
dropped
|
| Dump: |
rule63067v4.xml.3.dr
|
| ID: |
dr_614
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.904185100591606
|
| Encrypted: |
false
|
| Ssdeep: |
48:cvqUencI4Yzcud/9WlGeR/0D3Ij0QH0f+QEVYVWjUtsmMU+z7:6qfcWJ3I76+QEVXjUtsmMUU7
|
| Size: |
2870
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63069v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63069v0.xml
|
| Category: |
dropped
|
| Dump: |
rule63069v0.xml.3.dr
|
| ID: |
dr_618
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.9010788425455685
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dMNNUencIraWrNrFtqrRrKFrsfTYRIsIxDsXHmdJfOOdlRoHl2vAr7:csUencIfBeVW4f8Rf0Ds3CJfbJuIc7
|
| Size: |
1792
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63070v5.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63070v5.xml
|
| Category: |
dropped
|
| Dump: |
rule63070v5.xml.3.dr
|
| ID: |
dr_623
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.092328766049697
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdZWV+d8WuXV2xAQ/erKere/Q9lVZT4S6jlW5RdjlV9GY34TqcPIb6Md+xqOEq:2dZWUencIrdre49PqIpcc+QOEeQ6DnzB
|
| Size: |
1053
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63071v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63071v0.xml
|
| Category: |
dropped
|
| Dump: |
rule63071v0.xml.3.dr
|
| ID: |
dr_625
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.3337541139567035
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd4FV+d8WuXV2xAQ4WnerMZzsUINO2su:2d4FUenc8rERg
|
| Size: |
420
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63077v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63077v0.xml
|
| Category: |
dropped
|
| Dump: |
rule63077v0.xml.3.dr
|
| ID: |
dr_627
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.100737631611683
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dR+UencIrD+rE19PqIpcc+QOEeQ6DnzB:cQUencIP+Q1CVEe3
|
| Size: |
1065
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63078v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule63078v0.xml
|
| Category: |
dropped
|
| Dump: |
rule63078v0.xml.3.dr
|
| ID: |
dr_629
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.268171901132547
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBdHAkwD1VTcGfWVbKdq+HwWuXVUHperhhx7I7/USFNOn2sby:TMHd6iV+d8WuXViersUINO2su
|
| Size: |
374
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule65136v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule65136v1.xml
|
| Category: |
dropped
|
| Dump: |
rule65136v1.xml.3.dr
|
| ID: |
dr_630
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.954992114837363
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdB+tV+d8WuXV4Wneruc1NQjEBzDpnAUiUI0AZr7p6OXHaSMNO5ABsu:2dB6UenQrjqOxAwhApVo
|
| Size: |
798
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule65137v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule65137v0.xml
|
| Category: |
dropped
|
| Dump: |
rule65137v0.xml.3.dr
|
| ID: |
dr_633
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.536516834264947
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdBqLOerPferLofSNahueIIKObNOcsu:2dBCrOrcqpOj
|
| Size: |
418
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule65138v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule65138v0.xml
|
| Category: |
dropped
|
| Dump: |
rule65138v0.xml.3.dr
|
| ID: |
dr_635
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8747665284616675
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdBTTQV+d8WuXVic6NXFJjEQiiQ4WXyLi6yS5+xp6uRHfSMNOS5csu:2dBfQUenixvLXMY
|
| Size: |
760
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule65139v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule65139v0.xml
|
| Category: |
dropped
|
| Dump: |
rule65139v0.xml.3.dr
|
| ID: |
dr_638
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.432562297734537
|
| Encrypted: |
false
|
| Ssdeep: |
192:wxYYVY8ZfZmx7iFbRduRVqOqHs4g1RfafmEN/NGWguWQuTu6ctcGmkC+ACmseNi3:Lxm
|
| Size: |
7761
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68000v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68000v3.xml
|
| Category: |
dropped
|
| Dump: |
rule68000v3.xml.3.dr
|
| ID: |
dr_641
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.466450204490182
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdqO7erKSer2tDpTW8/pTO91UWCf/0//XhmMdy9pSPqNO/HNUlu:2dqFrKFrQpi1J7
|
| Size: |
713
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68001v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68001v2.xml
|
| Category: |
dropped
|
| Dump: |
rule68001v2.xml.3.dr
|
| ID: |
dr_644
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.471676286590207
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdDfKerd0er2YDpTW8/pTO91UWCf/0//XhmMdy9pSPqNOjsu:2dD1r5rLpi1F
|
| Size: |
669
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68002v11.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68002v11.xml
|
| Category: |
dropped
|
| Dump: |
rule68002v11.xml.3.dr
|
| ID: |
dr_647
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.887563027427744
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dd+corVPl6/+PNtFu3y7wIgUNZOrmzVBSl5OaFvg9OOygwAOOprrkXDirY6av:cd+7rPN6iP9pSnFvVZvUMyYzv
|
| Size: |
2646
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68003v12.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68003v12.xml
|
| Category: |
dropped
|
| Dump: |
rule68003v12.xml.3.dr
|
| ID: |
dr_650
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.885655529573596
|
| Encrypted: |
false
|
| Ssdeep: |
48:chohg74padkAmu8WsMHgzPC0bZsQuhDPpnp1VR4:Bhcd8Wsqg7C0bmNhzpnpHR4
|
| Size: |
2338
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68004v16.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68004v16.xml
|
| Category: |
dropped
|
| Dump: |
rule68004v16.xml.3.dr
|
| ID: |
dr_652
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.928259864066492
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dSvcorQPl6X1xFihNGuc5FtNFOXqHVBSgNm5O2El/pu4xiVK48hYBY6+Kv:cSv7/WNTc5RFdSgBhuXK1UYkv
|
| Size: |
2428
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68006v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68006v0.xml
|
| Category: |
dropped
|
| Dump: |
rule68006v0.xml.3.dr
|
| ID: |
dr_655
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.1531357207464
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBdDGk6SMQnTq3HwBUuNtEzrmRMFpAQ/GCHperhAjxPVC7LylnnqxtG0guynfC:TMHdDaPaEPAQXerMlVA64X9NO2su
|
| Size: |
504
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68008v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68008v4.xml
|
| Category: |
dropped
|
| Dump: |
rule68008v4.xml.3.dr
|
| ID: |
dr_657
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.12487732220577
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdfgoXLaEzerolVA64X9M93CCwrCfodVGTYPqNO2su:2dfT+XroPI8CzCsQYq
|
| Size: |
676
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68009v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68009v0.xml
|
| Category: |
dropped
|
| Dump: |
rule68009v0.xml.3.dr
|
| ID: |
dr_661
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.0976719166954965
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd/zaEPAQAmderHco9lVA64X9Q4hlw0daXsfgtiEXQx4xGQq/jkdKOASNO2su:2d+corHPPIFHDe4e1Ka
|
| Size: |
1046
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68010v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68010v2.xml
|
| Category: |
dropped
|
| Dump: |
rule68010v2.xml.3.dr
|
| ID: |
dr_662
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.973246245299416
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dQ+corHnrO6PIFHw5jQ10OODKOJKf+zRJ7:cQ+7DqVFTLGAkRJ7
|
| Size: |
1280
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68011v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68011v4.xml
|
| Category: |
dropped
|
| Dump: |
rule68011v4.xml.3.dr
|
| ID: |
dr_664
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.737419506295463
|
| Encrypted: |
false
|
| Ssdeep: |
48:clvhg7Ft1IUSSlkTcWetK70kF2ZnHh0AHv7:EvhWtySHh0AHv7
|
| Size: |
2419
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68012v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68012v2.xml
|
| Category: |
dropped
|
| Dump: |
rule68012v2.xml.3.dr
|
| ID: |
dr_666
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.0191095661729275
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdnN1aEPAQAmderH+erV8/eeWDee1lVA69JXhQ9JhlwtIdVDG5jY1N1Dckd0fh:2dicorHRrO6Pjo2kw5jQ15OFRJ7
|
| Size: |
1224
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68013v9.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68013v9.xml
|
| Category: |
dropped
|
| Dump: |
rule68013v9.xml.3.dr
|
| ID: |
dr_668
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.986220934844517
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d+rsfcorthjgPjYtY1rDT4EsN+WsawSplzAfrkfLIkoI/NXr9ZYgaCgQ:cssf7hIYaEEsLsUygZ08F
|
| Size: |
1917
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68014v8.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68014v8.xml
|
| Category: |
dropped
|
| Dump: |
rule68014v8.xml.3.dr
|
| ID: |
dr_670
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.9812676715207145
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dE0ocorGPIc0YD1wDTfE6N+XzMNUhs7DiW:czo7VcjJ6E6m4NY+
|
| Size: |
1492
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68015v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68015v1.xml
|
| Category: |
dropped
|
| Dump: |
rule68015v1.xml.3.dr
|
| ID: |
dr_673
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.127553325484714
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd9vc7aEPAQAmder+lVA64X9dy9OxFkd+DOENO2su:2dZc+cor+PIvC+p
|
| Size: |
863
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68016v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68016v1.xml
|
| Category: |
dropped
|
| Dump: |
rule68016v1.xml.3.dr
|
| ID: |
dr_676
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.22721966541961
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdUqnGaEPAQAmder+lglVA6PkdyuUnENO2su:2d9JcorhPAes
|
| Size: |
670
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68017v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68017v1.xml
|
| Category: |
dropped
|
| Dump: |
rule68017v1.xml.3.dr
|
| ID: |
dr_679
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.12901436166847
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdvCO7aEPAQAmderTlVA64X9/9nU+Fkd+DO4cNO2su:2dKO+corTPIcf+L0
|
| Size: |
852
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68018v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68018v1.xml
|
| Category: |
dropped
|
| Dump: |
rule68018v1.xml.3.dr
|
| ID: |
dr_681
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.118440135439064
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdN4d7aEPAQAmderN8RlVA64X9/9nU+isfgN1Dckd0ZNO2su:2dNu+corsPIcgO15Y
|
| Size: |
957
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68019v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68019v2.xml
|
| Category: |
dropped
|
| Dump: |
rule68019v2.xml.3.dr
|
| ID: |
dr_683
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.816936606288027
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd0UaEPAQAmderdfer8erMDeeW8/eeWHNeevXsNUWCf/0//XhmMp8kdWq4D7UH:2dwcorYrjrMkbbKsCkeRF
|
| Size: |
1403
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68020v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68020v3.xml
|
| Category: |
dropped
|
| Dump: |
rule68020v3.xml.3.dr
|
| ID: |
dr_684
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.0656769615346375
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdE4G8X7aE3mderOMlVA6cnU+paSQO9Pi2Ym8N1DZ9uT9SjkdKOFhNO2su:2dED8unorfPlTY9DTy1VEHKqn
|
| Size: |
1020
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68022v8.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68022v8.xml
|
| Category: |
dropped
|
| Dump: |
rule68022v8.xml.3.dr
|
| ID: |
dr_686
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.000011077180308
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d55/corarUc0nNEh++0KAe6+NkA4wwckWr5SZRF:cP7moc0V+07LRF
|
| Size: |
1530
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68023v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68023v2.xml
|
| Category: |
dropped
|
| Dump: |
rule68023v2.xml.3.dr
|
| ID: |
dr_688
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.067778544938019
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdoUoF7aE3mderVlVA6cnU+p9lSQE45i2YmqN1xa9uT9EePcemxckd+vesKNOQ:2dKknorVPlAdDTw1gEV14N+WsK
|
| Size: |
1175
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68024v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68024v2.xml
|
| Category: |
dropped
|
| Dump: |
rule68024v2.xml.3.dr
|
| ID: |
dr_690
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.999227591555157
|
| Encrypted: |
false
|
| Ssdeep: |
24:2drdngnorepPlAO0dbY1rDT4EO1u+mAfrkw3LIkXIjrI/NhsK:crdgoCDAO0doEE60S/sK
|
| Size: |
1673
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68025v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68025v1.xml
|
| Category: |
dropped
|
| Dump: |
rule68025v1.xml.3.dr
|
| ID: |
dr_692
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.07099005036855
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd/Ghc7aE3mder4elVA69JXh/9nU+4a9uT9EN1Dckd0rqNO2su:2dW/norBPjYyE4154q
|
| Size: |
942
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68026v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68026v0.xml
|
| Category: |
dropped
|
| Dump: |
rule68026v0.xml.3.dr
|
| ID: |
dr_694
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.965661719309549
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d1/norRPpOcPeFygxIl87Otass+4snTzNS8w:c1/oDOcG00IlTaYTz08w
|
| Size: |
1703
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68027v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68027v0.xml
|
| Category: |
dropped
|
| Dump: |
rule68027v0.xml.3.dr
|
| ID: |
dr_696
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.068085244975721
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdfKFaE3mderBjNlVA69JXBQ9UQ9nIdVYXOI0Xk4xP/AQ2LENO2su:2dCgnorjPjgkGXAXRJN7
|
| Size: |
846
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68028v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68028v0.xml
|
| Category: |
dropped
|
| Dump: |
rule68028v0.xml.3.dr
|
| ID: |
dr_698
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.219838188914371
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdb6zLXsVaE3mderSlVA6n+NHARdNO2su:2dbw8wnorSPP
|
| Size: |
565
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68029v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68029v2.xml
|
| Category: |
dropped
|
| Dump: |
rule68029v2.xml.3.dr
|
| ID: |
dr_700
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.972530512945299
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dzp6srnorIJPjYtY1rDT4EsN+WsawSplzAfrkfLIkoI/NXr9ZYgaCgQ:czAsrouYaEEsLsUygZ08F
|
| Size: |
1890
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68030v6.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68030v6.xml
|
| Category: |
dropped
|
| Dump: |
rule68030v6.xml.3.dr
|
| ID: |
dr_703
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.975784164850255
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdJWP7aEPAQXerzJX8X/Q9Pp95i2YL2i2q4U/vvd+xU3Nea9uz9EjlPn6d+sbl:2dQW9rtHDM2Do/t+ubkaY+UEBn5D5e
|
| Size: |
1226
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68031v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68031v0.xml
|
| Category: |
dropped
|
| Dump: |
rule68031v0.xml.3.dr
|
| ID: |
dr_704
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.038541124472883
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdM31A9aEPAQXerkMXdcnU+dywlfMxdV23N1x3rQ/vArydf+mNO2su:2dgz9rkMXG1lkrI1xWEiG2
|
| Size: |
872
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68038v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68038v0.xml
|
| Category: |
dropped
|
| Dump: |
rule68038v0.xml.3.dr
|
| ID: |
dr_706
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.193617198634289
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBdPk6+XnaTq3HwBUuNtEz3CHperhNlNkGVlrt3+u6B+Y9NOn2sby:TMHd32LaEUerHRJ3SNO2su
|
| Size: |
404
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68039v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68039v1.xml
|
| Category: |
dropped
|
| Dump: |
rule68039v1.xml.3.dr
|
| ID: |
dr_708
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.081308824120238
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdIMtaEUerQQzUKJkTfxdL83Q9J3SsMZ/GNO2su:2dcArQ5KJq3L
|
| Size: |
710
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68040v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule68040v0.xml
|
| Category: |
dropped
|
| Dump: |
rule68040v0.xml.3.dr
|
| ID: |
dr_710
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.192045537661589
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBdpmk6+X64TTq3HwBUuNtEz3CHperh6klrzVlrYwla6N2y+F/E2yns9nnqsVK:TMHdI4yaEUerEQzUKJkTfx9J3SNO2su
|
| Size: |
528
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule69600v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule69600v1.xml
|
| Category: |
dropped
|
| Dump: |
rule69600v1.xml.3.dr
|
| ID: |
dr_712
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.883093524019439
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdN9WNWd4wdX5XQGl4AQXerieryyDKW8/K1lVzH4dLjAuaM9bb8OKX/c//fpOy:2dNdXxzrVruGP4evA
|
| Size: |
1042
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700000v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700000v2.xml
|
| Category: |
dropped
|
| Dump: |
rule700000v2.xml.3.dr
|
| ID: |
dr_714
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.6287467149993144
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9M4DUubtFboHnS3BNjXMi+EsdnKE+2h6wl/FfQaH:cucUubtuHqNjXMzbdKshBdIaH
|
| Size: |
1703
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700001v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700001v2.xml
|
| Category: |
dropped
|
| Dump: |
rule700001v2.xml.3.dr
|
| ID: |
dr_716
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.664826904180416
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9uO8DUu3tFboHnS3BNjXMi+EsdnKE+2h6wl/FfQaH:chwUu3tuHqNjXMzbdKshBdIaH
|
| Size: |
1740
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70002v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70002v3.xml
|
| Category: |
dropped
|
| Dump: |
rule70002v3.xml.3.dr
|
| ID: |
dr_718
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.168891686759475
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd9pvhC4FDR6AfVX4zIVlVlr/662N9pzKe/eWhz:2d9ppC0DR68X4zUPln+Fbhz
|
| Size: |
544
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70003v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70003v3.xml
|
| Category: |
dropped
|
| Dump: |
rule70003v3.xml.3.dr
|
| ID: |
dr_720
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.290151700409384
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd9k74kFaSJB8TtiaADIW7J6nAfB6X4zIi8jxPVCIeIse/Ly5sby:TMHd9qS6C4FDR6AfB6X4zIVlVlr/mz
|
| Size: |
392
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700050v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700050v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700050v1.xml.3.dr
|
| ID: |
dr_723
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.856062142751853
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9Y/DvBuMt1k3BNjXMi+EsdnKE+2h6wl/FfxvDb0w9:c2bvBuMteNjXMzbdKshBdpr
|
| Size: |
1351
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700051v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700051v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700051v1.xml.3.dr
|
| ID: |
dr_724
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.892406151495341
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9DNDvBuct1k3BNjXMi+EsdnKE+2h6wl/FfxvDb0w9:cxNvBucteNjXMzbdKshBdpr
|
| Size: |
1388
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70006v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70006v1.xml
|
| Category: |
dropped
|
| Dump: |
rule70006v1.xml.3.dr
|
| ID: |
dr_726
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.344372098215696
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd9SpAxhC4FDR6A3AQDvX4zIVlVlr/mz:2d9X7C0DR6YX4zUPlSz
|
| Size: |
430
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700100v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700100v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700100v1.xml.3.dr
|
| ID: |
dr_728
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8523209999839665
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9SQ0DbuMt1k3BNjXMi+EsdnKE+2h6wl/Ffu0HL:cg9buMteNjXMzbdKshBdR
|
| Size: |
1357
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700101v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700101v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700101v1.xml.3.dr
|
| ID: |
dr_731
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.887564911417507
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9dnDbuct1k3BNjXMi+EsdnKE+2h6wl/Ffu0HL:crDbucteNjXMzbdKshBdR
|
| Size: |
1394
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700150v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700150v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700150v1.xml.3.dr
|
| ID: |
dr_734
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.844205264305739
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9nODuuMt1k3BNjXMi+EsdnKE+2h6wl/Ff3Jo:cd+uuMteNjXMzbdKshBdho
|
| Size: |
1361
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700151v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700151v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700151v1.xml.3.dr
|
| ID: |
dr_737
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.881230354145236
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9cWDuuct1k3BNjXMi+EsdnKE+2h6wl/Ff3Jo:cSGuucteNjXMzbdKshBdho
|
| Size: |
1398
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700200v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700200v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700200v1.xml.3.dr
|
| ID: |
dr_740
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.857330168861428
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9TGD+uMt1k3BNjXMi+EsdnKE+2h6wl/Ffo5ex:clW+uMteNjXMzbdKshBdoex
|
| Size: |
1355
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700201v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700201v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700201v1.xml.3.dr
|
| ID: |
dr_743
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.893667139355208
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9o+D+uct1k3BNjXMi+EsdnKE+2h6wl/Ffo5ex:caO+ucteNjXMzbdKshBdoex
|
| Size: |
1392
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700250v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700250v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700250v1.xml.3.dr
|
| ID: |
dr_746
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.853300327219875
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9+12DOuMt1k3BNjXMi+EsdnKE+2h6wl/FfAUB7FPEl:cg1mOuMteNjXMzbdKshBdoUZVEl
|
| Size: |
1357
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700251v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700251v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700251v1.xml.3.dr
|
| ID: |
dr_753
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.888371445584959
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9B8JDOuct1k3BNjXMi+EsdnKE+2h6wl/FfAUB7FPEl:cz8ZOucteNjXMzbdKshBdoUZVEl
|
| Size: |
1394
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70025v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70025v2.xml
|
| Category: |
dropped
|
| Dump: |
rule70025v2.xml.3.dr
|
| ID: |
dr_754
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.110156923652016
|
| Encrypted: |
false
|
| Ssdeep: |
48:c9zR6+LX40X4tX4tX4DX4Un5Ktas8qL95a7e9KYD:cJLXbX6XqXMXoND
|
| Size: |
2891
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70027v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70027v1.xml
|
| Category: |
dropped
|
| Dump: |
rule70027v1.xml.3.dr
|
| ID: |
dr_756
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.281064369241398
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd9nUC4FDR6ArBqX4zIVlVZ6nw/AIQQz:2d9UC0DR6mqX4zUPkQz
|
| Size: |
517
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70028v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70028v0.xml
|
| Category: |
dropped
|
| Dump: |
rule70028v0.xml.3.dr
|
| ID: |
dr_758
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.232421524842378
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd9ko4C4FDR6A3AQ+u4X4zIRVY2HUA82HhIdLLyVhdy9LzX+e/VeX+kdVYLxxS:2d9ko4C0DR6e4X4zT2W2Bk/Mi6e1ouez
|
| Size: |
871
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70029v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70029v0.xml
|
| Category: |
dropped
|
| Dump: |
rule70029v0.xml.3.dr
|
| ID: |
dr_761
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.284513748763277
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd91oUnCC4FDR6A3AQ+mX4zI3szGwMdLLzX+e/VeX+kdy9UpX+e/UEpX+4z:2d92iCC0DR6WX4zsMzw/6e1ohceMEc4z
|
| Size: |
670
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700300v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700300v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700300v1.xml.3.dr
|
| ID: |
dr_764
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.868166210989903
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9ojSDCuMt1k3BNjXMi+EsdnKE+2h6wl/Ff/T/:cGjyCuMteNjXMzbdKshBd3T/
|
| Size: |
1363
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700301v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700301v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700301v1.xml.3.dr
|
| ID: |
dr_767
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.9029116128103984
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d97gJDCuct1k3BNjXMi+EsdnKE+2h6wl/Ff/T/:cNgZCucteNjXMzbdKshBd3T/
|
| Size: |
1400
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70030v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70030v0.xml
|
| Category: |
dropped
|
| Dump: |
rule70030v0.xml.3.dr
|
| ID: |
dr_770
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.441976209389148
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd90erLyC4FDR6A3AQi9YX4zI3s0dWNAuXyz:2d9nyC0DR69YX4zsVWAz
|
| Size: |
437
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70031v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70031v0.xml
|
| Category: |
dropped
|
| Dump: |
rule70031v0.xml.3.dr
|
| ID: |
dr_773
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.389638807153727
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd9dd2ATaBC4FDR6A3AQiBsX4zIVlVZmz:2d9+DC0DR6BsX4zUPkz
|
| Size: |
440
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700350v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700350v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700350v1.xml.3.dr
|
| ID: |
dr_776
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.854268399216
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9LR7DduMt1k3BNjXMi+EsdnKE+2h6wl/FfIIqx:cVRHduMteNjXMzbdKshBdox
|
| Size: |
1359
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700351v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700351v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700351v1.xml.3.dr
|
| ID: |
dr_5
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.889160946895956
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9sDIODduct1k3BNjXMi+EsdnKE+2h6wl/FfIIqx:cMI+ducteNjXMzbdKshBdox
|
| Size: |
1396
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70036v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70036v0.xml
|
| Category: |
dropped
|
| Dump: |
rule70036v0.xml.3.dr
|
| ID: |
dr_7
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.367348644606108
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd9MlAAyC4FDR6A3AQiQvX4zI/JvFKtz:2d9MllyC0DR6QvX4zmFQz
|
| Size: |
419
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70037v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70037v1.xml
|
| Category: |
dropped
|
| Dump: |
rule70037v1.xml.3.dr
|
| ID: |
dr_8
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.351360933657103
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd9BPC4FDR6A3AQzxKX4zIRBLqh3yh4Qz:2d9BPC0DR6jX4zOoQz
|
| Size: |
439
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700400v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700400v2.xml
|
| Category: |
dropped
|
| Dump: |
rule700400v2.xml.3.dr
|
| ID: |
dr_9
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8496747496264785
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9QyijDGipuMt1k3BNjXMi+EsdnKE+2h6wl/Ffklwz:cSyUGYuMteNjXMzbdKshBdpz
|
| Size: |
1365
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700401v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700401v2.xml
|
| Category: |
dropped
|
| Dump: |
rule700401v2.xml.3.dr
|
| ID: |
dr_10
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.884832595325388
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9zykDGipuct1k3BNjXMi+EsdnKE+2h6wl/Ffklwz:cFy4GYucteNjXMzbdKshBdpz
|
| Size: |
1402
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700450v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700450v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700450v1.xml.3.dr
|
| ID: |
dr_11
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.852626468622731
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9EFDMYBuMt1k3BNjXMi+EsdnKE+2h6wl/FfUq/VU:cSlTuMteNjXMzbdKshBd8qNU
|
| Size: |
1355
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700451v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700451v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700451v1.xml.3.dr
|
| ID: |
dr_12
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.888202547105148
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9tRfDMYBuct1k3BNjXMi+EsdnKE+2h6wl/FfUq/VU:cd7TucteNjXMzbdKshBd8qNU
|
| Size: |
1392
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700500v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700500v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700500v1.xml.3.dr
|
| ID: |
dr_13
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.871520531670135
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9YVVDthDBTuMt1k3BNjXMi+EsdnKE+2h6wl/FfiV:cOFtRBTuMteNjXMzbdKshBd0
|
| Size: |
1367
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700501v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700501v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700501v1.xml.3.dr
|
| ID: |
dr_14
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.905620042369503
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9YV6BDBTuct1k3BNjXMi+EsdnKE+2h6wl/FfiV:cO6xBTucteNjXMzbdKshBd0
|
| Size: |
1404
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700550v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700550v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700550v1.xml.3.dr
|
| ID: |
dr_15
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.851683930128282
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9YenNDRhuMt1k3BNjXMi+EsdnKE+2h6wl/Ff0U3Xj:c5nNRhuMteNjXMzbdKshBdMoXj
|
| Size: |
1355
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700551v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700551v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700551v1.xml.3.dr
|
| ID: |
dr_17
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.886909274939712
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9YZXDRhuct1k3BNjXMi+EsdnKE+2h6wl/Ff0U3Xj:c+TRhucteNjXMzbdKshBdMoXj
|
| Size: |
1392
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700600v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700600v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700600v1.xml.3.dr
|
| ID: |
dr_18
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.865619885875738
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d93PDpuMt1k3BNjXMi+EsdnKE+2h6wl/FfcnHAvy:cJLpuMteNjXMzbdKshBdEgvy
|
| Size: |
1363
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700601v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700601v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700601v1.xml.3.dr
|
| ID: |
dr_19
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.897158029594799
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9sdDpuct1k3BNjXMi+EsdnKE+2h6wl/FfcnHAvy:cO9pucteNjXMzbdKshBdEgvy
|
| Size: |
1400
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700650v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700650v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700650v1.xml.3.dr
|
| ID: |
dr_20
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.852747306474377
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9ihDvuMt1k3BNjXMi+EsdnKE+2h6wl/FfI9:c0RvuMteNjXMzbdKshBdS
|
| Size: |
1361
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700651v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700651v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700651v1.xml.3.dr
|
| ID: |
dr_21
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.887736207218883
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9trDvuct1k3BNjXMi+EsdnKE+2h6wl/FfI9:c/XvucteNjXMzbdKshBdS
|
| Size: |
1398
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700700v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700700v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700700v1.xml.3.dr
|
| ID: |
dr_22
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8587705708675815
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9KRADB2uMt1k3BNjXMi+EsdnKE+2h6wl/FfmCUenT:c2EkuMteNjXMzbdKshBd+CUenT
|
| Size: |
1363
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700701v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700701v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700701v1.xml.3.dr
|
| ID: |
dr_23
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.894341017418388
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9/0DB2uct1k3BNjXMi+EsdnKE+2h6wl/FfmCUenT:cxokucteNjXMzbdKshBd+CUenT
|
| Size: |
1400
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700750v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700750v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700750v1.xml.3.dr
|
| ID: |
dr_24
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.889868179029986
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9JzVKUDXRTuMt1k3BNjXMi+EsdnKE+2h6wl/FfMgeD:cDzVRXRTuMteNjXMzbdKshBdEgeD
|
| Size: |
1376
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700751v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700751v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700751v1.xml.3.dr
|
| ID: |
dr_25
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.924333853581855
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9OzJDXRTuct1k3BNjXMi+EsdnKE+2h6wl/FfMgeD:cYzZXRTucteNjXMzbdKshBdEgeD
|
| Size: |
1413
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700850v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700850v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700850v1.xml.3.dr
|
| ID: |
dr_34
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.871091054185326
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9I1wjDcpuMt1k3BNjXMi+EsdnKE+2h6wl/FfrfXU:c+wPcpuMteNjXMzbdKshBdjfE
|
| Size: |
1377
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700851v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700851v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700851v1.xml.3.dr
|
| ID: |
dr_36
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.904142181625683
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9reDcpuct1k3BNjXMi+EsdnKE+2h6wl/FfrfXU:c5ucpucteNjXMzbdKshBdjfE
|
| Size: |
1414
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700900v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700900v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700900v1.xml.3.dr
|
| ID: |
dr_38
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.864243128033522
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d96hD4uMt1k3BNjXMi+EsdnKE+2h6wl/FfBMYw9:cIR4uMteNjXMzbdKshBdZFS
|
| Size: |
1370
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700901v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700901v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700901v1.xml.3.dr
|
| ID: |
dr_39
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.898680122194441
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9EQrD4uct1k3BNjXMi+EsdnKE+2h6wl/FfBMYw9:cmQX4ucteNjXMzbdKshBdZFS
|
| Size: |
1407
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700950v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700950v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700950v1.xml.3.dr
|
| ID: |
dr_40
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.870003164588434
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9PQUD2uMt1k3BNjXMi+EsdnKE+2h6wl/FfpNZ17B:clv2uMteNjXMzbdKshBdRNZ1l
|
| Size: |
1368
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700951v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule700951v1.xml
|
| Category: |
dropped
|
| Dump: |
rule700951v1.xml.3.dr
|
| ID: |
dr_41
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.903878162573853
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9EQYD2uct1k3BNjXMi+EsdnKE+2h6wl/FfpNZ17B:cah2ucteNjXMzbdKshBdRNZ1l
|
| Size: |
1405
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701050v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701050v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701050v1.xml.3.dr
|
| ID: |
dr_42
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.848504126163618
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9rFTDluMt1k3BNjXMi+EsdnKE+2h6wl/FfcFE0Q8:chFfluMteNjXMzbdKshBdEw8
|
| Size: |
1361
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701051v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701051v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701051v1.xml.3.dr
|
| ID: |
dr_43
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8838124424443485
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9r6hDluct1k3BNjXMi+EsdnKE+2h6wl/FfcFE0Q8:ch6RlucteNjXMzbdKshBdEw8
|
| Size: |
1398
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701100v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701100v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701100v1.xml.3.dr
|
| ID: |
dr_44
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.870676852445164
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9H6DiuMt1k3BNjXMi+EsdnKE+2h6wl/Ffb/R6:c1aiuMteNjXMzbdKshBdbR6
|
| Size: |
1373
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701101v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701101v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701101v1.xml.3.dr
|
| ID: |
dr_45
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.9032649064965685
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d98CDiuct1k3BNjXMi+EsdnKE+2h6wl/Ffb/R6:cqCiucteNjXMzbdKshBdbR6
|
| Size: |
1410
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701150v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701150v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701150v1.xml.3.dr
|
| ID: |
dr_60
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.859493863374326
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9yRDrouMt1k3BNjXMi+EsdnKE+2h6wl/Ffrk:cYhrouMteNjXMzbdKshBd4
|
| Size: |
1363
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701151v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701151v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701151v1.xml.3.dr
|
| ID: |
dr_63
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8949038661110205
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d99bDrouct1k3BNjXMi+EsdnKE+2h6wl/Ffrk:cDnroucteNjXMzbdKshBd4
|
| Size: |
1400
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701200v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701200v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701200v1.xml.3.dr
|
| ID: |
dr_66
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.859306526630754
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9WuS0DguMt1k3BNjXMi+EsdnKE+2h6wl/FflwrkaMp:cwuPguMteNjXMzbdKshBdNMk
|
| Size: |
1355
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701201v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701201v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701201v1.xml.3.dr
|
| ID: |
dr_68
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.894375938062735
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9RgDguct1k3BNjXMi+EsdnKE+2h6wl/FflwrkaMp:c7kgucteNjXMzbdKshBdNMk
|
| Size: |
1392
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701250v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701250v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701250v1.xml.3.dr
|
| ID: |
dr_69
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.852145737506613
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9jxE7DVOuMt1k3BNjXMi+EsdnKE+2h6wl/Ff/Fv:ctaHEuMteNjXMzbdKshBd1
|
| Size: |
1357
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701251v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701251v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701251v1.xml.3.dr
|
| ID: |
dr_70
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.887592597470845
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d94xCDVOuct1k3BNjXMi+EsdnKE+2h6wl/Ff/Fv:ciIEucteNjXMzbdKshBd1
|
| Size: |
1394
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701300v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701300v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701300v1.xml.3.dr
|
| ID: |
dr_71
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.853574157223617
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9puD+uMt1k3BNjXMi+EsdnKE+2h6wl/FfF5Mvj8+9:cTe+uMteNjXMzbdKshBd4jN
|
| Size: |
1365
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701301v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701301v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701301v1.xml.3.dr
|
| ID: |
dr_72
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.888179763188237
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9u0JD+uct1k3BNjXMi+EsdnKE+2h6wl/FfF5Mvj8+9:co0Z+ucteNjXMzbdKshBd4jN
|
| Size: |
1402
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701350v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701350v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701350v1.xml.3.dr
|
| ID: |
dr_73
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.862955605597379
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9UEDAuMt1k3BNjXMi+EsdnKE+2h6wl/FfFUZC:cGYAuMteNjXMzbdKshBd9T
|
| Size: |
1369
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701351v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701351v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701351v1.xml.3.dr
|
| ID: |
dr_82
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8974766228830156
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9fIDAuct1k3BNjXMi+EsdnKE+2h6wl/FfFUZC:cBMAucteNjXMzbdKshBd9T
|
| Size: |
1406
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701400v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701400v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701400v1.xml.3.dr
|
| ID: |
dr_85
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.859497537258701
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9AF7DPuMt1k3BNjXMi+EsdnKE+2h6wl/FfSoiD:cG5PuMteNjXMzbdKshBdqoiD
|
| Size: |
1363
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701401v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701401v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701401v1.xml.3.dr
|
| ID: |
dr_88
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.895259032059607
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9d1F5DPuct1k3BNjXMi+EsdnKE+2h6wl/FfSoiD:cBvPucteNjXMzbdKshBdqoiD
|
| Size: |
1400
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701500v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701500v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701500v1.xml.3.dr
|
| ID: |
dr_91
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.851189495849424
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9jsD4uMt1k3BNjXMi+EsdnKE+2h6wl/FfZl94dl:cZA4uMteNjXMzbdKshBdlWl
|
| Size: |
1363
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701501v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701501v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701501v1.xml.3.dr
|
| ID: |
dr_93
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.885644101734657
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d94gD4uct1k3BNjXMi+EsdnKE+2h6wl/FfZl94dl:cek4ucteNjXMzbdKshBdlWl
|
| Size: |
1400
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701550v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701550v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701550v1.xml.3.dr
|
| ID: |
dr_95
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.867050300290955
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9WEBDY5BuMt1k3BNjXMi+EsdnKE+2h6wl/FfdNG:cEExY5BuMteNjXMzbdKshBdrG
|
| Size: |
1367
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701551v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701551v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701551v1.xml.3.dr
|
| ID: |
dr_97
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.901397951222752
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9RELDY5Buct1k3BNjXMi+EsdnKE+2h6wl/FfdNG:cPE3Y5BucteNjXMzbdKshBdrG
|
| Size: |
1404
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701650v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701650v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701650v1.xml.3.dr
|
| ID: |
dr_99
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.87143922286121
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d93AcqUDcczuMt1k3BNjXMi+EsdnKE+2h6wl/FfbWd:cJA3IcEuMteNjXMzbdKshBdzu
|
| Size: |
1371
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701651v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701651v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701651v1.xml.3.dr
|
| ID: |
dr_101
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.9044836874199635
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d90jAcLDcczuct1k3BNjXMi+EsdnKE+2h6wl/FfbWd:cOAscEucteNjXMzbdKshBdzu
|
| Size: |
1408
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701700v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701700v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701700v1.xml.3.dr
|
| ID: |
dr_110
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.869280310390715
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9FC8fDW8NuMt1k3BNjXMi+EsdnKE+2h6wl/FfiyO:c3n9uMteNjXMzbdKshBd6yO
|
| Size: |
1385
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701701v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701701v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701701v1.xml.3.dr
|
| ID: |
dr_112
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.901909400554976
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d96C8tDW8Nuct1k3BNjXMi+EsdnKE+2h6wl/FfiyO:csJ9ucteNjXMzbdKshBd6yO
|
| Size: |
1422
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701750v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701750v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701750v1.xml.3.dr
|
| ID: |
dr_115
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.855593221051942
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9o4D52uMt1k3BNjXMi+EsdnKE+2h6wl/FfiDR6j9:cic52uMteNjXMzbdKshBdoR6J
|
| Size: |
1363
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701751v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701751v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701751v1.xml.3.dr
|
| ID: |
dr_118
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.889762408334574
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9T8D52uct1k3BNjXMi+EsdnKE+2h6wl/FfiDR6j9:ctw52ucteNjXMzbdKshBdoR6J
|
| Size: |
1400
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701800v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701800v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701800v1.xml.3.dr
|
| ID: |
dr_121
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.861678713883639
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9MISDtuMt1k3BNjXMi+EsdnKE+2h6wl/FfH3/j+:c6IytuMteNjXMzbdKshBdy
|
| Size: |
1365
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701801v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701801v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701801v1.xml.3.dr
|
| ID: |
dr_124
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8964391267970955
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9XIKDtuct1k3BNjXMi+EsdnKE+2h6wl/FfH3/j+:cFIKtucteNjXMzbdKshBdy
|
| Size: |
1402
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701850v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701850v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701850v1.xml.3.dr
|
| ID: |
dr_126
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.863237258346602
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9zFbD0auMt1k3BNjXMi+EsdnKE+2h6wl/FfnSip:cPn0auMteNjXMzbdKshBd/SU
|
| Size: |
1370
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701851v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701851v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701851v1.xml.3.dr
|
| ID: |
dr_128
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.897385308857073
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9z6ZD0auct1k3BNjXMi+EsdnKE+2h6wl/FfnSip:cEJ0aucteNjXMzbdKshBd/SU
|
| Size: |
1407
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701900v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701900v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701900v1.xml.3.dr
|
| ID: |
dr_130
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.856329203731458
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9vKDiuMt1k3BNjXMi+EsdnKE+2h6wl/FfYmlBu:cdKiuMteNjXMzbdKshBd9Bu
|
| Size: |
1369
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701901v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701901v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701901v1.xml.3.dr
|
| ID: |
dr_132
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.889929045928819
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9zQSDiuct1k3BNjXMi+EsdnKE+2h6wl/FfYmlBu:cNQyiucteNjXMzbdKshBd9Bu
|
| Size: |
1406
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701950v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701950v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701950v1.xml.3.dr
|
| ID: |
dr_141
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.877346383504526
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d90HjTDuXCuMt1k3BNjXMi+EsdnKE+2h6wl/FfAC9:c4jfluMteNjXMzbdKshBdYM
|
| Size: |
1379
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701951v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule701951v1.xml
|
| Category: |
dropped
|
| Dump: |
rule701951v1.xml.3.dr
|
| ID: |
dr_142
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.910169708231961
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9lhDuXCuct1k3BNjXMi+EsdnKE+2h6wl/FfAC9:crRlucteNjXMzbdKshBdYM
|
| Size: |
1416
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702000v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702000v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702000v1.xml.3.dr
|
| ID: |
dr_145
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.847219471844708
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d97eDeuMt1k3BNjXMi+EsdnKE+2h6wl/FfIz:cdueuMteNjXMzbdKshBdQz
|
| Size: |
1359
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702001v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702001v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702001v1.xml.3.dr
|
| ID: |
dr_148
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.883161848414622
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9wmDeuct1k3BNjXMi+EsdnKE+2h6wl/FfIz:cS2eucteNjXMzbdKshBdQz
|
| Size: |
1396
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702050v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702050v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702050v1.xml.3.dr
|
| ID: |
dr_151
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.869360909608632
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9u3DBuMt1k3BNjXMi+EsdnKE+2h6wl/FfZdXxF:cgzBuMteNjXMzbdKshBdv
|
| Size: |
1363
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702051v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702051v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702051v1.xml.3.dr
|
| ID: |
dr_154
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.903756644188613
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9pV/DBuct1k3BNjXMi+EsdnKE+2h6wl/FfZdXxF:crVBucteNjXMzbdKshBdv
|
| Size: |
1400
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702100v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702100v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702100v1.xml.3.dr
|
| ID: |
dr_157
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8734818259143164
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d941DVhuMt1k3BNjXMi+EsdnKE+2h6wl/Ff4N2l:c613uMteNjXMzbdKshBd7
|
| Size: |
1370
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702101v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702101v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702101v1.xml.3.dr
|
| ID: |
dr_159
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.907864691504703
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9jPDVhuct1k3BNjXMi+EsdnKE+2h6wl/Ff4N2l:cFL3ucteNjXMzbdKshBd7
|
| Size: |
1407
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702150v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702150v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702150v1.xml.3.dr
|
| ID: |
dr_161
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8484339473244455
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9V1jDRpuMt1k3BNjXMi+EsdnKE+2h6wl/FfvnrQc:cP1PRpuMteNjXMzbdKshBdXL
|
| Size: |
1359
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702151v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702151v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702151v1.xml.3.dr
|
| ID: |
dr_163
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.883223789400444
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9K1JDRpuct1k3BNjXMi+EsdnKE+2h6wl/FfvnrQc:cE1ZRpucteNjXMzbdKshBdXL
|
| Size: |
1396
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702200v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702200v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702200v1.xml.3.dr
|
| ID: |
dr_173
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8521344178314765
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d99XDpuMt1k3BNjXMi+EsdnKE+2h6wl/FfiNH:cbTpuMteNjXMzbdKshBdaNH
|
| Size: |
1359
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702201v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702201v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702201v1.xml.3.dr
|
| ID: |
dr_174
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.888051950170804
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9y1Dpuct1k3BNjXMi+EsdnKE+2h6wl/FfiNH:cQ1pucteNjXMzbdKshBdaNH
|
| Size: |
1396
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702250v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702250v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702250v1.xml.3.dr
|
| ID: |
dr_176
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8450235834940685
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9A7DluMt1k3BNjXMi+EsdnKE+2h6wl/FfGz:cOHluMteNjXMzbdKshBdez
|
| Size: |
1351
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702251v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702251v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702251v1.xml.3.dr
|
| ID: |
dr_178
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.882059181952758
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9vjqeDluct1k3BNjXMi+EsdnKE+2h6wl/FfGz:cJqulucteNjXMzbdKshBdez
|
| Size: |
1388
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702300v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702300v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702300v1.xml.3.dr
|
| ID: |
dr_181
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8575454867833265
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9aLDVuMt1k3BNjXMi+EsdnKE+2h6wl/Ff3:cY3VuMteNjXMzbdKshBdv
|
| Size: |
1361
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702301v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702301v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702301v1.xml.3.dr
|
| ID: |
dr_184
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.891463643270291
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9lJDVuct1k3BNjXMi+EsdnKE+2h6wl/Ff3:cDZVucteNjXMzbdKshBdv
|
| Size: |
1398
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702350v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702350v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702350v1.xml.3.dr
|
| ID: |
dr_187
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.860956043026469
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9v8DguMt1k3BNjXMi+EsdnKE+2h6wl/FfmS8ec:c1wguMteNjXMzbdKshBdOL
|
| Size: |
1357
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702351v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702351v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702351v1.xml.3.dr
|
| ID: |
dr_190
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.896099533418246
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9k1wDguct1k3BNjXMi+EsdnKE+2h6wl/FfmS8ec:cK1UgucteNjXMzbdKshBdOL
|
| Size: |
1394
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702400v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702400v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702400v1.xml.3.dr
|
| ID: |
dr_192
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8601857535171655
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9/XNDGEXuMt1k3BNjXMi+EsdnKE+2h6wl/FfOnEc:ch9juMteNjXMzbdKshBdML
|
| Size: |
1367
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702401v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702401v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702401v1.xml.3.dr
|
| ID: |
dr_194
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.89369333887998
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d90XXDGEXuct1k3BNjXMi+EsdnKE+2h6wl/FfOnEc:cmDjucteNjXMzbdKshBdML
|
| Size: |
1404
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702450v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702450v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702450v1.xml.3.dr
|
| ID: |
dr_205
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.857265439256473
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9qEDAuMt1k3BNjXMi+EsdnKE+2h6wl/FfsQkRc8z:cMYAuMteNjXMzbdKshBd5kRcC
|
| Size: |
1359
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702451v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702451v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702451v1.xml.3.dr
|
| ID: |
dr_206
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.891847134561355
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d91IDAuct1k3BNjXMi+EsdnKE+2h6wl/FfsQkRc8z:cXMAucteNjXMzbdKshBd5kRcC
|
| Size: |
1396
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702500v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702500v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702500v1.xml.3.dr
|
| ID: |
dr_208
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.874186173241039
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9chD/uMt1k3BNjXMi+EsdnKE+2h6wl/FfiGS9:cOR/uMteNjXMzbdKshBdPc
|
| Size: |
1377
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702501v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702501v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702501v1.xml.3.dr
|
| ID: |
dr_210
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.905863048995714
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9nrD/uct1k3BNjXMi+EsdnKE+2h6wl/FfiGS9:cJX/ucteNjXMzbdKshBdPc
|
| Size: |
1414
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702550v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702550v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702550v1.xml.3.dr
|
| ID: |
dr_213
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.86968935598947
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9Jj0jDApuMt1k3BNjXMi+EsdnKE+2h6wl/FfeX4WGVSH:cfj0PApuMteNjXMzbdKshBd17Q
|
| Size: |
1377
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702551v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702551v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702551v1.xml.3.dr
|
| ID: |
dr_216
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.901920052386891
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d92CDApuct1k3BNjXMi+EsdnKE+2h6wl/FfeX4WGVSH:cQCApucteNjXMzbdKshBd17Q
|
| Size: |
1414
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702600v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702600v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702600v1.xml.3.dr
|
| ID: |
dr_220
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.865695804192339
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9BjDFuMt1k3BNjXMi+EsdnKE+2h6wl/FftI:cfPFuMteNjXMzbdKshBde
|
| Size: |
1371
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702601v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702601v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702601v1.xml.3.dr
|
| ID: |
dr_224
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.899679787486778
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9GgODFuct1k3BNjXMi+EsdnKE+2h6wl/FftI:cUBFucteNjXMzbdKshBde
|
| Size: |
1408
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702650v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702650v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702650v1.xml.3.dr
|
| ID: |
dr_228
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.848587052076145
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9WFiDquMt1k3BNjXMi+EsdnKE+2h6wl/Ffo+p4i68:ccFiquMteNjXMzbdKshBdHpf
|
| Size: |
1357
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702651v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702651v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702651v1.xml.3.dr
|
| ID: |
dr_231
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.884966778735232
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9W6aDquct1k3BNjXMi+EsdnKE+2h6wl/Ffo+p4i68:cc66qucteNjXMzbdKshBdHpf
|
| Size: |
1394
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702700v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702700v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702700v1.xml.3.dr
|
| ID: |
dr_246
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8662369056062404
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9wrsuDpuMt1k3BNjXMi+EsdnKE+2h6wl/Ff8EcK:c8sepuMteNjXMzbdKshBdUED
|
| Size: |
1366
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702701v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702701v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702701v1.xml.3.dr
|
| ID: |
dr_248
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.901234050569788
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9wgs0JDpuct1k3BNjXMi+EsdnKE+2h6wl/Ff8EcK:cHs0ZpucteNjXMzbdKshBdUED
|
| Size: |
1403
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702750v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702750v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702750v1.xml.3.dr
|
| ID: |
dr_250
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.874109702881827
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9weSDKuMt1k3BNjXMi+EsdnKE+2h6wl/Ff1xs:cRyKuMteNjXMzbdKshBdg
|
| Size: |
1365
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702751v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702751v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702751v1.xml.3.dr
|
| ID: |
dr_252
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.907444238942649
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9wZzeDKuct1k3BNjXMi+EsdnKE+2h6wl/Ff1xs:cWKKucteNjXMzbdKshBdg
|
| Size: |
1402
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702800v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702800v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702800v1.xml.3.dr
|
| ID: |
dr_255
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.853435750554847
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9zXD5uMt1k3BNjXMi+EsdnKE+2h6wl/Ff1e9:c1T5uMteNjXMzbdKshBd9I
|
| Size: |
1353
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702801v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702801v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702801v1.xml.3.dr
|
| ID: |
dr_258
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.889693035476156
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9Aj1D5uct1k3BNjXMi+EsdnKE+2h6wl/Ff1e9:cq15ucteNjXMzbdKshBd9I
|
| Size: |
1390
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702850v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702850v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702850v1.xml.3.dr
|
| ID: |
dr_261
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.864270560319576
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9mVDfLuMt1k3BNjXMi+EsdnKE+2h6wl/Ffdd:cYVfLuMteNjXMzbdKshBdH
|
| Size: |
1367
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702851v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702851v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702851v1.xml.3.dr
|
| ID: |
dr_264
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.89890901835996
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d95D+ODfLuct1k3BNjXMi+EsdnKE+2h6wl/Ffdd:cnD++fLucteNjXMzbdKshBdH
|
| Size: |
1404
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702900v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702900v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702900v1.xml.3.dr
|
| ID: |
dr_268
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.866360064001697
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9QbCy3Dn5FuMt1k3BNjXMi+EsdnKE+2h6wl/FffkNH:cSbpnLuMteNjXMzbdKshBdOH
|
| Size: |
1373
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702901v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702901v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702901v1.xml.3.dr
|
| ID: |
dr_272
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.9005604200237975
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9uQbCyVDn5Fuct1k3BNjXMi+EsdnKE+2h6wl/FffkNH:ccQbfnLucteNjXMzbdKshBdOH
|
| Size: |
1410
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702950v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702950v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702950v1.xml.3.dr
|
| ID: |
dr_483
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.848792627939081
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9N92DJiuMt1k3BNjXMi+EsdnKE+2h6wl/Ff+8o:cn4QuMteNjXMzbdKshBdGN
|
| Size: |
1367
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702951v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule702951v1.xml
|
| Category: |
dropped
|
| Dump: |
rule702951v1.xml.3.dr
|
| ID: |
dr_484
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.884123808992733
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9S193eDJiuct1k3BNjXMi+EsdnKE+2h6wl/Ff+8o:ccZuQucteNjXMzbdKshBdGN
|
| Size: |
1404
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703000v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703000v1.xml
|
| Category: |
dropped
|
| Dump: |
rule703000v1.xml.3.dr
|
| ID: |
dr_485
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.860904905531245
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9K1zgDXcuMt1k3BNjXMi+EsdnKE+2h6wl/FfHWCE6:cMzkXcuMteNjXMzbdKshBd+CE6
|
| Size: |
1368
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703001v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703001v1.xml
|
| Category: |
dropped
|
| Dump: |
rule703001v1.xml.3.dr
|
| ID: |
dr_486
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.894903657691117
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d91zUDXcuct1k3BNjXMi+EsdnKE+2h6wl/FfHWCE6:cXzIXcucteNjXMzbdKshBd+CE6
|
| Size: |
1405
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703050v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703050v3.xml
|
| Category: |
dropped
|
| Dump: |
rule703050v3.xml.3.dr
|
| ID: |
dr_487
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.890103420426988
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9r18DEuMt1k3BNjXMi+EsdnKE+2h6wl/FfG0El:cHwEuMteNjXMzbdKshBdTC
|
| Size: |
1390
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703051v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703051v3.xml
|
| Category: |
dropped
|
| Dump: |
rule703051v3.xml.3.dr
|
| ID: |
dr_488
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.922148272354155
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d901wDEuct1k3BNjXMi+EsdnKE+2h6wl/FfG0El:cMUEucteNjXMzbdKshBdTC
|
| Size: |
1427
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703100v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703100v1.xml
|
| Category: |
dropped
|
| Dump: |
rule703100v1.xml.3.dr
|
| ID: |
dr_489
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.838395899121383
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9NZDfuMt1k3BNjXMi+EsdnKE+2h6wl/FfAzgmEc:cvJfuMteNjXMzbdKshBdIUmL
|
| Size: |
1355
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703101v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703101v1.xml
|
| Category: |
dropped
|
| Dump: |
rule703101v1.xml.3.dr
|
| ID: |
dr_490
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.874935439748928
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9CzDfuct1k3BNjXMi+EsdnKE+2h6wl/FfAzgmEc:ck/fucteNjXMzbdKshBdIUmL
|
| Size: |
1392
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703150v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703150v1.xml
|
| Category: |
dropped
|
| Dump: |
rule703150v1.xml.3.dr
|
| ID: |
dr_491
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.866844555220709
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9+RPjD7puMt1k3BNjXMi+EsdnKE+2h6wl/FfVQ1o:cYRPP7puMteNjXMzbdKshBdG1o
|
| Size: |
1373
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703151v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703151v1.xml
|
| Category: |
dropped
|
| Dump: |
rule703151v1.xml.3.dr
|
| ID: |
dr_492
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.898899268686255
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9bpD7puct1k3BNjXMi+EsdnKE+2h6wl/FfVQ1o:cl57pucteNjXMzbdKshBdG1o
|
| Size: |
1410
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703200v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703200v1.xml
|
| Category: |
dropped
|
| Dump: |
rule703200v1.xml.3.dr
|
| ID: |
dr_493
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8754299888628925
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9IUUDpuMt1k3BNjXMi+EsdnKE+2h6wl/Ffj9G:cejpuMteNjXMzbdKshBdw
|
| Size: |
1361
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703201v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703201v1.xml
|
| Category: |
dropped
|
| Dump: |
rule703201v1.xml.3.dr
|
| ID: |
dr_494
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.911190538820968
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9zlDpuct1k3BNjXMi+EsdnKE+2h6wl/Ffj9G:cZFpucteNjXMzbdKshBdw
|
| Size: |
1398
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703250v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703250v1.xml
|
| Category: |
dropped
|
| Dump: |
rule703250v1.xml.3.dr
|
| ID: |
dr_495
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.858209494900091
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d91DLD9uMt1k3BNjXMi+EsdnKE+2h6wl/Ff389Up:cr39uMteNjXMzbdKshBdP89K
|
| Size: |
1359
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703251v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703251v1.xml
|
| Category: |
dropped
|
| Dump: |
rule703251v1.xml.3.dr
|
| ID: |
dr_496
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8934439311342315
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9YRJD9uct1k3BNjXMi+EsdnKE+2h6wl/Ff389Up:cgZ9ucteNjXMzbdKshBdP89K
|
| Size: |
1396
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703300v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703300v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703300v0.xml.3.dr
|
| ID: |
dr_497
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.868924601340603
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d98rD0DcGguMt1k3BNjXMi+EsdnKE+2h6wl/FfiOW:cC4cDuMteNjXMzbdKshBdaOW
|
| Size: |
1381
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703301v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703301v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703301v0.xml.3.dr
|
| ID: |
dr_498
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.902831236582554
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9PrcDcGguct1k3BNjXMi+EsdnKE+2h6wl/FfiOW:cFscDucteNjXMzbdKshBdaOW
|
| Size: |
1418
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703350v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703350v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703350v0.xml.3.dr
|
| ID: |
dr_499
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.867179322734424
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9NwDohuMt1k3BNjXMi+EsdnKE+2h6wl/Ffssl:crUohuMteNjXMzbdKshBddl
|
| Size: |
1365
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703351v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703351v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703351v0.xml.3.dr
|
| ID: |
dr_500
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.901565760313767
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9KkDohuct1k3BNjXMi+EsdnKE+2h6wl/Ffssl:c44ohucteNjXMzbdKshBddl
|
| Size: |
1402
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703400v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703400v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703400v0.xml.3.dr
|
| ID: |
dr_501
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8898697870907935
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9NFD7uMt1k3BNjXMi+EsdnKE+2h6wl/FfbpZae:cXl7uMteNjXMzbdKshBdPZ
|
| Size: |
1387
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703401v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703401v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703401v0.xml.3.dr
|
| ID: |
dr_502
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.921719665185987
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9KfD7uct1k3BNjXMi+EsdnKE+2h6wl/FfbpZae:ck77ucteNjXMzbdKshBdPZ
|
| Size: |
1424
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703450v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703450v1.xml
|
| Category: |
dropped
|
| Dump: |
rule703450v1.xml.3.dr
|
| ID: |
dr_510
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.864841997755804
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9LxM7DuXRuMt1k3BNjXMi+EsdnKE+2h6wl/Ff6I8:cFxuQuMteNjXMzbdKshBdm
|
| Size: |
1371
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703451v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703451v1.xml
|
| Category: |
dropped
|
| Dump: |
rule703451v1.xml.3.dr
|
| ID: |
dr_512
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.89913278806516
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9AxM5DuXRuct1k3BNjXMi+EsdnKE+2h6wl/Ff6I8:c6x2QucteNjXMzbdKshBdm
|
| Size: |
1408
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703500v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703500v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703500v0.xml.3.dr
|
| ID: |
dr_513
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.859111574808197
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9ni6V0DTuMt1k3BNjXMi+EsdnKE+2h6wl/FfKkt7mu89:cc4oTuMteNjXMzbdKshBdSkt7i
|
| Size: |
1361
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703501v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703501v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703501v0.xml.3.dr
|
| ID: |
dr_514
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.89492777462298
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9l6+DTuct1k3BNjXMi+EsdnKE+2h6wl/FfKkt7mu89:cv7TucteNjXMzbdKshBdSkt7i
|
| Size: |
1398
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703550v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703550v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703550v0.xml.3.dr
|
| ID: |
dr_515
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.876198111520159
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9L3DxuMt1k3BNjXMi+EsdnKE+2h6wl/Ff7ISqxTn:ctzxuMteNjXMzbdKshBdDDqxTn
|
| Size: |
1371
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703551v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703551v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703551v0.xml.3.dr
|
| ID: |
dr_516
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.911520641736649
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9YVDxuct1k3BNjXMi+EsdnKE+2h6wl/Ff7ISqxTn:cqVxucteNjXMzbdKshBdDDqxTn
|
| Size: |
1408
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703600v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703600v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703600v0.xml.3.dr
|
| ID: |
dr_517
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.859441213383502
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d98m+DWuMt1k3BNjXMi+EsdnKE+2h6wl/FfOoZ0Q:cqmOWuMteNjXMzbdKshBdN0Q
|
| Size: |
1357
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703601v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703601v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703601v0.xml.3.dr
|
| ID: |
dr_518
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.895873875742196
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d91iGDWuct1k3BNjXMi+EsdnKE+2h6wl/FfOoZ0Q:cTiWWucteNjXMzbdKshBdN0Q
|
| Size: |
1394
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703650v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703650v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703650v0.xml.3.dr
|
| ID: |
dr_520
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.859074979008148
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9S0DAuMt1k3BNjXMi+EsdnKE+2h6wl/Ff9b1Q:cQoAuMteNjXMzbdKshBdFRQ
|
| Size: |
1359
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703651v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703651v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703651v0.xml.3.dr
|
| ID: |
dr_522
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.893131061328472
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9VpeDAuct1k3BNjXMi+EsdnKE+2h6wl/Ff9b1Q:cDcAucteNjXMzbdKshBdFRQ
|
| Size: |
1396
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703700v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703700v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703700v0.xml.3.dr
|
| ID: |
dr_530
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.869487277433382
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9A6DSuMt1k3BNjXMi+EsdnKE+2h6wl/FfqRjJNk:ceaSuMteNjXMzbdKshBdyRjJC
|
| Size: |
1377
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703701v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703701v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703701v0.xml.3.dr
|
| ID: |
dr_532
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.902951734564792
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9zIJDSuct1k3BNjXMi+EsdnKE+2h6wl/FfqRjJNk:cRIZSucteNjXMzbdKshBdyRjJC
|
| Size: |
1414
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703750v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703750v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703750v0.xml.3.dr
|
| ID: |
dr_534
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.898773611960046
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9p0D4uMt1k3BNjXMi+EsdnKE+2h6wl/Ff+V8E:c/o4uMteNjXMzbdKshBdTE
|
| Size: |
1399
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703751v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703751v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703751v0.xml.3.dr
|
| ID: |
dr_535
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.929467842574553
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d924D4uct1k3BNjXMi+EsdnKE+2h6wl/Ff+V8E:csc4ucteNjXMzbdKshBdTE
|
| Size: |
1436
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703800v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703800v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703800v0.xml.3.dr
|
| ID: |
dr_536
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.889079229821002
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9xGDmuMt1k3BNjXMi+EsdnKE+2h6wl/Ff+c:czWmuMteNjXMzbdKshBdmc
|
| Size: |
1381
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703801v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703801v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703801v0.xml.3.dr
|
| ID: |
dr_537
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.921065578166547
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9++Dmuct1k3BNjXMi+EsdnKE+2h6wl/Ff+c:cAOmucteNjXMzbdKshBdmc
|
| Size: |
1418
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703850v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703850v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703850v0.xml.3.dr
|
| ID: |
dr_538
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.9085076597309225
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9ogJDMuMt1k3BNjXMi+EsdnKE+2h6wl/Ff48z5l:cqOMuMteNjXMzbdKshBdddl
|
| Size: |
1404
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703851v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703851v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703851v0.xml.3.dr
|
| ID: |
dr_539
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.938740750695626
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9bgjDMuct1k3BNjXMi+EsdnKE+2h6wl/Ff48z5l:ctWMucteNjXMzbdKshBdddl
|
| Size: |
1441
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703900v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703900v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703900v0.xml.3.dr
|
| ID: |
dr_540
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.879092955369256
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9W+d7DiDuMt1k3BNjXMi+EsdnKE+2h6wl/FffmEj:cYgQuMteNjXMzbdKshBdXbj
|
| Size: |
1389
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703901v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703901v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703901v0.xml.3.dr
|
| ID: |
dr_550
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.912185438232315
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d902f+7DiDuct1k3BNjXMi+EsdnKE+2h6wl/FffmEj:cLfEQucteNjXMzbdKshBdXbj
|
| Size: |
1426
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703950v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703950v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703950v0.xml.3.dr
|
| ID: |
dr_552
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.860514751542863
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d93RDvuMt1k3BNjXMi+EsdnKE+2h6wl/FfQ6YiW:chhvuMteNjXMzbdKshBdCiW
|
| Size: |
1365
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703951v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule703951v0.xml
|
| Category: |
dropped
|
| Dump: |
rule703951v0.xml.3.dr
|
| ID: |
dr_555
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8964130495018665
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9EbDvuct1k3BNjXMi+EsdnKE+2h6wl/FfQ6YiW:cunvucteNjXMzbdKshBdCiW
|
| Size: |
1402
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704000v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704000v0.xml
|
| Category: |
dropped
|
| Dump: |
rule704000v0.xml.3.dr
|
| ID: |
dr_558
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.881737011521532
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9yTDluMt1k3BNjXMi+EsdnKE+2h6wl/Ffgp2i:cAfluMteNjXMzbdKshBdY8i
|
| Size: |
1381
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704001v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704001v0.xml
|
| Category: |
dropped
|
| Dump: |
rule704001v0.xml.3.dr
|
| ID: |
dr_560
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.914410926227558
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d91QODluct1k3BNjXMi+EsdnKE+2h6wl/Ffgp2i:czQ+lucteNjXMzbdKshBdY8i
|
| Size: |
1418
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704050v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704050v0.xml
|
| Category: |
dropped
|
| Dump: |
rule704050v0.xml.3.dr
|
| ID: |
dr_562
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.854080661479833
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9bOD2uMt1k3BNjXMi+EsdnKE+2h6wl/Ffox4dVXHj:cp+2uMteNjXMzbdKshBdfLXj
|
| Size: |
1355
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704051v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704051v0.xml
|
| Category: |
dropped
|
| Dump: |
rule704051v0.xml.3.dr
|
| ID: |
dr_563
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.890484382283006
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9oWD2uct1k3BNjXMi+EsdnKE+2h6wl/Ffox4dVXHj:c2G2ucteNjXMzbdKshBdfLXj
|
| Size: |
1392
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704100v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704100v0.xml
|
| Category: |
dropped
|
| Dump: |
rule704100v0.xml.3.dr
|
| ID: |
dr_565
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.853437171089294
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9QcaDj2uMt1k3BNjXMi+EsdnKE+2h6wl/FfjOLzW:cCc6j2uMteNjXMzbdKshBdbOLzW
|
| Size: |
1361
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704101v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704101v0.xml
|
| Category: |
dropped
|
| Dump: |
rule704101v0.xml.3.dr
|
| ID: |
dr_566
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.88763297443542
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9QviDj2uct1k3BNjXMi+EsdnKE+2h6wl/FfjOLzW:cCvij2ucteNjXMzbdKshBdbOLzW
|
| Size: |
1398
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704150v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704150v0.xml
|
| Category: |
dropped
|
| Dump: |
rule704150v0.xml.3.dr
|
| ID: |
dr_568
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.863515036936551
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9Qt4jD82YBuMt1k3BNjXMi+EsdnKE+2h6wl/Ffg3i9r9:cCt+2uMteNjXMzbdKshBdag
|
| Size: |
1361
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704151v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704151v0.xml
|
| Category: |
dropped
|
| Dump: |
rule704151v0.xml.3.dr
|
| ID: |
dr_577
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.898410545870133
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9QqWD82YBuct1k3BNjXMi+EsdnKE+2h6wl/Ffg3i9r9:cCqG2ucteNjXMzbdKshBdag
|
| Size: |
1398
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704200v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704200v0.xml
|
| Category: |
dropped
|
| Dump: |
rule704200v0.xml.3.dr
|
| ID: |
dr_579
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.864383829099071
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9QzDluMt1k3BNjXMi+EsdnKE+2h6wl/FfIH:ci/luMteNjXMzbdKshBdAH
|
| Size: |
1379
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704201v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule704201v0.xml
|
| Category: |
dropped
|
| Dump: |
rule704201v0.xml.3.dr
|
| ID: |
dr_581
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8984573728935095
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9DBDluct1k3BNjXMi+EsdnKE+2h6wl/FfIH:clxlucteNjXMzbdKshBdAH
|
| Size: |
1416
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70500v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70500v0.xml
|
| Category: |
dropped
|
| Dump: |
rule70500v0.xml.3.dr
|
| ID: |
dr_583
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.140990380367097
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHd92KU3b03CMgZYAQier8lV16jnfEtNO2su:2d9hU3Xgr8Pun8j
|
| Size: |
480
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70502v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70502v0.xml
|
| Category: |
dropped
|
| Dump: |
rule70502v0.xml.3.dr
|
| ID: |
dr_586
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.446203843540715
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9cuXRFtzRFkqRFnzRFBxRFTzRFMjDh1vPcpsJpDYpZ11uMTX0oG:cWuXRzRdR9RhR5RKhuMf
|
| Size: |
3699
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70503v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70503v0.xml
|
| Category: |
dropped
|
| Dump: |
rule70503v0.xml.3.dr
|
| ID: |
dr_588
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.713212028693152
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d9HFQc11mbU3Xm30chKSmuyPjRF4qLPD3RfT0cV0sOczioc8cg:c9FQI1aoXA0q1muybRF4q90w0q59j
|
| Size: |
1966
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70504v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule70504v0.xml
|
| Category: |
dropped
|
| Dump: |
rule70504v0.xml.3.dr
|
| ID: |
dr_590
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.6821367680074895
|
| Encrypted: |
false
|
| Ssdeep: |
24:2d92FQc1zU3Xm30cYISmuyPiKpFYhLPD3RfT0cTqC8vwfu+cjcg:c4FQIzoXA0FmuyPFYh900qLiWj
|
| Size: |
2036
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule840000v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule840000v1.xml
|
| Category: |
dropped
|
| Dump: |
rule840000v1.xml.3.dr
|
| ID: |
dr_592
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.5524500936112124
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dSLCCw6YiZys1OrTuiReWuUjO8PROt0FuoqfOi9w8hWD4:cgbai3OHuKesP1dD4
|
| Size: |
2739
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule840001v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule840001v0.xml
|
| Category: |
dropped
|
| Dump: |
rule840001v0.xml.3.dr
|
| ID: |
dr_593
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.139406679616707
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdSGMd/RZUCw6DEi3FerJMfUIdLWtlAGnp9l/+b4RCffE2NO2su:2dSFrUCw6Yi3wrJ/kK1FCnEG
|
| Size: |
689
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule840002v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule840002v1.xml
|
| Category: |
dropped
|
| Dump: |
rule840002v1.xml.3.dr
|
| ID: |
dr_595
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.971711898879209
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dS87Cw6YiZmZrbmux+agGik3CD81gGJAl:cSaicfmuI58gGJAl
|
| Size: |
1032
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880000v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880000v1.xml
|
| Category: |
dropped
|
| Dump: |
rule880000v1.xml.3.dr
|
| ID: |
dr_597
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.032222543430035
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHddljeIYAQXerHN+u/lOaNe8tNH/M//HTLJ5eNX/c//aNezPNuHa3/8//QGJuW:2ddljrJrH8uXhHwLKTQPbbFzPc
|
| Size: |
1065
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880001v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880001v1.xml
|
| Category: |
dropped
|
| Dump: |
rule880001v1.xml.3.dr
|
| ID: |
dr_598
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
3.998522798067614
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdpaljeqAQXerHN+u/lOaNe8tNH/M//H6jXhsK5eNX/c//aNezPNuGbXF3/8/v:2dsljcrH8uXhHLrITQP1x6qc
|
| Size: |
1053
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880015v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880015v0.xml
|
| Category: |
dropped
|
| Dump: |
rule880015v0.xml.3.dr
|
| ID: |
dr_600
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.772820693771853
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdoXLHAQXerHN+u/qNOstNX/c//3qS39pONGIfdNOjsu:2doXCrH8uyRXaKc
|
| Size: |
555
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880016v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880016v0.xml
|
| Category: |
dropped
|
| Dump: |
rule880016v0.xml.3.dr
|
| ID: |
dr_602
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.034943189563685
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdpLDYAQXerHN+u/lOaNe8tNH/M//HqS395eNX/c//hH/ezPNuP3/8//8JuNHU:2dpZrH8uXhHqehP2+vc
|
| Size: |
1064
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880017v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880017v0.xml
|
| Category: |
dropped
|
| Dump: |
rule880017v0.xml.3.dr
|
| ID: |
dr_604
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.061559435834553
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdQL7mAQXerHN+u/lOaNe8tNH/M//HqS395eNX/c//hH/ezPNuMz3K3/8//8JX:2dQ3rH8uXhHqehPHK+vc
|
| Size: |
1074
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880020v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880020v0.xml
|
| Category: |
dropped
|
| Dump: |
rule880020v0.xml.3.dr
|
| ID: |
dr_605
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.726610360558981
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdOaAQXerHN+u/qNOstNX/c//33zbpONGIfdNOjsu:2dOjrH8uyRXFc
|
| Size: |
542
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880021v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880021v0.xml
|
| Category: |
dropped
|
| Dump: |
rule880021v0.xml.3.dr
|
| ID: |
dr_607
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.254992160336294
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdHXTAQXerHN+u/lOaNe8tNH/M//H3zb5eNX/c//jPNeEKWnH/M//rLM5eNpOU:2dHXarH8uXhH3EPAWHy0c
|
| Size: |
880
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880022v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880022v0.xml
|
| Category: |
dropped
|
| Dump: |
rule880022v0.xml.3.dr
|
| ID: |
dr_609
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.013508743358617
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdD4MmAQXerHN+u/lOaNe8tNH/M//H3zb5eNX/c//hH/ezPNuCJ5hBjn3/8//s:2dD4qrH8uXhH3hPl/BLLsc
|
| Size: |
1059
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880023v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880023v0.xml
|
| Category: |
dropped
|
| Dump: |
rule880023v0.xml.3.dr
|
| ID: |
dr_611
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.712038068989999
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHda4vtAQXerHN+u/qNOstNX/c//VmqpONdGKNXmAChLIfdNOcsu:2d9vkrH8uyRXGKNWAlJ
|
| Size: |
634
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880024v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule880024v0.xml
|
| Category: |
dropped
|
| Dump: |
rule880024v0.xml.3.dr
|
| ID: |
dr_613
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.745302370768016
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdyvhnYAQXerHN+u/qNOstNX/c//XpONdGKNXmAChLIfdNOcsu:2dyvjrH8uyRXOKNWAlJ
|
| Size: |
637
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule890000v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule890000v2.xml
|
| Category: |
dropped
|
| Dump: |
rule890000v2.xml.3.dr
|
| ID: |
dr_615
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.992943901171179
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdt9ynFVkHzpRtRVHvAQjerPW/+u/5lOES1c/NX/c//+pONLjsfTS12xP6+/TI:2dzynFVOLzorPFunuc/Jks7u2Rbuc/qj
|
| Size: |
855
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule890002v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule890002v0.xml
|
| Category: |
dropped
|
| Dump: |
rule890002v0.xml.3.dr
|
| ID: |
dr_616
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.852534729172089
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdtu3NP2xVkHzpRtRVKerner1er8OerXergzahIffO9G9+lSGT+9d7yXGUEBI+:2dASVOLzDrergrarOrEw3aO2UGgC162J
|
| Size: |
991
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule890003v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule890003v1.xml
|
| Category: |
dropped
|
| Dump: |
rule890003v1.xml.3.dr
|
| ID: |
dr_617
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.8349878632894505
|
| Encrypted: |
false
|
| Ssdeep: |
24:2deqEXVOLzDrar0rt2rGr4rirSrFeOw9gOdq1ABR:ceHXVOLzDG4x2qEmOZeOwjd+8
|
| Size: |
1271
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule890004v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule890004v0.xml
|
| Category: |
dropped
|
| Dump: |
rule890004v0.xml.3.dr
|
| ID: |
dr_619
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.238922111527346
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBdPVVKmkl3mcf1LJL/cUdkTAHzpRsE6KVEDFperhnZkdx486/MveNOn2sby:TMHdt43NLIVkHzpRtRVKer/SWMmNO2su
|
| Size: |
395
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90117v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90117v1.xml
|
| Category: |
dropped
|
| Dump: |
rule90117v1.xml.3.dr
|
| ID: |
dr_620
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.1350527003055335
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdK/ksCSawSCSvAQqWnerfNsmEtadFv15nt9NI7NO2su:2dUYlwTrfNeQ8
|
| Size: |
613
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90118v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90118v1.xml
|
| Category: |
dropped
|
| Dump: |
rule90118v1.xml.3.dr
|
| ID: |
dr_621
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.1438660018382025
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdKqm4KlCSawSCSvAQ4WnerqsmEtadFv15r9LnoNO2su:2dVmWlwLrqeQk
|
| Size: |
598
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90119v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90119v1.xml
|
| Category: |
dropped
|
| Dump: |
rule90119v1.xml.3.dr
|
| ID: |
dr_622
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.138423191976508
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdK1kAmjSawSCSvAQqWnerLsmEtadrFbmMnt9NI7NO2su:2dKHMlwTrLeQrRu
|
| Size: |
622
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90120v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90120v1.xml
|
| Category: |
dropped
|
| Dump: |
rule90120v1.xml.3.dr
|
| ID: |
dr_624
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.131103601127074
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdK1kYJnmjSawSCSvAQUerbK7smEtadoEnFE9EnmMnt9NI7NO2su:2d6pMlw4rceQomS9mu
|
| Size: |
621
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90200v4.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90200v4.xml
|
| Category: |
dropped
|
| Dump: |
rule90200v4.xml.3.dr
|
| ID: |
dr_626
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.031646670731258
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdBK9SP4SawSCENXWnerJENerCUxlVqK7PNWXf/0//ChmMNOSjsu:2dA9SQlw+JrmYrCUxPLPQp
|
| Size: |
614
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90201v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90201v2.xml
|
| Category: |
dropped
|
| Dump: |
rule90201v2.xml.3.dr
|
| ID: |
dr_628
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.119788069276698
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdjSyC4SawSCSvAQENXWneralVqK6Vu+SrYOZe/7yHagaIZiN1Dp+hqTHEYoxJ:2djSulwTJraPIBGeDCaaI10j1b
|
| Size: |
1131
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90204v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90204v1.xml
|
| Category: |
dropped
|
| Dump: |
rule90204v1.xml.3.dr
|
| ID: |
dr_631
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.13362900928204
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdNjStk4SawSCSvAQENXWnerTPlVqK63XMpy/Py8/Ny4DFZNO2su:2dNjSDlwTJrbP6dr5
|
| Size: |
851
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90206v2.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90206v2.xml
|
| Category: |
dropped
|
| Dump: |
rule90206v2.xml.3.dr
|
| ID: |
dr_632
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.67263028306523
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdQ5Suu74SawSCENXWnerJENerCUO+tNqNOUX/c//ZpONd+kXqNOzX/c//ZpOi:2d+SuuElw+JrmYrCUNt49CTqC
|
| Size: |
760
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90207v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90207v1.xml
|
| Category: |
dropped
|
| Dump: |
rule90207v1.xml.3.dr
|
| ID: |
dr_634
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.071752018187274
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdWRBlbSawSC2RWnerlXFJjEQicitGzNUINO5AdHNUlu:2dozblwwzrJvLYR87
|
| Size: |
673
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90208v0.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90208v0.xml
|
| Category: |
dropped
|
| Dump: |
rule90208v0.xml.3.dr
|
| ID: |
dr_636
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.179855489867653
|
| Encrypted: |
false
|
| Ssdeep: |
12:TMHdZ0Bl0iSQSawSC2RWnerc3ntoBs/mUINO2su:2dyz0Clwwzr8QSg
|
| Size: |
604
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90303v1.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90303v1.xml
|
| Category: |
dropped
|
| Dump: |
rule90303v1.xml.3.dr
|
| ID: |
dr_639
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.975115444313837
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dVpqslwK3bTw2ritdFPZfPiIfzf9a/992iIylJw9hlPZ+:cVpqJK3bU22tTPV9aV92iulPA
|
| Size: |
1877
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90401v3.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule90401v3.xml
|
| Category: |
dropped
|
| Dump: |
rule90401v3.xml.3.dr
|
| ID: |
dr_642
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.85725913320415
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dokNYwlwZlYrlHlqgVwPwlNBHVCPw9uP2f7eVie7:cBYdTYZF7+7
|
| Size: |
1249
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db
|
SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database
pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db
|
| Category: |
dropped
|
| Dump: |
powerpnt.exe.db.3.dr
|
| ID: |
dr_57
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database
pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
|
| Entropy: |
0.09216609452072291
|
| Encrypted: |
false
|
| Ssdeep: |
3:lSWFN3l/klslpF/4llfll:l9F8E0/
|
| Size: |
4096
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db-journal
|
SQLite Rollback Journal
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db-journal
|
| Category: |
dropped
|
| Dump: |
powerpnt.exe.db-journal.3.dr
|
| ID: |
dr_883
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
SQLite Rollback Journal
|
| Entropy: |
0.13760166725504608
|
| Encrypted: |
false
|
| Ssdeep: |
3:7FEG2l+/0LslH/FllkpMRgSWbNFl/sl+ltlslVlllfllYn:7+/lXEBg9bNFlEs1EP/In
|
| Size: |
4616
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db-shm
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db-shm
|
| Category: |
dropped
|
| Dump: |
powerpnt.exe.db-shm.3.dr
|
| ID: |
dr_62
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
0.04482848510499482
|
| Encrypted: |
false
|
| Ssdeep: |
3:G4l2lBXNg/N64l2lBXNg/NJ8lL9//Xlvlll1lllwlvlllglbXdbllAlldl+l:G4l2bXNE64l2bXNEGL9XXPH4l942U
|
| Size: |
32768
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db-wal
|
SQLite Write-Ahead Log, version 3007000
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db-wal
|
| Category: |
dropped
|
| Dump: |
powerpnt.exe.db-wal.3.dr
|
| ID: |
dr_59
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
SQLite Write-Ahead Log, version 3007000
|
| Entropy: |
0.39398902079791137
|
| Encrypted: |
false
|
| Ssdeep: |
48:/BdfQ1ii6ZUw5Ull7DYMi+lkzO8VFDYMi:kz872ll4a8jVG
|
| Size: |
45352
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Allocates a big amount of memory (probably used for heap spraying) |
Software Vulnerabilities |
Extra Window Memory Injection
|
|
|
C:\Users\user\AppData\Local\Temp\Diagnostics\POWERPNT\App1728047436082157900_E910548C-1979-4833-9FEE-78F97BEE9BF6.log
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\Diagnostics\POWERPNT\App1728047436082157900_E910548C-1979-4833-9FEE-78F97BEE9BF6.log
|
| Category: |
dropped
|
| Dump: |
App1728047436082157900_E910548C-1979-4833-9FEE-78F97BEE9BF6.log.3.dr
|
| ID: |
dr_49
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
0.04190733968777602
|
| Encrypted: |
false
|
| Ssdeep: |
1536:klXeZdU89onLHAxYBrHWEercizbdWwcjYWhmxtIJm1BHfjg0bYhvR9pBSHJ8Q3Xw:hE2qJV0+Mh92X3R5
|
| Size: |
20971520
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\Diagnostics\POWERPNT\App1728047436082802100_E910548C-1979-4833-9FEE-78F97BEE9BF6.log
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\Diagnostics\POWERPNT\App1728047436082802100_E910548C-1979-4833-9FEE-78F97BEE9BF6.log
|
| Category: |
dropped
|
| Dump: |
App1728047436082802100_E910548C-1979-4833-9FEE-78F97BEE9BF6.log.3.dr
|
| ID: |
dr_51
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
0.0
|
| Encrypted: |
false
|
| Ssdeep: |
3::
|
| Size: |
20971520
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD511E.tmp\Content.inf
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD511E.tmp\Content.inf
|
| Category: |
dropped
|
| Dump: |
Content.inf3.3.dr
|
| ID: |
dr_79
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
3.5039994158393686
|
| Encrypted: |
false
|
| Ssdeep: |
6:fxnxUX4f+E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvGHmD0+dAH/luWvv
|
| Size: |
246
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD511E.tmp\TabbedArc.glox
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD511E.tmp\TabbedArc.glox
|
| Category: |
dropped
|
| Dump: |
TabbedArc.glox.3.dr
|
| ID: |
dr_53
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.772039166640107
|
| Encrypted: |
false
|
| Ssdeep: |
96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
|
| Size: |
3683
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5120.tmp\Content.inf
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5120.tmp\Content.inf
|
| Category: |
dropped
|
| Dump: |
Content.inf5.3.dr
|
| ID: |
dr_83
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
3.4721586910685547
|
| Encrypted: |
false
|
| Ssdeep: |
6:fxnxUX9+RclTloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyteUTloGHmD0+dAH/luWvv
|
| Size: |
254
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5120.tmp\chevronaccent.glox
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5120.tmp\chevronaccent.glox
|
| Category: |
dropped
|
| Dump: |
chevronaccent.glox.3.dr
|
| ID: |
dr_58
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.824383764848892
|
| Encrypted: |
false
|
| Ssdeep: |
96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
|
| Size: |
4243
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5121.tmp\BracketList.glox
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5121.tmp\BracketList.glox
|
| Category: |
dropped
|
| Dump: |
BracketList.glox.3.dr
|
| ID: |
dr_56
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.809492693601857
|
| Encrypted: |
false
|
| Ssdeep: |
96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
|
| Size: |
4026
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5121.tmp\Content.inf
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5121.tmp\Content.inf
|
| Category: |
dropped
|
| Dump: |
Content.inf4.3.dr
|
| ID: |
dr_81
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
3.4916022431157345
|
| Encrypted: |
false
|
| Ssdeep: |
6:fxnxUXsAl8xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8A8xoGHmD0+dAH/luWvv
|
| Size: |
250
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5123.tmp\Content.inf
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5123.tmp\Content.inf
|
| Category: |
dropped
|
| Dump: |
Content.inf2.3.dr
|
| ID: |
dr_78
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
3.48087342759872
|
| Encrypted: |
false
|
| Ssdeep: |
6:fxnxUXXt1MIae2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyfMIaRGHmD0+dAH/luWvv
|
| Size: |
252
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5123.tmp\PictureFrame.glox
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5123.tmp\PictureFrame.glox
|
| Category: |
dropped
|
| Dump: |
PictureFrame.glox.3.dr
|
| ID: |
dr_50
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.821066198539098
|
| Encrypted: |
false
|
| Ssdeep: |
96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
|
| Size: |
4326
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5129.tmp\Content.inf
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5129.tmp\Content.inf
|
| Category: |
dropped
|
| Dump: |
Content.inf0.3.dr
|
| ID: |
dr_76
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
3.4680595384446202
|
| Encrypted: |
false
|
| Ssdeep: |
6:fxnxUXivlE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyydGHmD0+dAH/luWvv
|
| Size: |
252
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5129.tmp\architecture.glox
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5129.tmp\architecture.glox
|
| Category: |
dropped
|
| Dump: |
architecture.glox.3.dr
|
| ID: |
dr_47
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.88616857639663
|
| Encrypted: |
false
|
| Ssdeep: |
96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
|
| Size: |
5783
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD512A.tmp\Content.inf
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD512A.tmp\Content.inf
|
| Category: |
dropped
|
| Dump: |
Content.inf6.3.dr
|
| ID: |
dr_86
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
3.4692172273306268
|
| Encrypted: |
false
|
| Ssdeep: |
6:fxnxUXcq9DsoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnysmYoGHmD0+dAH/luWvv
|
| Size: |
258
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD512A.tmp\pictureorgchart.glox
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD512A.tmp\pictureorgchart.glox
|
| Category: |
dropped
|
| Dump: |
pictureorgchart.glox.3.dr
|
| ID: |
dr_61
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.9204386289679745
|
| Encrypted: |
false
|
| Ssdeep: |
192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
|
| Size: |
7370
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD512B.tmp\Content.inf
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD512B.tmp\Content.inf
|
| Category: |
dropped
|
| Dump: |
Content.inf1.3.dr
|
| ID: |
dr_77
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
3.4901887319218092
|
| Encrypted: |
false
|
| Ssdeep: |
6:fxnxUXqhBMl0OoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyiMl0OoGHmD0+dAH/luWvv
|
| Size: |
262
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD512B.tmp\RadialPictureList.glox
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD512B.tmp\RadialPictureList.glox
|
| Category: |
dropped
|
| Dump: |
RadialPictureList.glox.3.dr
|
| ID: |
dr_52
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.875182123405584
|
| Encrypted: |
false
|
| Ssdeep: |
96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
|
| Size: |
5596
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD513B.tmp\Content.inf
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD513B.tmp\Content.inf
|
| Category: |
dropped
|
| Dump: |
Content.inf.3.dr
|
| ID: |
dr_75
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
3.484503080761839
|
| Encrypted: |
false
|
| Ssdeep: |
6:fxnxUXGdQ1MecJZMlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny2dQ98MlWlzGHmD0+dAH/luWvv
|
| Size: |
280
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD513B.tmp\InterconnectedBlockProcess.glox
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD513B.tmp\InterconnectedBlockProcess.glox
|
| Category: |
dropped
|
| Dump: |
InterconnectedBlockProcess.glox.3.dr
|
| ID: |
dr_54
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.93263830735235
|
| Encrypted: |
false
|
| Ssdeep: |
192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
|
| Size: |
9191
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD513C.tmp\CircleProcess.glox
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD513C.tmp\CircleProcess.glox
|
| Category: |
dropped
|
| Dump: |
CircleProcess.glox.3.dr
|
| ID: |
dr_48
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.9519793977093505
|
| Encrypted: |
false
|
| Ssdeep: |
384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
|
| Size: |
16806
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD513C.tmp\Content.inf
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD513C.tmp\Content.inf
|
| Category: |
dropped
|
| Dump: |
Content.inf11.3.dr
|
| ID: |
dr_113
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
3.4720677950594836
|
| Encrypted: |
false
|
| Ssdeep: |
6:fxnxUXOu9+MlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnycMlWlzGHmD0+dAH/luWvv
|
| Size: |
254
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD513D.tmp\Content.inf
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD513D.tmp\Content.inf
|
| Category: |
dropped
|
| Dump: |
Content.inf12.3.dr
|
| ID: |
dr_116
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
3.4938093034530917
|
| Encrypted: |
false
|
| Ssdeep: |
6:fxnxUX44lWWoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvToGHmD0+dAH/luWvv
|
| Size: |
242
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD513D.tmp\TabList.glox
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD513D.tmp\TabList.glox
|
| Category: |
dropped
|
| Dump: |
TabList.glox.3.dr
|
| ID: |
dr_89
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.8636569313247335
|
| Encrypted: |
false
|
| Ssdeep: |
96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
|
| Size: |
4888
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD514E.tmp\Content.inf
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD514E.tmp\Content.inf
|
| Category: |
dropped
|
| Dump: |
Content.inf10.3.dr
|
| ID: |
dr_111
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
3.494357416502254
|
| Encrypted: |
false
|
| Ssdeep: |
6:fxnxUX0XPE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPGHmD0+dAH/luWvv
|
| Size: |
260
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD514E.tmp\ThemePictureGrid.glox
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD514E.tmp\ThemePictureGrid.glox
|
| Category: |
dropped
|
| Dump: |
ThemePictureGrid.glox.3.dr
|
| ID: |
dr_80
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.855499268199703
|
| Encrypted: |
false
|
| Ssdeep: |
192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
|
| Size: |
6193
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD514F.tmp\Content.inf
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD514F.tmp\Content.inf
|
| Category: |
dropped
|
| Dump: |
Content.inf9.3.dr
|
| ID: |
dr_109
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
3.4895685222798054
|
| Encrypted: |
false
|
| Ssdeep: |
6:fxnxUX4cPBl4xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyPl4xoGHmD0+dAH/luWvv
|
| Size: |
260
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD514F.tmp\VaryingWidthList.glox
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD514F.tmp\VaryingWidthList.glox
|
| Category: |
dropped
|
| Dump: |
VaryingWidthList.glox.3.dr
|
| ID: |
dr_74
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.716021191059687
|
| Encrypted: |
false
|
| Ssdeep: |
48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
|
| Size: |
3075
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5150.tmp\Content.inf
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5150.tmp\Content.inf
|
| Category: |
dropped
|
| Dump: |
Content.inf8.3.dr
|
| ID: |
dr_108
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
3.472155835869843
|
| Encrypted: |
false
|
| Ssdeep: |
6:fxnxUXGE2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny4GHmD0+dAH/luWvv
|
| Size: |
238
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5150.tmp\rings.glox
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5150.tmp\rings.glox
|
| Category: |
dropped
|
| Dump: |
rings.glox.3.dr
|
| ID: |
dr_122
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.859615916913808
|
| Encrypted: |
false
|
| Ssdeep: |
96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
|
| Size: |
5151
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5151.tmp\Content.inf
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5151.tmp\Content.inf
|
| Category: |
dropped
|
| Dump: |
Content.inf7.3.dr
|
| ID: |
dr_107
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
3.4670546921349774
|
| Encrypted: |
false
|
| Ssdeep: |
6:fxnxUX0XPYDxUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPYDCloGHmD0+dAH/luWvv
|
| Size: |
286
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5151.tmp\ThemePictureAlternatingAccent.glox
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5151.tmp\ThemePictureAlternatingAccent.glox
|
| Category: |
dropped
|
| Dump: |
ThemePictureAlternatingAccent.glox.3.dr
|
| ID: |
dr_119
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.87271654296772
|
| Encrypted: |
false
|
| Ssdeep: |
96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
|
| Size: |
5630
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5171.tmp\Content.inf
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5171.tmp\Content.inf
|
| Category: |
dropped
|
| Dump: |
Content.inf15.3.dr
|
| ID: |
dr_155
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
3.4866056878458096
|
| Encrypted: |
false
|
| Ssdeep: |
6:fxnxUX0XrZUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXWloGHmD0+dAH/luWvv
|
| Size: |
264
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5171.tmp\ThemePictureAccent.glox
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5171.tmp\ThemePictureAccent.glox
|
| Category: |
dropped
|
| Dump: |
ThemePictureAccent.glox.3.dr
|
| ID: |
dr_106
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.897260397307811
|
| Encrypted: |
false
|
| Ssdeep: |
192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
|
| Size: |
6448
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5172.tmp\Content.inf
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5172.tmp\Content.inf
|
| Category: |
dropped
|
| Dump: |
Content.inf14.3.dr
|
| ID: |
dr_152
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
3.4845992218379616
|
| Encrypted: |
false
|
| Ssdeep: |
6:fxnxUXQFoElh/lE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8lLGHmD0+dAH/luWvv
|
| Size: |
254
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5172.tmp\HexagonRadial.glox
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5172.tmp\HexagonRadial.glox
|
| Category: |
dropped
|
| Dump: |
HexagonRadial.glox.3.dr
|
| ID: |
dr_105
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.886254023824049
|
| Encrypted: |
false
|
| Ssdeep: |
96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
|
| Size: |
6024
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5173.tmp\Content.inf
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5173.tmp\Content.inf
|
| Category: |
dropped
|
| Dump: |
Content.inf13.3.dr
|
| ID: |
dr_149
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
3.4842773155694724
|
| Encrypted: |
false
|
| Ssdeep: |
6:fxnxUXDAlIJAFIloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyMlI7loGHmD0+dAH/luWvv
|
| Size: |
256
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5173.tmp\ConvergingText.glox
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5173.tmp\ConvergingText.glox
|
| Category: |
dropped
|
| Dump: |
ConvergingText.glox.3.dr
|
| ID: |
dr_104
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.891971054886943
|
| Encrypted: |
false
|
| Ssdeep: |
192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
|
| Size: |
11380
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5260.tmp\View.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5260.tmp\View.thmx
|
| Category: |
dropped
|
| Dump: |
View.thmx.3.dr
|
| ID: |
dr_140
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.668294441507828
|
| Encrypted: |
false
|
| Ssdeep: |
6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
|
| Size: |
486596
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5260.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5260.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf0.3.dr
|
| ID: |
dr_143
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.535303979138867
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUX3IlVARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnynG6ymD0wbnKNAH/lMz1
|
| Size: |
274
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD52B1.tmp\Dividend.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD52B1.tmp\Dividend.thmx
|
| Category: |
dropped
|
| Dump: |
Dividend.thmx.3.dr
|
| ID: |
dr_135
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.674434888248144
|
| Encrypted: |
false
|
| Ssdeep: |
6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
|
| Size: |
570901
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD52B1.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD52B1.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf.3.dr
|
| ID: |
dr_137
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.5459495297497368
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXvBAuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnypJymD0wbnKNAH/lMz1
|
| Size: |
282
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD52E2.tmp\Basis.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD52E2.tmp\Basis.thmx
|
| Category: |
dropped
|
| Dump: |
Basis.thmx.3.dr
|
| ID: |
dr_188
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.696653383430889
|
| Encrypted: |
false
|
| Ssdeep: |
12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
|
| Size: |
558035
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD52E2.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD52E2.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf2.3.dr
|
| ID: |
dr_172
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.5361139545278144
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXeMWMluRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnycMlMymD0wbnKNAH/lMz1
|
| Size: |
276
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD52E3.tmp\Frame.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD52E3.tmp\Frame.thmx
|
| Category: |
dropped
|
| Dump: |
Frame.thmx.3.dr
|
| ID: |
dr_182
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.715248170753013
|
| Encrypted: |
false
|
| Ssdeep: |
6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
|
| Size: |
523048
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD52E3.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD52E3.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf3.3.dr
|
| ID: |
dr_185
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.5159096381406645
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXQIa3ARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygIaqymD0wbnKNAH/lMz1
|
| Size: |
276
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5323.tmp\Metropolitan.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5323.tmp\Metropolitan.thmx
|
| Category: |
dropped
|
| Dump: |
Metropolitan.thmx.3.dr
|
| ID: |
dr_169
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.689662652914981
|
| Encrypted: |
false
|
| Ssdeep: |
6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
|
| Size: |
777647
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5323.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5323.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf1.3.dr
|
| ID: |
dr_171
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.5091498509646044
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUX1MiDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyFdMymD0wbnKNAH/lMz1
|
| Size: |
290
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5345.tmp\Banded.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5345.tmp\Banded.thmx
|
| Category: |
dropped
|
| Dump: |
Banded.thmx.3.dr
|
| ID: |
dr_167
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.67409707491542
|
| Encrypted: |
false
|
| Ssdeep: |
12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
|
| Size: |
562113
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5345.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5345.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf7.3.dr
|
| ID: |
dr_203
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.535736910133401
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXeAlFkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyRGymD0wbnKNAH/lMz1
|
| Size: |
278
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5396.tmp\Facet.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5396.tmp\Facet.thmx
|
| Category: |
dropped
|
| Dump: |
Facet.thmx.3.dr
|
| ID: |
dr_217
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.8235726750504355
|
| Encrypted: |
false
|
| Ssdeep: |
12288:MIA7gJFzMeFZaq2fscBNVRFCToZr5RCmUQHr+kRBhFF0s9XH44qTxQXMI:hA7gJFzZ2xBbmsZdRC4Ck19X44qyMI
|
| Size: |
738429
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5396.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5396.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf8.3.dr
|
| ID: |
dr_221
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.516936518213681
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXOpCRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyLymD0wbnKNAH/lMz1
|
| Size: |
276
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD53C7.tmp\Parcel.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD53C7.tmp\Parcel.thmx
|
| Category: |
dropped
|
| Dump: |
Parcel.thmx.3.dr
|
| ID: |
dr_200
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.729143855239127
|
| Encrypted: |
false
|
| Ssdeep: |
6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
|
| Size: |
608122
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD53C7.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD53C7.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf6.3.dr
|
| ID: |
dr_201
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.516359852766808
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXKwRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6qymD0wbnKNAH/lMz1
|
| Size: |
278
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD53D9.tmp\Parallax.thmx
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD53D9.tmp\Parallax.thmx
|
| Category: |
dropped
|
| Dump: |
Parallax.thmx.3.dr
|
| ID: |
dr_197
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.824849396154325
|
| Encrypted: |
false
|
| Ssdeep: |
12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
|
| Size: |
924687
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD53D9.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD53D9.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf5.3.dr
|
| ID: |
dr_199
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.51145753448333
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXKsWkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6svymD0wbnKNAH/lMz1
|
| Size: |
282
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD53DA.tmp\Wisp.thmx
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD53DA.tmp\Wisp.thmx
|
| Category: |
dropped
|
| Dump: |
Wisp.thmx.3.dr
|
| ID: |
dr_269
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.849038074328931
|
| Encrypted: |
false
|
| Ssdeep: |
12288:RBbqz121ANZ40EdYNyNv3GaNBlHT3pxozHUt3HnpHQPegZ+dNu+7TrlpocfYFWCH:qDNhEYNyJNBlT3pxoz0tAtZ00j
|
| Size: |
787354
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD53DA.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD53DA.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf4.3.dr
|
| ID: |
dr_198
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.541057232141982
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXrpRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnybvymD0wbnKNAH/lMz1
|
| Size: |
274
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD540A.tmp\Wood_Type.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD540A.tmp\Wood_Type.thmx
|
| Category: |
dropped
|
| Dump: |
Wood_Type.thmx.3.dr
|
| ID: |
dr_245
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.875240099125746
|
| Encrypted: |
false
|
| Ssdeep: |
24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
|
| Size: |
1649585
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD540A.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD540A.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf11.3.dr
|
| ID: |
dr_265
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.5552837910707304
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXtLARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygymD0wbnKNAH/lMz1
|
| Size: |
284
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD546B.tmp\Quotable.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD546B.tmp\Quotable.thmx
|
| Category: |
dropped
|
| Dump: |
Quotable.thmx.3.dr
|
| ID: |
dr_242
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.8785200658952
|
| Encrypted: |
false
|
| Ssdeep: |
24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
|
| Size: |
966946
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD546B.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD546B.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf10.3.dr
|
| ID: |
dr_244
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.5323495192404475
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXhduDARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyxdumymD0wbnKNAH/lMz1
|
| Size: |
282
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD546C.tmp\Atlas.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD546C.tmp\Atlas.thmx
|
| Category: |
dropped
|
| Dump: |
Atlas.thmx.3.dr
|
| ID: |
dr_243
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.84356939318248
|
| Encrypted: |
false
|
| Ssdeep: |
12288:RiQJnhBiU81d9WbQPHxV9uqraiDFihVRR5cJJeYiaFUV0CoTz:RiwhE8bIXkvQIjRR+nDmVK3
|
| Size: |
857650
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD546C.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD546C.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf9.3.dr
|
| ID: |
dr_240
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.5321161173982487
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXWwRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyNymD0wbnKNAH/lMz1
|
| Size: |
276
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD54FA.tmp\Berlin.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD54FA.tmp\Berlin.thmx
|
| Category: |
dropped
|
| Dump: |
Berlin.thmx.3.dr
|
| ID: |
dr_239
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.791956689344336
|
| Encrypted: |
false
|
| Ssdeep: |
24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
|
| Size: |
976001
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD54FA.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD54FA.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf15.3.dr
|
| ID: |
dr_302
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.5270134268591966
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXa3Y1kRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyt1mymD0wbnKNAH/lMz1
|
| Size: |
278
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5608.tmp\Savon.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5608.tmp\Savon.thmx
|
| Category: |
dropped
|
| Dump: |
Savon.thmx.3.dr
|
| ID: |
dr_285
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.92476783994848
|
| Encrypted: |
false
|
| Ssdeep: |
24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
|
| Size: |
1204049
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5608.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5608.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf14.3.dr
|
| ID: |
dr_287
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.5364757859412563
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXARkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnywMymD0wbnKNAH/lMz1
|
| Size: |
276
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5618.tmp\Gallery.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5618.tmp\Gallery.thmx
|
| Category: |
dropped
|
| Dump: |
Gallery.thmx.3.dr
|
| ID: |
dr_284
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.906659368807194
|
| Encrypted: |
false
|
| Ssdeep: |
24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
|
| Size: |
1091485
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5618.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5618.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf13.3.dr
|
| ID: |
dr_286
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.5301133500353727
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXp2pRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyZ2vymD0wbnKNAH/lMz1
|
| Size: |
280
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5678.tmp\Retrospect.thmx
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5678.tmp\Retrospect.thmx
|
| Category: |
dropped
|
| Dump: |
Retrospect.thmx.3.dr
|
| ID: |
dr_281
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.867463315196704
|
| Encrypted: |
false
|
| Ssdeep: |
24576:bimPI+bGSIB3FKbFGTCpavIOuaR0Um9BbbjE68+xiMNcayWSvHo5R/m:OmPI+6fB3Abk8Q5tHmAsiMNccSvIr/m
|
| Size: |
1623260
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5678.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5678.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf12.3.dr
|
| ID: |
dr_282
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.51951639572024
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXeZkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnykmymD0wbnKNAH/lMz1
|
| Size: |
286
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD56BA.tmp\Circuit.thmx
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD56BA.tmp\Circuit.thmx
|
| Category: |
dropped
|
| Dump: |
Circuit.thmx.3.dr
|
| ID: |
dr_508
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.898382456989258
|
| Encrypted: |
false
|
| Ssdeep: |
24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
|
| Size: |
1463634
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD56BA.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD56BA.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf17.3.dr
|
| ID: |
dr_505
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.5286004619027067
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXOzXkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6WymD0wbnKNAH/lMz1
|
| Size: |
280
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD56EA.tmp\Ion_Boardroom.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD56EA.tmp\Ion_Boardroom.thmx
|
| Category: |
dropped
|
| Dump: |
Ion_Boardroom.thmx.3.dr
|
| ID: |
dr_521
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.907400454215888
|
| Encrypted: |
false
|
| Ssdeep: |
24576:zT2WTsZasyuJiyV0mDUoHLgwPjvgpEtrYpXjdHo8dJNgR6MxNTkdXylo:/KYlO3BpPTgpEtkpXJTgHxWuo
|
| Size: |
1593982
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD56EA.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD56EA.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf18.3.dr
|
| ID: |
dr_506
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.549050193282821
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXiXAKSwRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyX3qymD0wbnKNAH/lMz1
|
| Size: |
292
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD56FB.tmp\Droplet.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD56FB.tmp\Droplet.thmx
|
| Category: |
dropped
|
| Dump: |
Droplet.thmx.3.dr
|
| ID: |
dr_503
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.892395931401988
|
| Encrypted: |
false
|
| Ssdeep: |
24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
|
| Size: |
1750795
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD56FB.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD56FB.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf16.3.dr
|
| ID: |
dr_504
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.528155916440219
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXcmlDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyMmloymD0wbnKNAH/lMz1
|
| Size: |
280
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD58A3.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD58A3.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf22.3.dr
|
| ID: |
dr_533
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.599289509037855
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXwSil6RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyAflgymD0wbnKNAH/lMz1
|
| Size: |
304
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD58A3.tmp\myTemplate_02836342.thmx
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD58A3.tmp\myTemplate_02836342.thmx
|
| Category: |
dropped
|
| Dump: |
myTemplate_02836342.thmx.3.dr
|
| ID: |
dr_529
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.941741037170679
|
| Encrypted: |
false
|
| Ssdeep: |
24576:jS2WTsZasyuJiyV0mDUoHLgwPjvv96H8D86IRZ2s4p/H2rDCg+tuXlYMErpGzwZN:OKYlO3BpPTvc8oFZ29/Rg+rrDLr
|
| Size: |
1824766
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD58C3.tmp\Slate.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD58C3.tmp\Slate.thmx
|
| Category: |
dropped
|
| Dump: |
Slate.thmx.3.dr
|
| ID: |
dr_528
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.929430745829162
|
| Encrypted: |
false
|
| Ssdeep: |
49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
|
| Size: |
2357051
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD58C3.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD58C3.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf21.3.dr
|
| ID: |
dr_531
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.516423078177173
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUX7kARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny5ymD0wbnKNAH/lMz1
|
| Size: |
276
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5963.tmp\Depth.thmx
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5963.tmp\Depth.thmx
|
| Category: |
dropped
|
| Dump: |
Depth.thmx.3.dr
|
| ID: |
dr_541
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.9547975506532795
|
| Encrypted: |
false
|
| Ssdeep: |
49152:5HQKNdoI77mfXP/mDZLGkkgrODG1MHKr4nNtOmtu0:5HNjoygXnm0jgrODhqrsNcmtu0
|
| Size: |
2332136
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5963.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5963.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf20.3.dr
|
| ID: |
dr_525
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.5344681868414707
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUX4+RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyocymD0wbnKNAH/lMz1
|
| Size: |
276
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD59C1.tmp\Damask.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD59C1.tmp\Damask.thmx
|
| Category: |
dropped
|
| Dump: |
Damask.thmx.3.dr
|
| ID: |
dr_523
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.942378408801199
|
| Encrypted: |
false
|
| Ssdeep: |
49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
|
| Size: |
2218943
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD59C1.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD59C1.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf19.3.dr
|
| ID: |
dr_524
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.544065206514744
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXCARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyy6ymD0wbnKNAH/lMz1
|
| Size: |
278
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5A90.tmp\Madison.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5A90.tmp\Madison.thmx
|
| Category: |
dropped
|
| Dump: |
Madison.thmx.3.dr
|
| ID: |
dr_544
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.927032974390551
|
| Encrypted: |
false
|
| Ssdeep: |
49152:2HZkYR3gdOwBkskdDT+FQDGn5zpoLU0izCPOYZSKgdE6qFnm3DP+ulUnW:2jRkOlskJpDO5zpoKzZBKga6YmzWulUW
|
| Size: |
2443359
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5A90.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5A90.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf25.3.dr
|
| ID: |
dr_549
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.529695717494243
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUX0MAkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyEMVymD0wbnKNAH/lMz1
|
| Size: |
280
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5AA1.tmp\Main_Event.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5AA1.tmp\Main_Event.thmx
|
| Category: |
dropped
|
| Dump: |
Main_Event.thmx.3.dr
|
| ID: |
dr_545
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.970803022812704
|
| Encrypted: |
false
|
| Ssdeep: |
49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
|
| Size: |
2924237
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5AA1.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5AA1.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf24.3.dr
|
| ID: |
dr_548
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.5434534344080606
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXIc5+RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny4KcymD0wbnKNAH/lMz1
|
| Size: |
286
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5AA2.tmp\Mesh.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5AA2.tmp\Mesh.thmx
|
| Category: |
dropped
|
| Dump: |
Mesh.thmx.3.dr
|
| ID: |
dr_543
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.954129852655753
|
| Encrypted: |
false
|
| Ssdeep: |
49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
|
| Size: |
3078052
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5AA2.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5AA2.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf23.3.dr
|
| ID: |
dr_547
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.5303110391598502
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXzRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnylymD0wbnKNAH/lMz1
|
| Size: |
274
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5B32.tmp\Integral.thmx
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5B32.tmp\Integral.thmx
|
| Category: |
dropped
|
| Dump: |
Integral.thmx.3.dr
|
| ID: |
dr_582
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.939078022105486
|
| Encrypted: |
false
|
| Ssdeep: |
98304:hAABj6t8mC7x/pS6+X3Bzx37OjbqOMhbEsMWII5:ct8mC7x/pS6uBzp5NhAsMWt
|
| Size: |
3446188
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5B32.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5B32.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf29.3.dr
|
| ID: |
dr_584
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.52879087534807
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXG+kRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny2nymD0wbnKNAH/lMz1
|
| Size: |
282
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5B71.tmp\Celestial.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5B71.tmp\Celestial.thmx
|
| Category: |
dropped
|
| Dump: |
Celestial.thmx.3.dr
|
| ID: |
dr_580
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.9549249539064
|
| Encrypted: |
false
|
| Ssdeep: |
98304:RMKPrL1cgIF6jyoKfszvzC2UFsp3SUwDyMdghJU:RLPrGgIF6jJKAvO2UAiwU
|
| Size: |
3295051
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5B71.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5B71.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf28.3.dr
|
| ID: |
dr_578
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.5058612801050892
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUX1kRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyYymD0wbnKNAH/lMz1
|
| Size: |
284
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5C9C.tmp\Vapor_Trail.thmx
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5C9C.tmp\Vapor_Trail.thmx
|
| Category: |
dropped
|
| Dump: |
Vapor_Trail.thmx.3.dr
|
| ID: |
dr_574
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.965784120725206
|
| Encrypted: |
false
|
| Ssdeep: |
49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
|
| Size: |
3611324
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD5C9C.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD5C9C.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf27.3.dr
|
| ID: |
dr_575
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.5359188337181853
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXe46x8RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyO3UymD0wbnKNAH/lMz1
|
| Size: |
288
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD69AE.tmp\Organic.thmx
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
modified
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD69AE.tmp\Organic.thmx
|
| Category: |
modified
|
| Dump: |
Organic.thmx.3.dr
|
| ID: |
dr_571
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.955490103632122
|
| Encrypted: |
false
|
| Ssdeep: |
196608:fHnG7lmZcnwldXA4AZwsjVvWJ5u2AbKLCIV50CAmad7uS/5o:u7lVGXA4ABJWJc2A6rkno
|
| Size: |
8705569
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\TCD69AE.tmp\content.inf
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\TCD69AE.tmp\content.inf
|
| Category: |
dropped
|
| Dump: |
content.inf26.3.dr
|
| ID: |
dr_572
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
| Entropy: |
3.532897849466528
|
| Encrypted: |
false
|
| Ssdeep: |
6:Q+sxnxUXYwRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny5ymD0wbnKNAH/lMz1
|
| Size: |
280
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab50B6.tmp
|
Microsoft Cabinet archive data, many, 4410 bytes, 2 files, at 0x44 "PictureFrame.glox" "Content.inf", flags 0x4, number 1,
extra bytes 20 in head, 1 datablock, 0x1203 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab50B6.tmp
|
| Category: |
dropped
|
| Dump: |
cab50B6.tmp.3.dr
|
| ID: |
dr_671
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 4410 bytes, 2 files, at 0x44 "PictureFrame.glox" "Content.inf", flags 0x4, number 1,
extra bytes 20 in head, 1 datablock, 0x1203 compression
|
| Entropy: |
7.612044504501488
|
| Encrypted: |
false
|
| Ssdeep: |
384:zEAH676iPi8+IS5iqn7G8E0GftpBjExDxIHFLrHRN7Ke/ll7PK/pGaz6:zEhG8+ISrG8Pi6xDxCKoIGaz6
|
| Size: |
20554
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab50D6.tmp
|
Microsoft Cabinet archive data, many, 3749 bytes, 2 files, at 0x44 "TabbedArc.glox" "Content.inf", flags 0x4, number 1, extra
bytes 20 in head, 1 datablock, 0x1203 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab50D6.tmp
|
| Category: |
dropped
|
| Dump: |
cab50D6.tmp.3.dr
|
| ID: |
dr_674
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 3749 bytes, 2 files, at 0x44 "TabbedArc.glox" "Content.inf", flags 0x4, number 1, extra
bytes 20 in head, 1 datablock, 0x1203 compression
|
| Entropy: |
7.592090622603185
|
| Encrypted: |
false
|
| Ssdeep: |
384:v3Zh3VlkpSIcgbA8E0GftpBjEmm3UFLrHRN7GYvlvQyUTL2mTAp:v31qp/A8Pi6mUqGGvU+mcp
|
| Size: |
19893
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab50D7.tmp
|
Microsoft Cabinet archive data, many, 5647 bytes, 2 files, at 0x44 "RadialPictureList.glox" "Content.inf", flags 0x4, number
1, extra bytes 20 in head, 1 datablock, 0x1203 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab50D7.tmp
|
| Category: |
dropped
|
| Dump: |
cab50D7.tmp.3.dr
|
| ID: |
dr_16
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 5647 bytes, 2 files, at 0x44 "RadialPictureList.glox" "Content.inf", flags 0x4, number
1, extra bytes 20 in head, 1 datablock, 0x1203 compression
|
| Entropy: |
7.65837691872985
|
| Encrypted: |
false
|
| Ssdeep: |
384:PWew5RNDcvPgbA8E0GftpBjE0hsyaFLrHRN7BD9lI66YR:P3GRNDcEA8Pi60hsyABDo66g
|
| Size: |
21791
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab50D8.tmp
|
Microsoft Cabinet archive data, many, 4091 bytes, 2 files, at 0x44 "BracketList.glox" "Content.inf", flags 0x4, number 1,
extra bytes 20 in head, 1 datablock, 0x1203 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab50D8.tmp
|
| Category: |
dropped
|
| Dump: |
cab50D8.tmp.3.dr
|
| ID: |
dr_677
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 4091 bytes, 2 files, at 0x44 "BracketList.glox" "Content.inf", flags 0x4, number 1,
extra bytes 20 in head, 1 datablock, 0x1203 compression
|
| Entropy: |
7.61176626859621
|
| Encrypted: |
false
|
| Ssdeep: |
384:j3W3yGyjgbA8E0GftpBjEHvFLrHRN7pDAlI66Yv1:j3WFyAA8Pi6HVpDZ66c1
|
| Size: |
20235
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab50D9.tmp
|
Microsoft Cabinet archive data, many, 7453 bytes, 2 files, at 0x44 "pictureorgchart.glox" "Content.inf", flags 0x4, number
1, extra bytes 20 in head, 1 datablock, 0x1203 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab50D9.tmp
|
| Category: |
dropped
|
| Dump: |
cab50D9.tmp.3.dr
|
| ID: |
dr_37
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 7453 bytes, 2 files, at 0x44 "pictureorgchart.glox" "Content.inf", flags 0x4, number
1, extra bytes 20 in head, 1 datablock, 0x1203 compression
|
| Entropy: |
7.692965575678876
|
| Encrypted: |
false
|
| Ssdeep: |
384:y6aR//q0bJi/Uj+957G8E0GftpBj/4YOFLrHRN7LxhKll7PK/ph:y6I/Li/UjmVG8PiZ4YsLxh6Ih
|
| Size: |
23597
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab50DA.tmp
|
Microsoft Cabinet archive data, many, 9170 bytes, 2 files, at 0x44 "InterconnectedBlockProcess.glox" "Content.inf", flags
0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab50DA.tmp
|
| Category: |
dropped
|
| Dump: |
cab50DA.tmp.3.dr
|
| ID: |
dr_32
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 9170 bytes, 2 files, at 0x44 "InterconnectedBlockProcess.glox" "Content.inf", flags
0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
|
| Entropy: |
7.729848360340861
|
| Encrypted: |
false
|
| Ssdeep: |
384:75V23GNhfG/YvmBqWDP7G8E0GftpBjEB1vrFLrHRN7mKll7PK/pRU0:LS/Yvc7TG8Pi6BLm6IS0
|
| Size: |
25314
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab50DB.tmp
|
Microsoft Cabinet archive data, many, 5864 bytes, 2 files, at 0x44 "architecture.glox" "Content.inf", flags 0x4, number 1,
extra bytes 20 in head, 1 datablock, 0x1203 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab50DB.tmp
|
| Category: |
dropped
|
| Dump: |
cab50DB.tmp.3.dr
|
| ID: |
dr_35
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 5864 bytes, 2 files, at 0x44 "architecture.glox" "Content.inf", flags 0x4, number 1,
extra bytes 20 in head, 1 datablock, 0x1203 compression
|
| Entropy: |
7.662386258803613
|
| Encrypted: |
false
|
| Ssdeep: |
384:M7FUtfIdqSHQs7G8E0GftpBjED/C4RQrFLrHRN7TT8DlvQyUTL2mH:sWgdqR2G8Pi6D6YQZTTMvU+mH
|
| Size: |
22008
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab50DC.tmp
|
Microsoft Cabinet archive data, many, 4313 bytes, 2 files, at 0x44 "chevronaccent.glox" "Content.inf", flags 0x4, number 1,
extra bytes 20 in head, 1 datablock, 0x1203 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab50DC.tmp
|
| Category: |
dropped
|
| Dump: |
cab50DC.tmp.3.dr
|
| ID: |
dr_33
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 4313 bytes, 2 files, at 0x44 "chevronaccent.glox" "Content.inf", flags 0x4, number 1,
extra bytes 20 in head, 1 datablock, 0x1203 compression
|
| Entropy: |
7.612540359660869
|
| Encrypted: |
false
|
| Ssdeep: |
384:KyeISBuydn5rpmp77G8E0GftpBjE/kFLrHRN7ngslI66YVj:KHISBvd5rpmFG8Pi6/6nK666j
|
| Size: |
20457
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab50DD.tmp
|
Microsoft Cabinet archive data, many, 14939 bytes, 2 files, at 0x44 "CircleProcess.glox" "Content.inf", flags 0x4, number
1, extra bytes 20 in head, 1 datablock, 0x1203 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab50DD.tmp
|
| Category: |
dropped
|
| Dump: |
cab50DD.tmp.3.dr
|
| ID: |
dr_31
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 14939 bytes, 2 files, at 0x44 "CircleProcess.glox" "Content.inf", flags 0x4, number
1, extra bytes 20 in head, 1 datablock, 0x1203 compression
|
| Entropy: |
7.814202819173796
|
| Encrypted: |
false
|
| Ssdeep: |
384:0XbSq3W46TVZb5fOFo1HtZwGqtRT44hS+nyBoiuFgbA8E0GftpBjEcBFLrHRN7Ku:0XpOflfOFo1DMr/iuuA8Pi6cfKjW66b
|
| Size: |
31083
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab50DE.tmp
|
Microsoft Cabinet archive data, many, 4967 bytes, 2 files, at 0x44 "TabList.glox" "Content.inf", flags 0x4, number 1, extra
bytes 20 in head, 1 datablock, 0x1203 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab50DE.tmp
|
| Category: |
dropped
|
| Dump: |
cab50DE.tmp.3.dr
|
| ID: |
dr_30
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 4967 bytes, 2 files, at 0x44 "TabList.glox" "Content.inf", flags 0x4, number 1, extra
bytes 20 in head, 1 datablock, 0x1203 compression
|
| Entropy: |
7.6297992466897675
|
| Encrypted: |
false
|
| Ssdeep: |
384:wWZsOvbMZGgbA8E0GftpBjEtnFLrHRN7Dfll7PK/pirk:xZRvuzA8Pi6t9DPISk
|
| Size: |
21111
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab511F.tmp
|
Microsoft Cabinet archive data, many, 6450 bytes, 2 files, at 0x44 "ThemePictureAccent.glox" "Content.inf", flags 0x4, number
1, extra bytes 20 in head, 1 datablock, 0x1203 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab511F.tmp
|
| Category: |
dropped
|
| Dump: |
cab511F.tmp.3.dr
|
| ID: |
dr_64
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 6450 bytes, 2 files, at 0x44 "ThemePictureAccent.glox" "Content.inf", flags 0x4, number
1, extra bytes 20 in head, 1 datablock, 0x1203 compression
|
| Entropy: |
7.674816892242868
|
| Encrypted: |
false
|
| Ssdeep: |
384:L7d2l8FbHaaIKbtv1gDISi8E0GftpBjEZRFLrHRN74bUll7PK/pd:LUlCIOt/8Pi6Zv4bMId
|
| Size: |
22594
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5122.tmp
|
Microsoft Cabinet archive data, many, 5213 bytes, 2 files, at 0x44 "rings.glox" "Content.inf", flags 0x4, number 1, extra
bytes 20 in head, 1 datablock, 0x1203 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5122.tmp
|
| Category: |
dropped
|
| Dump: |
cab5122.tmp.3.dr
|
| ID: |
dr_29
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 5213 bytes, 2 files, at 0x44 "rings.glox" "Content.inf", flags 0x4, number 1, extra
bytes 20 in head, 1 datablock, 0x1203 compression
|
| Entropy: |
7.641082043198371
|
| Encrypted: |
false
|
| Ssdeep: |
384:zdx+NRrogu6fzCI7Th7G8E0GftpBjEzZq4FLrHRN7/Oll7PK/pB:/+NRrFf/G8Pi6zZb/GIB
|
| Size: |
21357
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5124.tmp
|
Microsoft Cabinet archive data, many, 6005 bytes, 2 files, at 0x44 "HexagonRadial.glox" "Content.inf", flags 0x4, number 1,
extra bytes 20 in head, 1 datablock, 0x1203 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5124.tmp
|
| Category: |
dropped
|
| Dump: |
cab5124.tmp.3.dr
|
| ID: |
dr_28
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 6005 bytes, 2 files, at 0x44 "HexagonRadial.glox" "Content.inf", flags 0x4, number 1,
extra bytes 20 in head, 1 datablock, 0x1203 compression
|
| Entropy: |
7.659898883631361
|
| Encrypted: |
false
|
| Ssdeep: |
384:b98FG/zdCbf7BOEawSi8E0GftpBjEPTFPxFLrHRN7S5ll7PK/pA2:N/zAbDae8Pi6PFPSRIA2
|
| Size: |
22149
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5125.tmp
|
Microsoft Cabinet archive data, many, 3144 bytes, 2 files, at 0x44 "VaryingWidthList.glox" "Content.inf", flags 0x4, number
1, extra bytes 20 in head, 1 datablock, 0x1203 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5125.tmp
|
| Category: |
dropped
|
| Dump: |
cab5125.tmp.3.dr
|
| ID: |
dr_27
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 3144 bytes, 2 files, at 0x44 "VaryingWidthList.glox" "Content.inf", flags 0x4, number
1, extra bytes 20 in head, 1 datablock, 0x1203 compression
|
| Entropy: |
7.570850633867256
|
| Encrypted: |
false
|
| Ssdeep: |
384:5ZII4Hf+7G8E0GftpBjCwBFLrHRN7bcClvQyUTL2mH:pG8PicgbcAvU+mH
|
| Size: |
19288
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5126.tmp
|
Microsoft Cabinet archive data, many, 5731 bytes, 2 files, at 0x44 "ThemePictureAlternatingAccent.glox" "Content.inf", flags
0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5126.tmp
|
| Category: |
dropped
|
| Dump: |
cab5126.tmp.3.dr
|
| ID: |
dr_46
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 5731 bytes, 2 files, at 0x44 "ThemePictureAlternatingAccent.glox" "Content.inf", flags
0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
|
| Entropy: |
7.6559132103953305
|
| Encrypted: |
false
|
| Ssdeep: |
384:k73HRpZA6B3ulrnxtRT7G8E0GftpBjEdHqlFLrHRN7uhFlvQyUTL2m4c:k7XRgIkrG8Pi6dmuNvU+mp
|
| Size: |
21875
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5127.tmp
|
Microsoft Cabinet archive data, many, 6196 bytes, 2 files, at 0x44 "ThemePictureGrid.glox" "Content.inf", flags 0x4, number
1, extra bytes 20 in head, 1 datablock, 0x1203 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5127.tmp
|
| Category: |
dropped
|
| Dump: |
cab5127.tmp.3.dr
|
| ID: |
dr_26
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 6196 bytes, 2 files, at 0x44 "ThemePictureGrid.glox" "Content.inf", flags 0x4, number
1, extra bytes 20 in head, 1 datablock, 0x1203 compression
|
| Entropy: |
7.668619892503165
|
| Encrypted: |
false
|
| Ssdeep: |
384:GByvLdFHny7G8E0GftpBjE8upFLrHRN778lvQyUTL2mm2y:Oy3HkG8Pi6887mvU+ma
|
| Size: |
22340
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5128.tmp
|
Microsoft Cabinet archive data, many, 10800 bytes, 2 files, at 0x44 "ConvergingText.glox" "Content.inf", flags 0x4, number
1, extra bytes 20 in head, 1 datablock, 0x1203 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5128.tmp
|
| Category: |
dropped
|
| Dump: |
cab5128.tmp.3.dr
|
| ID: |
dr_67
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 10800 bytes, 2 files, at 0x44 "ConvergingText.glox" "Content.inf", flags 0x4, number
1, extra bytes 20 in head, 1 datablock, 0x1203 compression
|
| Entropy: |
7.7574645319832225
|
| Encrypted: |
false
|
| Ssdeep: |
384:sbUX16g8/atF4NB3TJOvqeMRD/8svIZj/OwgbA8E0GftpBjEYwFLrHRN7mYll7PY:sbhg8yY4nMZK2hA8Pi6Yum4IVR
|
| Size: |
26944
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab523F.tmp
|
Microsoft Cabinet archive data, many, 206792 bytes, 2 files, at 0x44 +A "content.inf" +A "View.thmx", flags 0x4, ID 33885,
number 1, extra bytes 20 in head, 15 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab523F.tmp
|
| Category: |
dropped
|
| Dump: |
cab523F.tmp.3.dr
|
| ID: |
dr_146
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 206792 bytes, 2 files, at 0x44 +A "content.inf" +A "View.thmx", flags 0x4, ID 33885,
number 1, extra bytes 20 in head, 15 datablocks, 0x1503 compression
|
| Entropy: |
7.994458910952451
|
| Encrypted: |
true
|
| Ssdeep: |
6144:k8/c2cF9GTLqsTmYstUdx+dwb2ooiVOfiI17zWbQ:jbzqGdpbZ/Mf3h68
|
| Size: |
222992
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab529F.tmp
|
Microsoft Cabinet archive data, many, 259074 bytes, 2 files, at 0x44 +A "content.inf" +A "Dividend.thmx", flags 0x4, ID 58359,
number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab529F.tmp
|
| Category: |
dropped
|
| Dump: |
cab529F.tmp.3.dr
|
| ID: |
dr_139
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 259074 bytes, 2 files, at 0x44 +A "content.inf" +A "Dividend.thmx", flags 0x4, ID 58359,
number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
|
| Entropy: |
7.995561338730199
|
| Encrypted: |
true
|
| Ssdeep: |
6144:H2a+HFkDF8gpmMt4kzwVVqhSYO6DITxPWgJl1CFExwXyo7N:mlZgFtIVVTuDExeWuv7N
|
| Size: |
276650
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab52B0.tmp
|
Microsoft Cabinet archive data, many, 279287 bytes, 2 files, at 0x44 +A "Basis.thmx" +A "content.inf", flags 0x4, ID 55632,
number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab52B0.tmp
|
| Category: |
dropped
|
| Dump: |
cab52B0.tmp.3.dr
|
| ID: |
dr_138
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 279287 bytes, 2 files, at 0x44 +A "Basis.thmx" +A "content.inf", flags 0x4, ID 55632,
number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
|
| Entropy: |
7.996203550147553
|
| Encrypted: |
true
|
| Ssdeep: |
6144:nwVaEqsf23c9shf6UyOGgDWDn/p3fd+zkPWnvGL3n9bQnkmVheyqtkl:MlPfW6sVEDn/pPdhWnvGL36zyyqal
|
| Size: |
295527
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab52D1.tmp
|
Microsoft Cabinet archive data, many, 252241 bytes, 2 files, at 0x44 +A "content.inf" +A "Frame.thmx", flags 0x4, ID 34169,
number 1, extra bytes 20 in head, 16 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab52D1.tmp
|
| Category: |
dropped
|
| Dump: |
cab52D1.tmp.3.dr
|
| ID: |
dr_136
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 252241 bytes, 2 files, at 0x44 +A "content.inf" +A "Frame.thmx", flags 0x4, ID 34169,
number 1, extra bytes 20 in head, 16 datablocks, 0x1503 compression
|
| Entropy: |
7.995547668305345
|
| Encrypted: |
true
|
| Ssdeep: |
6144:zfdvQnJMwXse4Vradf3mrC7woyWbjKlCVC7K:zfJwJse4VrS1AK
|
| Size: |
271273
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5303.tmp
|
Microsoft Cabinet archive data, many, 243642 bytes, 2 files, at 0x44 +A "content.inf" +A "Metropolitan.thmx", flags 0x4, ID
19054, number 1, extra bytes 20 in head, 24 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5303.tmp
|
| Category: |
dropped
|
| Dump: |
cab5303.tmp.3.dr
|
| ID: |
dr_179
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 243642 bytes, 2 files, at 0x44 +A "content.inf" +A "Metropolitan.thmx", flags 0x4, ID
19054, number 1, extra bytes 20 in head, 24 datablocks, 0x1503 compression
|
| Entropy: |
7.99541965268665
|
| Encrypted: |
true
|
| Ssdeep: |
6144:9blShNYrHNn0JU+D+kh8CIjXHWC7X0nZLC9Ge2KY/WfI:9ZSTYrtn0Sk+CIDHWC7chVKYx
|
| Size: |
261258
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5324.tmp
|
Microsoft Cabinet archive data, many, 291188 bytes, 2 files, at 0x44 +A "Banded.thmx" +A "content.inf", flags 0x4, ID 56338,
number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5324.tmp
|
| Category: |
dropped
|
| Dump: |
cab5324.tmp.3.dr
|
| ID: |
dr_170
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 291188 bytes, 2 files, at 0x44 +A "Banded.thmx" +A "content.inf", flags 0x4, ID 56338,
number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
|
| Entropy: |
7.996451393909308
|
| Encrypted: |
true
|
| Ssdeep: |
6144:7vH3uG+yiWx0eVJyORloyyDqnHefzOs81MrXLXx7:b36yiWH/LRS2CJl1
|
| Size: |
307348
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5344.tmp
|
Microsoft Cabinet archive data, many, 471473 bytes, 2 files, at 0x44 +A "content.inf" +A "Facet.thmx", flags 0x4, ID 35621,
number 1, extra bytes 20 in head, 23 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5344.tmp
|
| Category: |
dropped
|
| Dump: |
cab5344.tmp.3.dr
|
| ID: |
dr_168
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 471473 bytes, 2 files, at 0x44 +A "content.inf" +A "Facet.thmx", flags 0x4, ID 35621,
number 1, extra bytes 20 in head, 23 datablocks, 0x1503 compression
|
| Entropy: |
7.997899883595182
|
| Encrypted: |
true
|
| Ssdeep: |
6144:mPoUL7rdGbRXiXMDCVcP0EO3bozD1icl+CabWQRgqOqqs/eMFq8qZumLXvjKUUo6:2D9QdiXMbMxUti/RbWhqcMw8WKUUovC
|
| Size: |
487545
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5385.tmp
|
Microsoft Cabinet archive data, many, 214772 bytes, 2 files, at 0x44 +A "content.inf" +A "Parcel.thmx", flags 0x4, ID 26500,
number 1, extra bytes 20 in head, 19 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5385.tmp
|
| Category: |
dropped
|
| Dump: |
cab5385.tmp.3.dr
|
| ID: |
dr_225
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 214772 bytes, 2 files, at 0x44 +A "content.inf" +A "Parcel.thmx", flags 0x4, ID 26500,
number 1, extra bytes 20 in head, 19 datablocks, 0x1503 compression
|
| Entropy: |
7.994759087207758
|
| Encrypted: |
true
|
| Ssdeep: |
6144:OTIPtMXmJWnzPS3pqnkeuJXW+FNx1a72rLiQxEBTR:750nz63/FJRFLISnp+Bt
|
| Size: |
230916
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5386.tmp
|
Microsoft Cabinet archive data, many, 480282 bytes, 2 files, at 0x44 +A "content.inf" +A "Wisp.thmx", flags 0x4, ID 56119,
number 1, extra bytes 20 in head, 25 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5386.tmp
|
| Category: |
dropped
|
| Dump: |
cab5386.tmp.3.dr
|
| ID: |
dr_166
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 480282 bytes, 2 files, at 0x44 +A "content.inf" +A "Wisp.thmx", flags 0x4, ID 56119,
number 1, extra bytes 20 in head, 25 datablocks, 0x1503 compression
|
| Entropy: |
7.997206654807112
|
| Encrypted: |
true
|
| Ssdeep: |
12288:ZqKfByFV1zSEVKRLYSh6YaYJkImjMjmf0fPae/:Z5QFV1GRbhvaYKB0fy8
|
| Size: |
496354
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab53A7.tmp
|
Microsoft Cabinet archive data, many, 533290 bytes, 2 files, at 0x44 +A "content.inf" +A "Parallax.thmx", flags 0x4, ID 64081,
number 1, extra bytes 20 in head, 29 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab53A7.tmp
|
| Category: |
dropped
|
| Dump: |
cab53A7.tmp.3.dr
|
| ID: |
dr_204
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 533290 bytes, 2 files, at 0x44 +A "content.inf" +A "Parallax.thmx", flags 0x4, ID 64081,
number 1, extra bytes 20 in head, 29 datablocks, 0x1503 compression
|
| Entropy: |
7.998289614787931
|
| Encrypted: |
true
|
| Ssdeep: |
12288:N4Ar9NyDhUQM0Hk86V1YnOIxQ9e6SJbj2OjK:jAG8wa5Qw6SZ2Oj
|
| Size: |
550906
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab53C8.tmp
|
Microsoft Cabinet archive data, many, 704319 bytes, 2 files, at 0x44 +A "content.inf" +A "Wood_Type.thmx", flags 0x4, ID 5778,
number 1, extra bytes 20 in head, 51 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab53C8.tmp
|
| Category: |
dropped
|
| Dump: |
cab53C8.tmp.3.dr
|
| ID: |
dr_202
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 704319 bytes, 2 files, at 0x44 +A "content.inf" +A "Wood_Type.thmx", flags 0x4, ID 5778,
number 1, extra bytes 20 in head, 51 datablocks, 0x1503 compression
|
| Entropy: |
7.997550445816903
|
| Encrypted: |
true
|
| Ssdeep: |
12288:NPnBZX7wR3tMwYqNDQGnXTtfzO5U7yo6O7bLhe8yE3LLDok4a:JBMbYE7xzO5U917bLh/DL3oJa
|
| Size: |
723359
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab540B.tmp
|
Microsoft Cabinet archive data, many, 437097 bytes, 2 files, at 0x44 +A "Atlas.thmx" +A "content.inf", flags 0x4, ID 18422,
number 1, extra bytes 20 in head, 27 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab540B.tmp
|
| Category: |
dropped
|
| Dump: |
cab540B.tmp.3.dr
|
| ID: |
dr_238
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 437097 bytes, 2 files, at 0x44 +A "Atlas.thmx" +A "content.inf", flags 0x4, ID 18422,
number 1, extra bytes 20 in head, 27 datablocks, 0x1503 compression
|
| Entropy: |
7.997509772969848
|
| Encrypted: |
true
|
| Ssdeep: |
6144:Ggji1e3pEwbB2Y02HSiPTiGE74Go8D6CFQQ5sIxrV2CnOzIt5E6H7f1ADW0QFQhX:GMP9JTHjPuT9+KKIKCnO16bfGGStAM
|
| Size: |
453305
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab541B.tmp
|
Microsoft Cabinet archive data, many, 624532 bytes, 2 files, at 0x44 +A "content.inf" +A "Quotable.thmx", flags 0x4, ID 13510,
number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab541B.tmp
|
| Category: |
dropped
|
| Dump: |
cab541B.tmp.3.dr
|
| ID: |
dr_247
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 624532 bytes, 2 files, at 0x44 +A "content.inf" +A "Quotable.thmx", flags 0x4, ID 13510,
number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
|
| Entropy: |
7.99860205353102
|
| Encrypted: |
true
|
| Ssdeep: |
12288:eV7ivfl+kbkIrWu+2aoRjwv/cSUWauGPo2v65s4QqcT3ZCCz6CSj8aC:fdhr1+3y4MWaC2CO4V+3ZCCDsO
|
| Size: |
640684
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab547C.tmp
|
Microsoft Cabinet archive data, many, 682092 bytes, 2 files, at 0x44 +A "Berlin.thmx" +A "content.inf", flags 0x4, ID 46672,
number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab547C.tmp
|
| Category: |
dropped
|
| Dump: |
cab547C.tmp.3.dr
|
| ID: |
dr_241
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 682092 bytes, 2 files, at 0x44 +A "Berlin.thmx" +A "content.inf", flags 0x4, ID 46672,
number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
|
| Entropy: |
7.997838239368002
|
| Encrypted: |
true
|
| Ssdeep: |
12288:bUfKzAwwP7XAMWtr4FvMRt4lX0hnBdThiSb32+TdysrQgn7v4EemC6:sr7AMkJ34xu1bm4ZrQaY6
|
| Size: |
698244
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab55D6.tmp
|
Microsoft Cabinet archive data, many, 1049713 bytes, 2 files, at 0x44 +A "content.inf" +A "Savon.thmx", flags 0x4, ID 60609,
number 1, extra bytes 20 in head, 37 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab55D6.tmp
|
| Category: |
dropped
|
| Dump: |
cab55D6.tmp.3.dr
|
| ID: |
dr_280
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 1049713 bytes, 2 files, at 0x44 +A "content.inf" +A "Savon.thmx", flags 0x4, ID 60609,
number 1, extra bytes 20 in head, 37 datablocks, 0x1503 compression
|
| Entropy: |
7.998277814657051
|
| Encrypted: |
true
|
| Ssdeep: |
24576:qehtHA3nsAOx7yN7THwxdGpkw8R60aTcua5U4c:hhmnsBMNAxdGpV5za5Uv
|
| Size: |
1065873
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab55D7.tmp
|
Microsoft Cabinet archive data, many, 937309 bytes, 2 files, at 0x44 +A "content.inf" +A "Gallery.thmx", flags 0x4, ID 44349,
number 1, extra bytes 20 in head, 34 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab55D7.tmp
|
| Category: |
dropped
|
| Dump: |
cab55D7.tmp.3.dr
|
| ID: |
dr_279
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 937309 bytes, 2 files, at 0x44 +A "content.inf" +A "Gallery.thmx", flags 0x4, ID 44349,
number 1, extra bytes 20 in head, 34 datablocks, 0x1503 compression
|
| Entropy: |
7.99899040756787
|
| Encrypted: |
true
|
| Ssdeep: |
24576:9B1Onw3vg7aeYPagzbJ5Vhv6LnV2Dhl7GEYqVjcyd:vww3o7BYPJbJ5Vh6UCqZfd
|
| Size: |
953453
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab55F7.tmp
|
Microsoft Cabinet archive data, many, 1072808 bytes, 2 files, at 0x44 +A "content.inf" +A "Retrospect.thmx", flags 0x4, ID
59128, number 1, extra bytes 20 in head, 50 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab55F7.tmp
|
| Category: |
dropped
|
| Dump: |
cab55F7.tmp.3.dr
|
| ID: |
dr_288
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 1072808 bytes, 2 files, at 0x44 +A "content.inf" +A "Retrospect.thmx", flags 0x4, ID
59128, number 1, extra bytes 20 in head, 50 datablocks, 0x1503 compression
|
| Entropy: |
7.9927994027199425
|
| Encrypted: |
true
|
| Ssdeep: |
24576:h2WZfFbGSoB3Pf/u/V1HTysuGrieyhhwSvxqi6Spqsgx:h2WZfF6NB3XM1z9rALvOS6x
|
| Size: |
1088984
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5629.tmp
|
Microsoft Cabinet archive data, many, 1081343 bytes, 2 files, at 0x44 +A "Circuit.thmx" +A "content.inf", flags 0x4, ID 11309,
number 1, extra bytes 20 in head, 45 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5629.tmp
|
| Category: |
dropped
|
| Dump: |
cab5629.tmp.3.dr
|
| ID: |
dr_283
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 1081343 bytes, 2 files, at 0x44 +A "Circuit.thmx" +A "content.inf", flags 0x4, ID 11309,
number 1, extra bytes 20 in head, 45 datablocks, 0x1503 compression
|
| Entropy: |
7.99825462915052
|
| Encrypted: |
true
|
| Ssdeep: |
24576:UE9BMy98gA4cDWHkSrDans3MfEE6w8OaVuCibol0j41dwD:UE9Bdy3D4keQWt7w85VuVoaj4/Q
|
| Size: |
1097591
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5698.tmp
|
Microsoft Cabinet archive data, many, 1377563 bytes, 2 files, at 0x44 +A "content.inf" +A "Ion_Boardroom.thmx", flags 0x4,
ID 26781, number 1, extra bytes 20 in head, 49 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5698.tmp
|
| Category: |
dropped
|
| Dump: |
cab5698.tmp.3.dr
|
| ID: |
dr_511
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 1377563 bytes, 2 files, at 0x44 +A "content.inf" +A "Ion_Boardroom.thmx", flags 0x4,
ID 26781, number 1, extra bytes 20 in head, 49 datablocks, 0x1503 compression
|
| Entropy: |
7.998039489696127
|
| Encrypted: |
true
|
| Ssdeep: |
24576:pI4ga3jIAemcNjI7L6+iXZ4vI+arjU/QxJMT+wBeXTKgd:Rga9JcNM7L6+oZiyU/Q7G+KeXTKgd
|
| Size: |
1393811
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab56A9.tmp
|
Microsoft Cabinet archive data, many, 1291243 bytes, 2 files, at 0x44 +A "content.inf" +A "Droplet.thmx", flags 0x4, ID 47417,
number 1, extra bytes 20 in head, 54 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab56A9.tmp
|
| Category: |
dropped
|
| Dump: |
cab56A9.tmp.3.dr
|
| ID: |
dr_509
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 1291243 bytes, 2 files, at 0x44 +A "content.inf" +A "Droplet.thmx", flags 0x4, ID 47417,
number 1, extra bytes 20 in head, 54 datablocks, 0x1503 compression
|
| Entropy: |
7.9985829899274385
|
| Encrypted: |
true
|
| Ssdeep: |
24576:NN3M9UHpHZE4aubaPubP3M6d71FdtmFAjq+54/79LVzG+VnS:NN3M9UJHZE4abPyU4JtmFCq+q/7JlVS
|
| Size: |
1310275
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab56EB.tmp
|
Microsoft Cabinet archive data, many, 1593091 bytes, 2 files, at 0x44 +A "content.inf" +A "myTemplate_02836342.thmx", flags
0x4, ID 49870, number 1, extra bytes 20 in head, 56 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab56EB.tmp
|
| Category: |
dropped
|
| Dump: |
cab56EB.tmp.3.dr
|
| ID: |
dr_507
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 1593091 bytes, 2 files, at 0x44 +A "content.inf" +A "myTemplate_02836342.thmx", flags
0x4, ID 49870, number 1, extra bytes 20 in head, 56 datablocks, 0x1503 compression
|
| Entropy: |
7.9984205861574775
|
| Encrypted: |
true
|
| Ssdeep: |
24576:lAqpS8Oo3NP518YJ7quri1kR0BnuLtBz1GS1fB9z29q4Gdu7BR/jKg5rp:lAWAGNPLJ7qugk6o3AlGdcR/jjrp
|
| Size: |
1609163
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5864.tmp
|
Microsoft Cabinet archive data, many, 1750009 bytes, 2 files, at 0x44 +A "content.inf" +A "Slate.thmx", flags 0x4, ID 28969,
number 1, extra bytes 20 in head, 72 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5864.tmp
|
| Category: |
dropped
|
| Dump: |
cab5864.tmp.3.dr
|
| ID: |
dr_519
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 1750009 bytes, 2 files, at 0x44 +A "content.inf" +A "Slate.thmx", flags 0x4, ID 28969,
number 1, extra bytes 20 in head, 72 datablocks, 0x1503 compression
|
| Entropy: |
7.9991290831091115
|
| Encrypted: |
true
|
| Ssdeep: |
24576:O/gjMj+RP9Q07h9F75a0BXjBccHMVk2Hq2SkGa0QglyZtxmdPP2LcSUtfgfp16Yx:kJ6RP9Q07/X5V7yVF0QgktxAPutUt0zP
|
| Size: |
1766185
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5903.tmp
|
Microsoft Cabinet archive data, many, 2042491 bytes, 2 files, at 0x44 +A "content.inf" +A "Depth.thmx", flags 0x4, ID 63414,
number 1, extra bytes 20 in head, 72 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5903.tmp
|
| Category: |
dropped
|
| Dump: |
cab5903.tmp.3.dr
|
| ID: |
dr_527
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 2042491 bytes, 2 files, at 0x44 +A "content.inf" +A "Depth.thmx", flags 0x4, ID 63414,
number 1, extra bytes 20 in head, 72 datablocks, 0x1503 compression
|
| Entropy: |
7.997107658057165
|
| Encrypted: |
true
|
| Ssdeep: |
49152:5IgXLOTa1MKe/VpMDaIWRzU3lLqvaF1buL7rNQVxE:WgXaMMrViuIWtUkvGoHr+W
|
| Size: |
2058715
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5952.tmp
|
Microsoft Cabinet archive data, many, 1865728 bytes, 2 files, at 0x44 +A "content.inf" +A "Damask.thmx", flags 0x4, ID 63852,
number 1, extra bytes 20 in head, 68 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5952.tmp
|
| Category: |
dropped
|
| Dump: |
cab5952.tmp.3.dr
|
| ID: |
dr_526
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 1865728 bytes, 2 files, at 0x44 +A "content.inf" +A "Damask.thmx", flags 0x4, ID 63852,
number 1, extra bytes 20 in head, 68 datablocks, 0x1503 compression
|
| Entropy: |
7.999066394602922
|
| Encrypted: |
true
|
| Ssdeep: |
49152:6Wp9u/ZAvKz7ZFCejPiSmYXKIr6kBwBUA:6W6Bn7ZFNiiKo2l
|
| Size: |
1881952
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5A30.tmp
|
Microsoft Cabinet archive data, many, 2511552 bytes, 2 files, at 0x44 +A "content.inf" +A "Main_Event.thmx", flags 0x4, ID
59889, number 1, extra bytes 20 in head, 90 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5A30.tmp
|
| Category: |
dropped
|
| Dump: |
cab5A30.tmp.3.dr
|
| ID: |
dr_556
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 2511552 bytes, 2 files, at 0x44 +A "content.inf" +A "Main_Event.thmx", flags 0x4, ID
59889, number 1, extra bytes 20 in head, 90 datablocks, 0x1503 compression
|
| Entropy: |
7.992272975565323
|
| Encrypted: |
true
|
| Ssdeep: |
49152:NFXdpz4d98p/q5jA4q+9Uf5kx6wHR8WfPJZVhWzH4dRze76YP9nJ7yyAInT76nSY:NFXdKx5sM9SmxHKexZVhutJJVpCSqa0Z
|
| Size: |
2527736
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5A31.tmp
|
Microsoft Cabinet archive data, many, 2573508 bytes, 2 files, at 0x44 +A "content.inf" +A "Mesh.thmx", flags 0x4, ID 62129,
number 1, extra bytes 20 in head, 94 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5A31.tmp
|
| Category: |
dropped
|
| Dump: |
cab5A31.tmp.3.dr
|
| ID: |
dr_553
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 2573508 bytes, 2 files, at 0x44 +A "content.inf" +A "Mesh.thmx", flags 0x4, ID 62129,
number 1, extra bytes 20 in head, 94 datablocks, 0x1503 compression
|
| Entropy: |
7.999030891647433
|
| Encrypted: |
true
|
| Ssdeep: |
49152:ZSBBeAefkpB5iXfQJgi7JBaCCRZ3cM2VDHkvSJO6qzI1tE9Rn:EBI6gbCkMPDHKSJO6qsP6n
|
| Size: |
2591108
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5A32.tmp
|
Microsoft Cabinet archive data, many, 2132545 bytes, 2 files, at 0x44 +A "content.inf" +A "Madison.thmx", flags 0x4, ID 44832,
number 1, extra bytes 20 in head, 75 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5A32.tmp
|
| Category: |
dropped
|
| Dump: |
cab5A32.tmp.3.dr
|
| ID: |
dr_551
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 2132545 bytes, 2 files, at 0x44 +A "content.inf" +A "Madison.thmx", flags 0x4, ID 44832,
number 1, extra bytes 20 in head, 75 datablocks, 0x1503 compression
|
| Entropy: |
7.9987997302874785
|
| Encrypted: |
true
|
| Ssdeep: |
49152:3S7Eynda/aPhPWgYPaNu/I757rju1RAVRe3i89Y7NAc4gdCCg:3S7EyCatWBaNuwi1RuRg9YhT4wVg
|
| Size: |
2148753
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5AB3.tmp
|
Microsoft Cabinet archive data, many, 2738786 bytes, 2 files, at 0x44 +A "content.inf" +A "Integral.thmx", flags 0x4, ID 26156,
number 1, extra bytes 20 in head, 106 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5AB3.tmp
|
| Category: |
dropped
|
| Dump: |
cab5AB3.tmp.3.dr
|
| ID: |
dr_546
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 2738786 bytes, 2 files, at 0x44 +A "content.inf" +A "Integral.thmx", flags 0x4, ID 26156,
number 1, extra bytes 20 in head, 106 datablocks, 0x1503 compression
|
| Entropy: |
7.998611101143596
|
| Encrypted: |
true
|
| Ssdeep: |
49152:3+eO6OYqspfKnz1J4qgcvFhud2BbPI6fp4q7+lyip3vyUM5ZCFwNn3zMiSfM:386mEfGn4jcvFhD1p4uw1pqUDmn3wiUM
|
| Size: |
2754858
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5AD3.tmp
|
Microsoft Cabinet archive data, many, 2871083 bytes, 2 files, at 0x44 +A "Celestial.thmx" +A "content.inf", flags 0x4, ID
12122, number 1, extra bytes 20 in head, 101 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5AD3.tmp
|
| Category: |
dropped
|
| Dump: |
cab5AD3.tmp.3.dr
|
| ID: |
dr_542
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 2871083 bytes, 2 files, at 0x44 +A "Celestial.thmx" +A "content.inf", flags 0x4, ID
12122, number 1, extra bytes 20 in head, 101 datablocks, 0x1503 compression
|
| Entropy: |
7.998455532594825
|
| Encrypted: |
true
|
| Ssdeep: |
49152:qUwqNNZTcomaX/9ImsCnslPrLI6hzr6BifW7JR4uyIpT/hwnXRtJWmMm1vVGoyqP:qvqR5ms9noPrEKzWB0WMuyIpT/hwnXXF
|
| Size: |
2887155
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab5C3D.tmp
|
Microsoft Cabinet archive data, many, 3239239 bytes, 2 files, at 0x44 +A "content.inf" +A "Vapor_Trail.thmx", flags 0x4, ID
19811, number 1, extra bytes 20 in head, 111 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab5C3D.tmp
|
| Category: |
dropped
|
| Dump: |
cab5C3D.tmp.3.dr
|
| ID: |
dr_576
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 3239239 bytes, 2 files, at 0x44 +A "content.inf" +A "Vapor_Trail.thmx", flags 0x4, ID
19811, number 1, extra bytes 20 in head, 111 datablocks, 0x1503 compression
|
| Entropy: |
7.996842935632312
|
| Encrypted: |
true
|
| Ssdeep: |
98304:wh7I1aeH9YvgK+A+a7GiiQzP4YZDpQ2+Sd6Y:w21ay93aypQzzhpBL/
|
| Size: |
3256855
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\cab68E2.tmp
|
Microsoft Cabinet archive data, many, 8162257 bytes, 2 files, at 0x44 +A "content.inf" +A "Organic.thmx", flags 0x4, ID 28519,
number 1, extra bytes 20 in head, 266 datablocks, 0x1503 compression
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\cab68E2.tmp
|
| Category: |
dropped
|
| Dump: |
cab68E2.tmp.3.dr
|
| ID: |
dr_573
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft Cabinet archive data, many, 8162257 bytes, 2 files, at 0x44 +A "content.inf" +A "Organic.thmx", flags 0x4, ID 28519,
number 1, extra bytes 20 in head, 266 datablocks, 0x1503 compression
|
| Entropy: |
7.998487287228825
|
| Encrypted: |
true
|
| Ssdeep: |
196608:Uu4B2pbfn0wQZOGTHYuFdzCACe9QWPNZKPmMsDfB8D6T:UuTVfn0BcGTHl9Ce9QWPNZKPmHB8eT
|
| Size: |
8178537
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Payout Receipt.LNK
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Feb 7 13:52:16
2024, mtime=Fri Oct 4 12:10:37 2024, atime=Fri Oct 4 12:10:34 2024, length=210853, window=hide
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Payout Receipt.LNK
|
| Category: |
dropped
|
| Dump: |
Payout Receipt.LNK.3.dr
|
| ID: |
dr_0
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Feb 7 13:52:16
2024, mtime=Fri Oct 4 12:10:37 2024, atime=Fri Oct 4 12:10:34 2024, length=210853, window=hide
|
| Entropy: |
4.728841703960836
|
| Encrypted: |
false
|
| Ssdeep: |
6:4xtQl3TuPOcSXsy68CX2hHOTq3vXllbeGaioljAlM8xmsHvRO2EW60lbeGailTjM:8LPOFsGkM7khjAnHw2EEkklLSXhcmV
|
| Size: |
541
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
|
Generic INItialization configuration [folders]
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
|
| Category: |
dropped
|
| Dump: |
index.dat.3.dr
|
| ID: |
dr_1
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Generic INItialization configuration [folders]
|
| Entropy: |
4.677687812691546
|
| Encrypted: |
false
|
| Ssdeep: |
3:H+BRLp2m42QRLp2v:H+3KI
|
| Size: |
63
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02836342[[fn=Ion]].thmx (copy)
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02836342[[fn=Ion]].thmx (copy)
|
| Category: |
dropped
|
| Dump: |
myTemplate_02836342.thmx.3.dr
|
| ID: |
dr_1064
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.941741037170679
|
| Encrypted: |
false
|
| Ssdeep: |
24576:jS2WTsZasyuJiyV0mDUoHLgwPjvv96H8D86IRZ2s4p/H2rDCg+tuXlYMErpGzwZN:OKYlO3BpPTvc8oFZ29/Rg+rrDLr
|
| Size: |
1824766
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02892315[[fn=Wisp]].thmx (copy)
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02892315[[fn=Wisp]].thmx (copy)
|
| Category: |
dropped
|
| Dump: |
Wisp.thmx.3.dr
|
| ID: |
dr_1052
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.849038074328931
|
| Encrypted: |
false
|
| Ssdeep: |
12288:RBbqz121ANZ40EdYNyNv3GaNBlHT3pxozHUt3HnpHQPegZ+dNu+7TrlpocfYFWCH:qDNhEYNyJNBlT3pxoz0tAtZ00j
|
| Size: |
787354
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02900688[[fn=Facet]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02900688[[fn=Facet]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Facet.thmx.3.dr
|
| ID: |
dr_1050
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.8235726750504355
|
| Encrypted: |
false
|
| Ssdeep: |
12288:MIA7gJFzMeFZaq2fscBNVRFCToZr5RCmUQHr+kRBhFF0s9XH44qTxQXMI:hA7gJFzZ2xBbmsZdRC4Ck19X44qyMI
|
| Size: |
738429
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02900720[[fn=Integral]].thmx
(copy)
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02900720[[fn=Integral]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Integral.thmx.3.dr
|
| ID: |
dr_1071
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.939078022105486
|
| Encrypted: |
false
|
| Ssdeep: |
98304:hAABj6t8mC7x/pS6+X3Bzx37OjbqOMhbEsMWII5:ct8mC7x/pS6uBzp5NhAsMWt
|
| Size: |
3446188
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02900722[[fn=Ion Boardroom]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02900722[[fn=Ion Boardroom]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Ion_Boardroom.thmx.3.dr
|
| ID: |
dr_1062
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.907400454215888
|
| Encrypted: |
false
|
| Ssdeep: |
24576:zT2WTsZasyuJiyV0mDUoHLgwPjvgpEtrYpXjdHo8dJNgR6MxNTkdXylo:/KYlO3BpPTgpEtkpXJTgHxWuo
|
| Size: |
1593982
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02900743[[fn=Organic]].thmx
(copy)
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02900743[[fn=Organic]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Organic.thmx.3.dr
|
| ID: |
dr_1074
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.955490103632122
|
| Encrypted: |
false
|
| Ssdeep: |
196608:fHnG7lmZcnwldXA4AZwsjVvWJ5u2AbKLCIV50CAmad7uS/5o:u7lVGXA4ABJWJc2A6rkno
|
| Size: |
8705569
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02900769[[fn=Retrospect]].thmx
(copy)
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02900769[[fn=Retrospect]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Retrospect.thmx.3.dr
|
| ID: |
dr_1060
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.867463315196704
|
| Encrypted: |
false
|
| Ssdeep: |
24576:bimPI+bGSIB3FKbFGTCpavIOuaR0Um9BbbjE68+xiMNcayWSvHo5R/m:OmPI+6fB3Abk8Q5tHmAsiMNccSvIr/m
|
| Size: |
1623260
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Banded.thmx.3.dr
|
| ID: |
dr_1048
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.67409707491542
|
| Encrypted: |
false
|
| Ssdeep: |
12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
|
| Size: |
562113
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Wood_Type.thmx.3.dr
|
| ID: |
dr_1054
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.875240099125746
|
| Encrypted: |
false
|
| Ssdeep: |
24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
|
| Size: |
1649585
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Basis.thmx.3.dr
|
| ID: |
dr_1046
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.696653383430889
|
| Encrypted: |
false
|
| Ssdeep: |
12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
|
| Size: |
558035
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457452[[fn=Celestial]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457452[[fn=Celestial]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Celestial.thmx.3.dr
|
| ID: |
dr_1072
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.9549249539064
|
| Encrypted: |
false
|
| Ssdeep: |
98304:RMKPrL1cgIF6jyoKfszvzC2UFsp3SUwDyMdghJU:RLPrGgIF6jJKAvO2UAiwU
|
| Size: |
3295051
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Dividend.thmx.3.dr
|
| ID: |
dr_1045
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.674434888248144
|
| Encrypted: |
false
|
| Ssdeep: |
6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
|
| Size: |
570901
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Frame.thmx.3.dr
|
| ID: |
dr_1047
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.715248170753013
|
| Encrypted: |
false
|
| Ssdeep: |
6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
|
| Size: |
523048
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx (copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx (copy)
|
| Category: |
dropped
|
| Dump: |
Mesh.thmx.3.dr
|
| ID: |
dr_1070
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.954129852655753
|
| Encrypted: |
false
|
| Ssdeep: |
49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
|
| Size: |
3078052
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Metropolitan.thmx.3.dr
|
| ID: |
dr_1049
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.689662652914981
|
| Encrypted: |
false
|
| Ssdeep: |
6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
|
| Size: |
777647
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx
(copy)
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Parallax.thmx.3.dr
|
| ID: |
dr_1053
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.824849396154325
|
| Encrypted: |
false
|
| Ssdeep: |
12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
|
| Size: |
924687
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Quotable.thmx.3.dr
|
| ID: |
dr_1056
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.8785200658952
|
| Encrypted: |
false
|
| Ssdeep: |
24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
|
| Size: |
966946
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Savon.thmx.3.dr
|
| ID: |
dr_1058
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.92476783994848
|
| Encrypted: |
false
|
| Ssdeep: |
24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
|
| Size: |
1204049
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx (copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx (copy)
|
| Category: |
dropped
|
| Dump: |
View.thmx.3.dr
|
| ID: |
dr_1044
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.668294441507828
|
| Encrypted: |
false
|
| Ssdeep: |
6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
|
| Size: |
486596
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Berlin.thmx.3.dr
|
| ID: |
dr_1057
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.791956689344336
|
| Encrypted: |
false
|
| Ssdeep: |
24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
|
| Size: |
976001
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx
(copy)
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Circuit.thmx.3.dr
|
| ID: |
dr_1061
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.898382456989258
|
| Encrypted: |
false
|
| Ssdeep: |
24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
|
| Size: |
1463634
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Damask.thmx.3.dr
|
| ID: |
dr_1067
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.942378408801199
|
| Encrypted: |
false
|
| Ssdeep: |
49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
|
| Size: |
2218943
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033923[[fn=Depth]].thmx
(copy)
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033923[[fn=Depth]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Depth.thmx.3.dr
|
| ID: |
dr_1066
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.9547975506532795
|
| Encrypted: |
false
|
| Ssdeep: |
49152:5HQKNdoI77mfXP/mDZLGkkgrODG1MHKr4nNtOmtu0:5HNjoygXnm0jgrODhqrsNcmtu0
|
| Size: |
2332136
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Droplet.thmx.3.dr
|
| ID: |
dr_1063
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.892395931401988
|
| Encrypted: |
false
|
| Ssdeep: |
24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
|
| Size: |
1750795
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Main_Event.thmx.3.dr
|
| ID: |
dr_1069
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.970803022812704
|
| Encrypted: |
false
|
| Ssdeep: |
49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
|
| Size: |
2924237
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Slate.thmx.3.dr
|
| ID: |
dr_1065
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.929430745829162
|
| Encrypted: |
false
|
| Ssdeep: |
49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
|
| Size: |
2357051
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Vapor_Trail.thmx.3.dr
|
| ID: |
dr_1073
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.965784120725206
|
| Encrypted: |
false
|
| Ssdeep: |
49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
|
| Size: |
3611324
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Gallery.thmx.3.dr
|
| ID: |
dr_1059
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.906659368807194
|
| Encrypted: |
false
|
| Ssdeep: |
24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
|
| Size: |
1091485
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Parcel.thmx.3.dr
|
| ID: |
dr_1051
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.729143855239127
|
| Encrypted: |
false
|
| Ssdeep: |
6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
|
| Size: |
608122
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM16401371[[fn=Atlas]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM16401371[[fn=Atlas]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Atlas.thmx.3.dr
|
| ID: |
dr_1055
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.84356939318248
|
| Encrypted: |
false
|
| Ssdeep: |
12288:RiQJnhBiU81d9WbQPHxV9uqraiDFihVRR5cJJeYiaFUV0CoTz:RiwhE8bIXkvQIjRR+nDmVK3
|
| Size: |
857650
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM16401375[[fn=Madison]].thmx
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM16401375[[fn=Madison]].thmx
(copy)
|
| Category: |
dropped
|
| Dump: |
Madison.thmx.3.dr
|
| ID: |
dr_1068
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.927032974390551
|
| Encrypted: |
false
|
| Ssdeep: |
49152:2HZkYR3gdOwBkskdDT+FQDGn5zpoLU0izCPOYZSKgdE6qFnm3DP+ulUnW:2jRkOlskJpDO5zpoKzZBKga6YmzWulUW
|
| Size: |
2443359
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox
(copy)
|
| Category: |
dropped
|
| Dump: |
architecture.glox.3.dr
|
| ID: |
dr_1030
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.88616857639663
|
| Encrypted: |
false
|
| Ssdeep: |
96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
|
| Size: |
5783
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox
(copy)
|
| Category: |
dropped
|
| Dump: |
BracketList.glox.3.dr
|
| ID: |
dr_1038
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.809492693601857
|
| Encrypted: |
false
|
| Ssdeep: |
96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
|
| Size: |
4026
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox
(copy)
|
| Category: |
dropped
|
| Dump: |
chevronaccent.glox.3.dr
|
| ID: |
dr_1032
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.824383764848892
|
| Encrypted: |
false
|
| Ssdeep: |
96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
|
| Size: |
4243
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox
(copy)
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox
(copy)
|
| Category: |
dropped
|
| Dump: |
CircleProcess.glox.3.dr
|
| ID: |
dr_1029
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.9519793977093505
|
| Encrypted: |
false
|
| Ssdeep: |
384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
|
| Size: |
16806
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging
Text]].glox (copy)
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging
Text]].glox (copy)
|
| Category: |
dropped
|
| Dump: |
ConvergingText.glox.3.dr
|
| ID: |
dr_1043
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.891971054886943
|
| Encrypted: |
false
|
| Ssdeep: |
192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
|
| Size: |
11380
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox
(copy)
|
| Category: |
dropped
|
| Dump: |
HexagonRadial.glox.3.dr
|
| ID: |
dr_1040
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.886254023824049
|
| Encrypted: |
false
|
| Ssdeep: |
96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
|
| Size: |
6024
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected
Block Process]].glox (copy)
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected
Block Process]].glox (copy)
|
| Category: |
dropped
|
| Dump: |
InterconnectedBlockProcess.glox.3.dr
|
| ID: |
dr_1033
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.93263830735235
|
| Encrypted: |
false
|
| Ssdeep: |
192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
|
| Size: |
9191
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox
(copy)
|
| Category: |
dropped
|
| Dump: |
PictureFrame.glox.3.dr
|
| ID: |
dr_1039
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.821066198539098
|
| Encrypted: |
false
|
| Ssdeep: |
96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
|
| Size: |
4326
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization
Chart]].glox (copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization
Chart]].glox (copy)
|
| Category: |
dropped
|
| Dump: |
pictureorgchart.glox.3.dr
|
| ID: |
dr_1036
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.9204386289679745
|
| Encrypted: |
false
|
| Ssdeep: |
192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
|
| Size: |
7370
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture
List]].glox (copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture
List]].glox (copy)
|
| Category: |
dropped
|
| Dump: |
RadialPictureList.glox.3.dr
|
| ID: |
dr_1028
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.875182123405584
|
| Encrypted: |
false
|
| Ssdeep: |
96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
|
| Size: |
5596
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox
(copy)
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox
(copy)
|
| Category: |
dropped
|
| Dump: |
TabbedArc.glox.3.dr
|
| ID: |
dr_1031
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.772039166640107
|
| Encrypted: |
false
|
| Ssdeep: |
96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
|
| Size: |
3683
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox
(copy)
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox
(copy)
|
| Category: |
dropped
|
| Dump: |
TabList.glox.3.dr
|
| ID: |
dr_1027
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.8636569313247335
|
| Encrypted: |
false
|
| Ssdeep: |
96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
|
| Size: |
4888
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture
Accent]].glox (copy)
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture
Accent]].glox (copy)
|
| Category: |
dropped
|
| Dump: |
ThemePictureAccent.glox.3.dr
|
| ID: |
dr_1042
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.897260397307811
|
| Encrypted: |
false
|
| Ssdeep: |
192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
|
| Size: |
6448
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture
Alternating Accent]].glox (copy)
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture
Alternating Accent]].glox (copy)
|
| Category: |
dropped
|
| Dump: |
ThemePictureAlternatingAccent.glox.3.dr
|
| ID: |
dr_1035
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.87271654296772
|
| Encrypted: |
false
|
| Ssdeep: |
96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
|
| Size: |
5630
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture
Grid]].glox (copy)
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture
Grid]].glox (copy)
|
| Category: |
dropped
|
| Dump: |
ThemePictureGrid.glox.3.dr
|
| ID: |
dr_1037
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Zip archive data, at least v2.0 to extract, compression method=deflate
|
| Entropy: |
7.855499268199703
|
| Encrypted: |
false
|
| Ssdeep: |
192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
|
| Size: |
6193
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width
List]].glox (copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width
List]].glox (copy)
|
| Category: |
dropped
|
| Dump: |
VaryingWidthList.glox.3.dr
|
| ID: |
dr_1041
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.716021191059687
|
| Encrypted: |
false
|
| Ssdeep: |
48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
|
| Size: |
3075
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox
(copy)
|
Microsoft OOXML
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox
(copy)
|
| Category: |
dropped
|
| Dump: |
rings.glox.3.dr
|
| ID: |
dr_1034
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
Microsoft OOXML
|
| Entropy: |
7.859615916913808
|
| Encrypted: |
false
|
| Ssdeep: |
96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
|
| Size: |
5151
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HIHYJ4H4RMET7JLNJR3I.temp
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HIHYJ4H4RMET7JLNJR3I.temp
|
| Category: |
dropped
|
| Dump: |
HIHYJ4H4RMET7JLNJR3I.temp.3.dr
|
| ID: |
dr_645
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
0.41381685030363374
|
| Encrypted: |
false
|
| Ssdeep: |
3:/l:
|
| Size: |
12
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\R8A3OFV8ZDF16EP5SGRJ.temp
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\R8A3OFV8ZDF16EP5SGRJ.temp
|
| Category: |
dropped
|
| Dump: |
R8A3OFV8ZDF16EP5SGRJ.temp.3.dr
|
| ID: |
dr_648
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
0.41381685030363374
|
| Encrypted: |
false
|
| Ssdeep: |
3:/l:
|
| Size: |
12
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d00655d2aa12ff6d.customDestinations-ms (copy)
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d00655d2aa12ff6d.customDestinations-ms (copy)
|
| Category: |
dropped
|
| Dump: |
HIHYJ4H4RMET7JLNJR3I.temp.3.dr
|
| ID: |
dr_1025
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
0.41381685030363374
|
| Encrypted: |
false
|
| Ssdeep: |
3:/l:
|
| Size: |
12
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d00655d2aa12ff6d.customDestinations-ms~RF22e49.TMP
(copy)
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d00655d2aa12ff6d.customDestinations-ms~RF22e49.TMP
(copy)
|
| Category: |
dropped
|
| Dump: |
HIHYJ4H4RMET7JLNJR3I.temp.3.dr
|
| ID: |
dr_1026
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
0.41381685030363374
|
| Encrypted: |
false
|
| Ssdeep: |
3:/l:
|
| Size: |
12
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 12:10:47 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
|
| Category: |
dropped
|
| Dump: |
Docs.lnk.11.dr
|
| ID: |
dr_1080
|
| Target ID: |
11
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 12:10:47 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
| Entropy: |
3.9798962983922577
|
| Encrypted: |
false
|
| Ssdeep: |
48:8+7deTD7orHAidAKZdA1JehwiZUklqehs5y+3:8+oUujy
|
| Size: |
2677
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Stores files to the Windows start menu directory |
Boot Survival |
Registry Run Keys / Startup Folder
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 12:10:47 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
|
| Category: |
dropped
|
| Dump: |
Gmail.lnk.11.dr
|
| ID: |
dr_1078
|
| Target ID: |
11
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 12:10:47 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
| Entropy: |
3.9965693680759555
|
| Encrypted: |
false
|
| Ssdeep: |
48:8P7deTD7orHAidAKZdA10eh/iZUkAQkqehh5y+2:8PoUc9Qey
|
| Size: |
2679
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Stores files to the Windows start menu directory |
Boot Survival |
Registry Run Keys / Startup Folder
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
|
| Category: |
dropped
|
| Dump: |
Google Drive.lnk.11.dr
|
| ID: |
dr_1075
|
| Target ID: |
11
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
| Entropy: |
4.005720157801585
|
| Encrypted: |
false
|
| Ssdeep: |
48:8e7deTD7ojHAidAKZdA14tIeh7sFiZUkmgqeh7sf5y+BX:8eoUMn3y
|
| Size: |
2693
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Stores files to the Windows start menu directory |
Boot Survival |
Registry Run Keys / Startup Folder
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 12:10:47 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
|
| Category: |
dropped
|
| Dump: |
Sheets.lnk.11.dr
|
| ID: |
dr_1077
|
| Target ID: |
11
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 12:10:47 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
| Entropy: |
3.9968907836433507
|
| Encrypted: |
false
|
| Ssdeep: |
48:8V7deTD7orHAidAKZdA1behDiZUkwqehl5y+R:8VoUX5y
|
| Size: |
2681
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Stores files to the Windows start menu directory |
Boot Survival |
Registry Run Keys / Startup Folder
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 12:10:47 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
|
| Category: |
dropped
|
| Dump: |
Slides.lnk.11.dr
|
| ID: |
dr_1079
|
| Target ID: |
11
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 12:10:47 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
| Entropy: |
3.9835390088573153
|
| Encrypted: |
false
|
| Ssdeep: |
48:8D7deTD7orHAidAKZdA1VehBiZUk1W1qehb5y+C:8DoUn9ly
|
| Size: |
2681
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Stores files to the Windows start menu directory |
Boot Survival |
Registry Run Keys / Startup Folder
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 12:10:47 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
|
| Category: |
dropped
|
| Dump: |
YouTube.lnk.11.dr
|
| ID: |
dr_1076
|
| Target ID: |
11
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 12:10:47 2024, atime=Mon Oct 2 20:46:57
2023, length=1210144, window=hide
|
| Entropy: |
3.99421842937096
|
| Encrypted: |
false
|
| Ssdeep: |
48:8Q7deTD7orHAidAKZdA1duT6ehOuTbbiZUk5OjqehOuTbd5y+yT+:8QoUjTTTbxWOvTb3y7T
|
| Size: |
2683
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Stores files to the Windows start menu directory |
Boot Survival |
Registry Run Keys / Startup Folder
|
|
|
C:\Users\user\Desktop\~$Payout Receipt.pptx
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\Desktop\~$Payout Receipt.pptx
|
| Category: |
dropped
|
| Dump: |
~$Payout Receipt.pptx.3.dr
|
| ID: |
dr_55
|
| Target ID: |
3
|
| Process: |
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
|
| Type: |
data
|
| Entropy: |
1.5036061025690532
|
| Encrypted: |
false
|
| Ssdeep: |
3:4HAmFF/6ftt:4rFFS
|
| Size: |
165
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1165
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
|
dropped
|
|
|
|
| File: |
Chrome Cache Entry: 1165
|
| Category: |
dropped
|
| Dump: |
chromecache_1165.12.dr
|
| ID: |
dr_1081
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
|
| Entropy: |
7.997737813291819
|
| Encrypted: |
true
|
| Ssdeep: |
1536:9IyZY3F6VvgB9lnrhw1h+WbhcNtrpUzwXkqGeKTgcao2AYvXMpclkcKAXWG8NYh:9BZ5hu91Nwz+trpGmkReMgcaQYXlkcjR
|
| Size: |
116365
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1166
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141866
|
dropped
|
|
|
|
| File: |
Chrome Cache Entry: 1166
|
| Category: |
dropped
|
| Dump: |
chromecache_1166.12.dr
|
| ID: |
dr_1092
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141866
|
| Entropy: |
7.994672288751266
|
| Encrypted: |
true
|
| Ssdeep: |
1536:SMuttwJ0uUmAcZjNL6nnQlL+mwKLiQC7Mn3dxPErr:SwJ0vmAcKnnQF+8LJOMn3DPE/
|
| Size: |
49804
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1167
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449703
|
dropped
|
|
|
|
| File: |
Chrome Cache Entry: 1167
|
| Category: |
dropped
|
| Dump: |
chromecache_1167.12.dr
|
| ID: |
dr_1091
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449703
|
| Entropy: |
7.997505273485286
|
| Encrypted: |
true
|
| Ssdeep: |
3072:H4ojbjOwCNA0H+Zenw+OA6m3SmjcnlDHG21TIoN:dHyi0Ity3wnY2lIA
|
| Size: |
122193
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1168
|
XML 1.0 document, ASCII text
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1168
|
| Category: |
downloaded
|
| Dump: |
chromecache_1168.12.dr
|
| ID: |
dr_1124
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
XML 1.0 document, ASCII text
|
| Entropy: |
5.710072326155945
|
| Encrypted: |
false
|
| Ssdeep: |
6:TMVBd/ZbZjZvKtWRVzjovK0vl2m8xDI4b6Fn010tian:TMHd9BZKtWR2fGJGtia
|
| Size: |
255
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1169
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1169
|
| Category: |
downloaded
|
| Dump: |
chromecache_1169.12.dr
|
| ID: |
dr_1125
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
|
| Entropy: |
7.673946009263606
|
| Encrypted: |
false
|
| Ssdeep: |
12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
|
| Size: |
621
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1170
|
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
|
dropped
|
|
|
|
| File: |
Chrome Cache Entry: 1170
|
| Category: |
dropped
|
| Dump: |
chromecache_1170.12.dr
|
| ID: |
dr_1088
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
|
| Entropy: |
3.990210155325004
|
| Encrypted: |
false
|
| Ssdeep: |
3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
|
| Size: |
61
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1171
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
|
dropped
|
|
|
|
| File: |
Chrome Cache Entry: 1171
|
| Category: |
dropped
|
| Dump: |
chromecache_1171.12.dr
|
| ID: |
dr_1087
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
|
| Entropy: |
7.8613342322590265
|
| Encrypted: |
false
|
| Ssdeep: |
24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
|
| Size: |
1435
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1172
|
HTML document, ASCII text, with very long lines (3458), with CRLF line terminators
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1172
|
| Category: |
downloaded
|
| Dump: |
chromecache_1172.12.dr
|
| ID: |
dr_1126
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
HTML document, ASCII text, with very long lines (3458), with CRLF line terminators
|
| Entropy: |
5.122700637311411
|
| Encrypted: |
false
|
| Ssdeep: |
96:3qO9I9Sz9KHULI5m4UidBGLVvsushswsosry:a2IYz95qTdBaq
|
| Size: |
3460
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1173
|
PNG image data, 69 x 28, 8-bit/color RGB, non-interlaced
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1173
|
| Category: |
downloaded
|
| Dump: |
chromecache_1173.12.dr
|
| ID: |
dr_1127
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
PNG image data, 69 x 28, 8-bit/color RGB, non-interlaced
|
| Entropy: |
4.002585360278503
|
| Encrypted: |
false
|
| Ssdeep: |
3:yionv//thPl2tJTl1xl/k4E08up:6v/lhP4l17Tp
|
| Size: |
61
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1174
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449703
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1174
|
| Category: |
downloaded
|
| Dump: |
chromecache_1174.12.dr
|
| ID: |
dr_1128
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449703
|
| Entropy: |
7.997505273485286
|
| Encrypted: |
true
|
| Ssdeep: |
3072:H4ojbjOwCNA0H+Zenw+OA6m3SmjcnlDHG21TIoN:dHyi0Ity3wnY2lIA
|
| Size: |
122193
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1175
|
ASCII text, with very long lines (47261)
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1175
|
| Category: |
downloaded
|
| Dump: |
chromecache_1175.12.dr
|
| ID: |
dr_1129
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
ASCII text, with very long lines (47261)
|
| Entropy: |
5.3974731018213795
|
| Encrypted: |
false
|
| Ssdeep: |
768:+CWIsQ06lHHhw+r9sygguSwodvdq3VE3XYdze9Ddre9eom1CQWpKexThupcubvCR:uQflHBN9sygg1WViPreEM
|
| Size: |
47262
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1176
|
ASCII text, with very long lines (32058)
|
dropped
|
|
|
|
| File: |
Chrome Cache Entry: 1176
|
| Category: |
dropped
|
| Dump: |
chromecache_1176.12.dr
|
| ID: |
dr_1082
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
ASCII text, with very long lines (32058)
|
| Entropy: |
5.36781915816204
|
| Encrypted: |
false
|
| Ssdeep: |
1536:YNhEyjjTikEJO4edXXe9J578go6MWX2xkj8e4c4j2ll2AckaXEP6n15HZ+FhFcQ7:uxc2yjx4j2uX/kcQDU8Cu9
|
| Size: |
86659
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1177
|
ASCII text, with very long lines (47261)
|
dropped
|
|
|
|
| File: |
Chrome Cache Entry: 1177
|
| Category: |
dropped
|
| Dump: |
chromecache_1177.12.dr
|
| ID: |
dr_1103
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
ASCII text, with very long lines (47261)
|
| Entropy: |
5.3974731018213795
|
| Encrypted: |
false
|
| Ssdeep: |
768:+CWIsQ06lHHhw+r9sygguSwodvdq3VE3XYdze9Ddre9eom1CQWpKexThupcubvCR:uQflHBN9sygg1WViPreEM
|
| Size: |
47262
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1178
|
HTML document, ASCII text, with very long lines (4585)
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1178
|
| Category: |
downloaded
|
| Dump: |
chromecache_1178.12.dr
|
| ID: |
dr_1130
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
HTML document, ASCII text, with very long lines (4585)
|
| Entropy: |
5.521542323293806
|
| Encrypted: |
false
|
| Ssdeep: |
96:/o3zpnc8TdekEd9Nz/YY3ZnzJhkGductm4nx/ICu:/o3hc8kkGr/Y2nlhkxOlnx/ju
|
| Size: |
7142
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1179
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57443
|
dropped
|
|
|
|
| File: |
Chrome Cache Entry: 1179
|
| Category: |
dropped
|
| Dump: |
chromecache_1179.12.dr
|
| ID: |
dr_1101
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57443
|
| Entropy: |
7.987374325584103
|
| Encrypted: |
false
|
| Ssdeep: |
384:GTwafLJjHlgnek9V15z6Brrwb9tYt3skOUAQC1:GTtTJjHlgneqTz658ht/eAQw
|
| Size: |
16326
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1180
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
|
dropped
|
|
|
|
| File: |
Chrome Cache Entry: 1180
|
| Category: |
dropped
|
| Dump: |
chromecache_1180.12.dr
|
| ID: |
dr_1100
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
|
| Entropy: |
7.99275807202193
|
| Encrypted: |
true
|
| Ssdeep: |
768:FlTfWbX2KT+Hid0L7lumndasuVyeLtCR4sqvrdYnN6UcepZtf/r6:LgbT+Hid0TFbeLtUGvrdCNqepbHr6
|
| Size: |
35168
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1181
|
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1181
|
| Category: |
downloaded
|
| Dump: |
chromecache_1181.12.dr
|
| ID: |
dr_1131
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
|
| Entropy: |
3.990210155325004
|
| Encrypted: |
false
|
| Ssdeep: |
3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
|
| Size: |
61
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1182
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113401
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1182
|
| Category: |
downloaded
|
| Dump: |
chromecache_1182.12.dr
|
| ID: |
dr_1132
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113401
|
| Entropy: |
7.979508934961097
|
| Encrypted: |
false
|
| Ssdeep: |
384:ekqQ8rNFEhCgMyL2iww6oIR8mWG+Pu9Z5IMU7ULgCsHqZo9v8:9CGEiL/w7R8DW9Z5BU7UMZHqok
|
| Size: |
20414
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1183
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
|
dropped
|
|
|
|
| File: |
Chrome Cache Entry: 1183
|
| Category: |
dropped
|
| Dump: |
chromecache_1183.12.dr
|
| ID: |
dr_1097
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
|
| Entropy: |
7.95514518328613
|
| Encrypted: |
false
|
| Ssdeep: |
96:/hCpRVAqhJlGWPQXH0xeQysZT1rTr8Ps8RLTJ1ctq5/+XVGbN6obuwSuaGwEan:CRRh430/PdTrv8RtytveNjaGC
|
| Size: |
5529
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1184
|
HTML document, ASCII text, with very long lines (3458), with CRLF line terminators
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1184
|
| Category: |
downloaded
|
| Dump: |
chromecache_1184.12.dr
|
| ID: |
dr_1133
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
HTML document, ASCII text, with very long lines (3458), with CRLF line terminators
|
| Entropy: |
5.122700637311411
|
| Encrypted: |
false
|
| Ssdeep: |
96:3qO9I9Sz9KHULI5m4UidBGLVvsushswsosry:a2IYz95qTdBaq
|
| Size: |
3460
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1185
|
ASCII text, with no line terminators
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1185
|
| Category: |
downloaded
|
| Dump: |
chromecache_1185.12.dr
|
| ID: |
dr_1134
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
ASCII text, with no line terminators
|
| Entropy: |
4.307354922057605
|
| Encrypted: |
false
|
| Ssdeep: |
3:8Kiun9ks:8Kiun2s
|
| Size: |
28
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1186
|
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1186
|
| Category: |
downloaded
|
| Dump: |
chromecache_1186.12.dr
|
| ID: |
dr_1135
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
|
| Entropy: |
2.9129715116732746
|
| Encrypted: |
false
|
| Ssdeep: |
24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
|
| Size: |
17174
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1187
|
ASCII text, with very long lines (32058)
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1187
|
| Category: |
downloaded
|
| Dump: |
chromecache_1187.12.dr
|
| ID: |
dr_1136
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
ASCII text, with very long lines (32058)
|
| Entropy: |
5.36781915816204
|
| Encrypted: |
false
|
| Ssdeep: |
1536:YNhEyjjTikEJO4edXXe9J578go6MWX2xkj8e4c4j2ll2AckaXEP6n15HZ+FhFcQ7:uxc2yjx4j2uX/kcQDU8Cu9
|
| Size: |
86659
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1188
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1188
|
| Category: |
downloaded
|
| Dump: |
chromecache_1188.12.dr
|
| ID: |
dr_1137
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
|
| Entropy: |
7.95514518328613
|
| Encrypted: |
false
|
| Ssdeep: |
96:/hCpRVAqhJlGWPQXH0xeQysZT1rTr8Ps8RLTJ1ctq5/+XVGbN6obuwSuaGwEan:CRRh430/PdTrv8RtytveNjaGC
|
| Size: |
5529
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1189
|
HTML document, ASCII text, with CRLF line terminators
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1189
|
| Category: |
downloaded
|
| Dump: |
chromecache_1189.12.dr
|
| ID: |
dr_1138
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
HTML document, ASCII text, with CRLF line terminators
|
| Entropy: |
4.609079251036341
|
| Encrypted: |
false
|
| Ssdeep: |
48:tvY98wlG0fT4sa0oJIDKVI8yQQYxyucsEArK:lY98ws0fq9IO01ucD
|
| Size: |
3321
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1190
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
|
dropped
|
|
|
|
| File: |
Chrome Cache Entry: 1190
|
| Category: |
dropped
|
| Dump: |
chromecache_1190.12.dr
|
| ID: |
dr_1104
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
|
| Entropy: |
7.673946009263606
|
| Encrypted: |
false
|
| Ssdeep: |
12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
|
| Size: |
621
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1191
|
ASCII text, with very long lines (7992), with no line terminators
|
dropped
|
|
|
|
| File: |
Chrome Cache Entry: 1191
|
| Category: |
dropped
|
| Dump: |
chromecache_1191.12.dr
|
| ID: |
dr_1112
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
ASCII text, with very long lines (7992), with no line terminators
|
| Entropy: |
5.74549549135949
|
| Encrypted: |
false
|
| Ssdeep: |
192:zzfFBAIqBCTbiHoPcr0FsBE8F36TCReTA1vn0:zzfQNiPcr0FsBE8RxR91v0
|
| Size: |
7992
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1192
|
GIF image data, version 89a, 352 x 3
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1192
|
| Category: |
downloaded
|
| Dump: |
chromecache_1192.12.dr
|
| ID: |
dr_1139
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
GIF image data, version 89a, 352 x 3
|
| Entropy: |
6.640973516071413
|
| Encrypted: |
false
|
| Ssdeep: |
48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
|
| Size: |
2672
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1193
|
GIF image data, version 89a, 352 x 3
|
dropped
|
|
|
|
| File: |
Chrome Cache Entry: 1193
|
| Category: |
dropped
|
| Dump: |
chromecache_1193.12.dr
|
| ID: |
dr_1110
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
GIF image data, version 89a, 352 x 3
|
| Entropy: |
6.867828878374734
|
| Encrypted: |
false
|
| Ssdeep: |
48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
|
| Size: |
3620
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1194
|
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1840x630, components
3
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1194
|
| Category: |
downloaded
|
| Dump: |
chromecache_1194.12.dr
|
| ID: |
dr_1140
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1840x630, components
3
|
| Entropy: |
7.574348657479085
|
| Encrypted: |
false
|
| Ssdeep: |
768:LYU5cIupDSkdi0l48StkLA1bAjtenAB7MGrv+/:TruJSkwIlDMBAjtenAB7xrW/
|
| Size: |
39755
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1195
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1195
|
| Category: |
downloaded
|
| Dump: |
chromecache_1195.12.dr
|
| ID: |
dr_1141
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
|
| Entropy: |
7.99275807202193
|
| Encrypted: |
true
|
| Ssdeep: |
768:FlTfWbX2KT+Hid0L7lumndasuVyeLtCR4sqvrdYnN6UcepZtf/r6:LgbT+Hid0TFbeLtUGvrdCNqepbHr6
|
| Size: |
35168
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1196
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1196
|
| Category: |
downloaded
|
| Dump: |
chromecache_1196.12.dr
|
| ID: |
dr_1142
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
|
| Entropy: |
7.997737813291819
|
| Encrypted: |
true
|
| Ssdeep: |
1536:9IyZY3F6VvgB9lnrhw1h+WbhcNtrpUzwXkqGeKTgcao2AYvXMpclkcKAXWG8NYh:9BZ5hu91Nwz+trpGmkReMgcaQYXlkcjR
|
| Size: |
116365
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1197
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1197
|
| Category: |
downloaded
|
| Dump: |
chromecache_1197.12.dr
|
| ID: |
dr_1143
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
|
| Entropy: |
7.8613342322590265
|
| Encrypted: |
false
|
| Ssdeep: |
24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
|
| Size: |
1435
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1198
|
GIF image data, version 89a, 352 x 3
|
dropped
|
|
|
|
| File: |
Chrome Cache Entry: 1198
|
| Category: |
dropped
|
| Dump: |
chromecache_1198.12.dr
|
| ID: |
dr_1105
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
GIF image data, version 89a, 352 x 3
|
| Entropy: |
6.640973516071413
|
| Encrypted: |
false
|
| Ssdeep: |
48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
|
| Size: |
2672
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1199
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57443
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1199
|
| Category: |
downloaded
|
| Dump: |
chromecache_1199.12.dr
|
| ID: |
dr_1144
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57443
|
| Entropy: |
7.987374325584103
|
| Encrypted: |
false
|
| Ssdeep: |
384:GTwafLJjHlgnek9V15z6Brrwb9tYt3skOUAQC1:GTtTJjHlgneqTz658ht/eAQw
|
| Size: |
16326
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1200
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1200
|
| Category: |
downloaded
|
| Dump: |
chromecache_1200.12.dr
|
| ID: |
dr_1145
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
|
| Entropy: |
7.6596900876595075
|
| Encrypted: |
false
|
| Ssdeep: |
12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
|
| Size: |
673
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1201
|
GIF image data, version 89a, 352 x 3
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1201
|
| Category: |
downloaded
|
| Dump: |
chromecache_1201.12.dr
|
| ID: |
dr_1146
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
GIF image data, version 89a, 352 x 3
|
| Entropy: |
6.867828878374734
|
| Encrypted: |
false
|
| Ssdeep: |
48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
|
| Size: |
3620
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1202
|
PNG image data, 69 x 28, 8-bit/color RGB, non-interlaced
|
dropped
|
|
|
|
| File: |
Chrome Cache Entry: 1202
|
| Category: |
dropped
|
| Dump: |
chromecache_1202.12.dr
|
| ID: |
dr_1120
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
PNG image data, 69 x 28, 8-bit/color RGB, non-interlaced
|
| Entropy: |
4.002585360278503
|
| Encrypted: |
false
|
| Ssdeep: |
3:yionv//thPl2tJTl1xl/k4E08up:6v/lhP4l17Tp
|
| Size: |
61
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1203
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141866
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1203
|
| Category: |
downloaded
|
| Dump: |
chromecache_1203.12.dr
|
| ID: |
dr_1147
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141866
|
| Entropy: |
7.994672288751266
|
| Encrypted: |
true
|
| Ssdeep: |
1536:SMuttwJ0uUmAcZjNL6nnQlL+mwKLiQC7Mn3dxPErr:SwJ0vmAcKnnQF+8LJOMn3DPE/
|
| Size: |
49804
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1204
|
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1840x630, components
3
|
dropped
|
|
|
|
| File: |
Chrome Cache Entry: 1204
|
| Category: |
dropped
|
| Dump: |
chromecache_1204.12.dr
|
| ID: |
dr_1118
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1840x630, components
3
|
| Entropy: |
7.574348657479085
|
| Encrypted: |
false
|
| Ssdeep: |
768:LYU5cIupDSkdi0l48StkLA1bAjtenAB7MGrv+/:TruJSkwIlDMBAjtenAB7xrW/
|
| Size: |
39755
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1205
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
|
dropped
|
|
|
|
| File: |
Chrome Cache Entry: 1205
|
| Category: |
dropped
|
| Dump: |
chromecache_1205.12.dr
|
| ID: |
dr_1117
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
|
| Entropy: |
7.6596900876595075
|
| Encrypted: |
false
|
| Ssdeep: |
12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
|
| Size: |
673
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1206
|
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
|
dropped
|
|
|
|
| File: |
Chrome Cache Entry: 1206
|
| Category: |
dropped
|
| Dump: |
chromecache_1206.12.dr
|
| ID: |
dr_1116
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
|
| Entropy: |
2.9129715116732746
|
| Encrypted: |
false
|
| Ssdeep: |
24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
|
| Size: |
17174
|
| Whitelisted: |
true
|
| Reputation: |
timeout
|
|
|
Chrome Cache Entry: 1207
|
ASCII text, with very long lines (8053), with no line terminators
|
downloaded
|
|
|
|
| File: |
Chrome Cache Entry: 1207
|
| Category: |
downloaded
|
| Dump: |
chromecache_1207.12.dr
|
| ID: |
dr_1148
|
| Target ID: |
12
|
| Process: |
C:\Program Files\Google\Chrome\Application\chrome.exe
|
| Type: |
ASCII text, with very long lines (8053), with no line terminators
|
| Entropy: |
5.773897399401492
|
| Encrypted: |
false
|
| Ssdeep: |
192:7vDk5F+L7w9ZfMLnGhvUg1lp97+jh1CidK/9y8bh:TA8gfMLGhvUg1j0h1DdK/99bh
|
| Size: |
8053
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
