IOCReport

loading gif

Files

File Path
Type
Category
Malicious
https://landarch.org/hassani/index.php
URL
initial url
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\index[1].htm
HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
downloaded
 malicious
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E0B04448-B38D-11EB-90E5-ECF4BB2D2496}.dat
Microsoft Word Document
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E0B0444A-B38D-11EB-90E5-ECF4BB2D2496}.dat
Microsoft Word Document
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E7627DA5-B38D-11EB-90E5-ECF4BB2D2496}.dat
Microsoft Word Document
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\wlm7n14\imagestore.dat
data
modified
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\adobe[1].jpg
JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 400x400, frames 3
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\free-v4-shims.min[1].css
ASCII text, with very long lines
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\free.min[1].css
ASCII text, with very long lines
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\jquery.min[1].js
ASCII text, with very long lines
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\w-logo-blue-white-bg[1].png
PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\585b051251[1].js
ASCII text, with very long lines
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\bootstrap.min[1].css
ASCII text, with very long lines
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\bootstrap.min[1].js
ASCII text, with very long lines
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\css[2].css
ASCII text
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\popper.min[1].js
ASCII text, with very long lines
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\8[1].jpg
[TIFF image data, big-endian, direntries=12, height=709, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1200], baseline, precision 8, 1200x646, frames 3
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\jquery-3.1.1.min[1].js
ASCII text, with very long lines
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\jquery-3.2.1.slim.min[1].js
ASCII text, with very long lines
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\gmail[1].png
PNG image data, 1280 x 1280, 8-bit/color RGBA, non-interlaced
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\hover[1].css
ASCII text
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\office3651[1].png
PNG image data, 187 x 188, 8-bit/color RGBA, non-interlaced
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\other1[1].png
PNG image data, 190 x 187, 8-bit/color RGBA, non-interlaced
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\outlook1[1].png
PNG image data, 26 x 26, 8-bit/color RGBA, non-interlaced
downloaded
 clean
C:\Users\user\AppData\Local\Temp\~DF21461B56EB5BEA2A.TMP
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\~DF4E7BFA20179A1DA0.TMP
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\~DFC5762E6EF0DB105B.TMP
data
dropped
 clean
There are 17 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\internet explorer\iexplore.exe
'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
 clean
C:\Program Files (x86)\Internet Explorer\iexplore.exe
'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1972 CREDAT:17410 /prefetch:2
 clean

URLs

Name
IP
Malicious
https://landarch.org/hassani/index.php
malicious
https://landarch.org/hassani/index.php$Share
unknown
 malicious
https://landarch.org/hassani/index.phpRoot
unknown
 malicious
https://landarch.org/hassani/index.php
unknown
 malicious
https://landarch.org/hassani/index.phpn
unknown
 malicious
http://ianlunn.github.io/Hover/)
unknown
 clean
https://ka-f.fontawesome.com
unknown
 clean
https://code.jquery.com/jquery-3.2.1.slim.min.js
unknown
 clean
https://landarch.org/favicon.ico
unknown
 clean
https://code.jquery.com/jquery-3.1.1.min.js
unknown
 clean
https://code.jquery.com/jquery-3.3.1.js
unknown
 clean
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
unknown
 clean
https://fontawesome.com/license/free
unknown
 clean
https://fontawesome.com
unknown
 clean
https://kit.fontawesome.com
unknown
 clean
https://github.com/twbs/bootstrap/graphs/contributors)
unknown
 clean
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
unknown
 clean
https://login.microsoftonline.com/common/login
unknown
 clean
https://getbootstrap.com)
unknown
 clean
http://ianlunn.co.uk/
unknown
 clean
https://github.com/twbs/bootstrap/blob/master/LICENSE)
unknown
 clean
https://github.com/IanLunn/Hover
unknown
 clean
http://opensource.org/licenses/MIT).
unknown
 clean
https://kit.fontawesome.com/585b051251.js
unknown
 clean
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
unknown
 clean
There are 15 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
landarch.org
50.87.140.26
 malicious
cdnjs.cloudflare.com
104.16.19.94
 clean
maxcdn.bootstrapcdn.com
104.18.10.207
 clean
ka-f.fontawesome.com
unknown
 clean
code.jquery.com
unknown
 clean
kit.fontawesome.com
unknown
 clean

IPs

IP
Domain
Country
Malicious
50.87.140.26
landarch.org
United States
malicious
104.18.10.207
maxcdn.bootstrapcdn.com
United States
clean
104.16.19.94
cdnjs.cloudflare.com
United States
clean

Registry

Path
Value
Malicious
C:\Program Files\internet explorer\iexplore.exe
{E0B04448-B38D-11EB-90E5-ECF4BB2D2496}
 clean
C:\Program Files\internet explorer\iexplore.exe
Count
 clean
C:\Program Files\internet explorer\iexplore.exe
Time
 clean
C:\Program Files\internet explorer\iexplore.exe
Blocked
 clean
C:\Program Files\internet explorer\iexplore.exe
Count
 clean
C:\Program Files\internet explorer\iexplore.exe
Time
 clean
C:\Program Files\internet explorer\iexplore.exe
Count
 clean
C:\Program Files\internet explorer\iexplore.exe
Time
 clean
C:\Program Files\internet explorer\iexplore.exe
LoadTimeArray
 clean
C:\Program Files\internet explorer\iexplore.exe
LoadTimeArray
 clean
C:\Program Files\internet explorer\iexplore.exe
Count
 clean
C:\Program Files\internet explorer\iexplore.exe
Time
 clean
C:\Program Files\internet explorer\iexplore.exe
Blocked
 clean
C:\Program Files\internet explorer\iexplore.exe
Count
 clean
C:\Program Files\internet explorer\iexplore.exe
Time
 clean
C:\Program Files\internet explorer\iexplore.exe
LoadTimeArray
 clean
C:\Program Files\internet explorer\iexplore.exe
Count
 clean
C:\Program Files\internet explorer\iexplore.exe
Time
 clean
C:\Program Files\internet explorer\iexplore.exe
LoadTimeArray
 clean
C:\Program Files (x86)\Internet Explorer\iexplore.exe
@C:\Windows\System32\ieframe.dll,-912
 clean
C:\Program Files (x86)\Internet Explorer\iexplore.exe
@C:\Windows\System32\ieframe.dll,-904
 clean
There are 11 hidden registries, click here to show them.

DOM / HTML

URL
Malicious
https://landarch.org/hassani/index.php
 malicious