±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 36738
New Yesterday: 0 Visitors: 134

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Excel Macro Screenshots (Author?)

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts


Excel Macro Screenshots (Author?)

Post Posted: Nov 11, 19 08:04

we had an incident, where a user opened a compromised excel file and activated excel-macros beforehand to do so.
Now, we've found screenshots which documented the "macro-activation-process" (timestamp matches 100%).
The screenshots where found in "/Users/Username/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/...."
Now the question is, who created those screenshots and why ?
Windows ? Office ?

Best regards  

Senior Member

Re: Excel Macro Screenshots (Author?)

Post Posted: Nov 11, 19 12:03

Your post doesn't really give enough information to answer your question but some malware actively captures screenshots of user activity (although the ones I've seen put it in a specific folder rather than the internet history files).  

Senior Member

Re: Excel Macro Screenshots (Author?)

Post Posted: Nov 12, 19 12:26

Have you considered creating a timeline, in order to 'see' what was 'going on' around the time that the files were created?  

Page 1 of 1