IOCReport

loading gif

Files

File Path
Type
Category
Malicious
Comission_1980420924_03172021.xlsm
Microsoft Excel 2007+
initial sample
malicious
C:\Users\user\Desktop\~$Comission_1980420924_03172021.xlsm
data
dropped
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A4B9C4AC.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 1386x1386, frames 3
dropped
clean
C:\Users\user\AppData\Local\Temp\F7EE0000
data
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Comission_1980420924_03172021.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:17 2020, mtime=Wed Apr 7 23:27:44 2021, atime=Wed Apr 7 23:27:44 2021, length=188507, window=hide
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed Apr 7 23:27:44 2021, atime=Wed Apr 7 23:27:44 2021, length=12288, window=hide
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
clean
C:\Users\user\Desktop\C8EE0000
data
dropped
clean

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
malicious
C:\Windows\System32\rundll32.exe
Rundll32 ..\Kiod.hod,DllRegisterServer
malicious
C:\Windows\System32\rundll32.exe
Rundll32 ..\Kiod.hod1,DllRegisterServer
malicious
C:\Windows\System32\rundll32.exe
Rundll32 ..\Kiod.hod2,DllRegisterServer
malicious

URLs

Name
IP
Malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
clean
http://www.windows.com/pctv.
unknown
clean
http://investor.msn.com
unknown
clean
http://www.msnbc.com/news/ticker.txt
unknown
clean
http://188.119.112.114/44293.7276049768.dat
188.119.112.114
clean
http://www.icra.org/vocabulary/.
unknown
clean
http://185.82.219.75/44293.7276049768.dat
185.82.219.75
clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
clean
http://www.hotmail.com/oe
unknown
clean
http://investor.msn.com/
unknown
clean

Domains

Name
IP
Malicious
44293.7276049768.dat
unknown
malicious

IPs

IP
Domain
Country
Malicious
188.119.112.114
unknown
Russian Federation
clean
188.127.230.104
unknown
Russian Federation
clean
185.82.219.75
unknown
Bulgaria
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
%)7
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE198
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE659
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE791
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE87B
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE936
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
#57
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
100B08
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
100DE6
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
clean
There are 95 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2925000
unkown
page readonly
clean
2115000
heap private
page read and write
clean
3DE000
heap default
page read and write
clean
1C80000
unkown
page readonly
clean
2792000
unkown
page readonly
clean
1BC0000
unkown
page readonly
clean
2C15000
heap private
page read and write
clean
25C000
unkown
page read and write
clean
2D2B000
heap private
page read and write
clean
2D70000
unkown
page readonly
clean
2F60000
unkown
page read and write
clean
2852000
unkown
page readonly
clean
22D0000
unkown
page readonly
clean
27C2000
unkown
page readonly
clean
2598000
unkown
page readonly
clean
2885000
unkown
page readonly
clean
60000
unkown
page readonly
clean
2772000
unkown
page readonly
clean
2B80000
unkown
page readonly
clean
27E6000
unkown
page readonly
clean
2865000
unkown
page readonly
clean
2805000
unkown
page readonly
clean
2959000
unkown
page readonly
clean
2210000
unkown
page readonly
clean
E0000
unkown
page read and write
clean
2952000
unkown
page readonly
clean
2839000
unkown
page readonly
clean
28B5000
unkown
page readonly
clean
196000
unkown
page read and write
clean
2538000
unkown
page readonly
clean
293D000
unkown
page readonly
clean
2B20000
unkown
page readonly
clean
584000
heap private
page read and write
clean
60000
unkown
page readonly
clean
281D000
unkown
page readonly
clean
22B0000
unkown
page readonly
clean
20000
unkown
page readonly
clean
4F0000
heap private
page read and write
clean
28E5000
unkown
page readonly
clean
580000
heap private
page read and write
clean
760000
unkown
page readonly
clean
15D000
unkown
page read and write
clean
2B42000
unkown
page readonly
clean
2939000
unkown
page readonly
clean
280000
unkown
page write copy
clean
2A82000
unkown
page readonly
clean
2030000
heap private
page read and write
clean
2CF5000
heap private
page read and write
clean
2EB000
heap default
page read and write
clean
160000
unkown
page read and write
clean
27F2000
unkown
page readonly
clean
2819000
unkown
page readonly
clean
2C10000
heap private
page read and write
clean
2832000
unkown
page readonly
clean
2714000
unkown
page readonly
clean
2805000
unkown
page readonly
clean
29D5000
unkown
page readonly
clean
13B000
heap private
page read and write
clean
2712000
unkown
page readonly
clean
62F000
unkown
page read and write
clean
2855000
unkown
page readonly
clean
2DD000
heap default
page read and write
clean
2B00000
unkown
page readonly
clean
20B0000
unkown
page write copy
clean
21B0000
unkown
page readonly
clean
2794000
unkown
page readonly
clean
4A0000
unkown
page readonly
clean
2734000
unkown
page readonly
clean
2762000
unkown
page readonly
clean
2754000
unkown
page readonly
clean
3A7000
heap default
page read and write
clean
D0000
unkown
page read and write
clean
1E97000
unkown
page readonly
clean
367000
heap default
page read and write
clean
3040000
unkown
page read and write
clean
26F2000
unkown
page readonly
clean
26F4000
unkown
page readonly
clean
2CF0000
heap private
page read and write
clean
27E6000
unkown
page readonly
clean
1DA7000
unkown
page readonly
clean
2235000
heap private
page read and write
clean
20B000
unkown
page read and write
clean
2936000
unkown
page readonly
clean
28F9000
unkown
page readonly
clean
296000
unkown
page read and write
clean
2A0000
heap default
page read and write
clean
2775000
unkown
page readonly
clean
2119000
heap private
page read and write
clean
2230000
heap private
page read and write
clean
130000
heap private
page read and write
clean
2792000
unkown
page readonly
clean
2786000
unkown
page readonly
clean
28A6000
unkown
page readonly
clean
2732000
unkown
page readonly
clean
27A5000
unkown
page readonly
clean
2774000
unkown
page readonly
clean
2592000
unkown
page readonly
clean
2C4B000
heap private
page read and write
clean
210000
unkown
page write copy
clean
100000
heap private
page read and write
clean
2812000
unkown
page readonly
clean
28F5000
unkown
page readonly
clean
287D000
unkown
page readonly
clean
D0000
unkown
page read and write
clean
2854000
unkown
page readonly
clean
20000
unkown
page readonly
clean
2899000
unkown
page readonly
clean
2239000
heap private
page read and write
clean
2E6000
heap default
page read and write
clean
134000
heap private
page read and write
clean
360000
heap default
page read and write
clean
4EF000
unkown
page read and write
clean
2752000
unkown
page readonly
clean
21F0000
unkown
page readonly
clean
27C2000
unkown
page readonly
clean
114000
heap private
page read and write
clean
2862000
unkown
page readonly
clean
28C2000
unkown
page readonly
clean
29B2000
unkown
page readonly
clean
20C9000
heap private
page read and write
clean
2A7000
heap default
page read and write
clean
39E000
heap default
page read and write
clean
60000
unkown
page readonly
clean
2BC0000
unkown
page readonly
clean
2915000
unkown
page readonly
clean
590000
unkown
page readonly
clean
2982000
unkown
page readonly
clean
460000
unkown
page read and write
clean
27D5000
unkown
page readonly
clean
28F2000
unkown
page readonly
clean
29B9000
unkown
page readonly
clean
42E000
unkown
page read and write
clean
4F4000
heap private
page read and write
clean
2912000
unkown
page readonly
clean
2692000
unkown
page readonly
clean
2752000
unkown
page readonly
clean
560000
unkown
page readonly
clean
105000
heap private
page read and write
clean
2AE0000
unkown
page readonly
clean
28C5000
unkown
page readonly
clean
2882000
unkown
page readonly
clean
2892000
unkown
page readonly
clean
20C5000
heap private
page read and write
clean
2A80000
unkown
page readonly
clean
2895000
unkown
page readonly
clean
28B5000
unkown
page readonly
clean
2C00000
unkown
page readonly
clean
2822000
unkown
page readonly
clean
2876000
unkown
page readonly
clean
E0000
unkown
page read and write
clean
2E0000
heap default
page read and write
clean
2814000
unkown
page readonly
clean
20000
unkown
page readonly
clean
20C0000
heap private
page read and write
clean
28B2000
unkown
page readonly
clean
2899000
unkown
page readonly
clean
2BA0000
unkown
page readonly
clean
2834000
unkown
page readonly
clean
2852000
unkown
page readonly
clean
2846000
unkown
page readonly
clean
2A22000
unkown
page readonly
clean
60000
unkown
page readonly
clean
620000
unkown
page readonly
clean
2652000
unkown
page readonly
clean
2658000
unkown
page readonly
clean
2AA0000
unkown
page readonly
clean
2906000
unkown
page readonly
clean
B5F000
unkown
page read and write
clean
2BE0000
unkown
page readonly
clean
1CB0000
unkown
page readonly
clean
3A0000
heap default
page read and write
clean
416000
unkown
page read and write
clean
2110000
heap private
page read and write
clean
6E0000
unkown
page readonly
clean
710000
unkown
page readonly
clean
2879000
unkown
page readonly
clean
2632000
unkown
page readonly
clean
27B000
unkown
page read and write
clean
2AC0000
unkown
page readonly
clean
2C90000
unkown
page readonly
clean
27D5000
unkown
page readonly
clean
3E0000
unkown
page read and write
clean
2AC0000
unkown
page readonly
clean
2835000
unkown
page readonly
clean
2170000
heap private
page read and write
clean
28C9000
unkown
page readonly
clean
2832000
unkown
page readonly
clean
2989000
unkown
page readonly
clean
2532000
unkown
page readonly
clean
496000
unkown
page read and write
clean
27B6000
unkown
page readonly
clean
E0000
unkown
page read and write
clean
110000
heap private
page read and write
clean
28E2000
unkown
page readonly
clean
260000
unkown
page read and write
clean
2E7000
heap default
page read and write
clean
2975000
unkown
page readonly
clean
2892000
unkown
page readonly
clean
31E000
heap default
page read and write
clean
1E67000
unkown
page readonly
clean
140000
heap private
page read and write
clean
28D6000
unkown
page readonly
clean
29A5000
unkown
page readonly
clean
27F2000
unkown
page readonly
clean
2ED0000
unkown
page read and write
clean
2A60000
unkown
page readonly
clean
2190000
unkown
page readonly
clean
2869000
unkown
page readonly
clean
2816000
unkown
page readonly
clean
D0000
unkown
page read and write
clean
2816000
unkown
page readonly
clean
There are 201 hidden memdumps, click here to show them.