IOCReport

loading gif

Files

File Path
Type
Category
Malicious
diagram-419065597.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Author: van-van, Last Saved By: vi-vi, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed May 12 08:22:48 2021, Security: 0
initial sample
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 59863 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\88EE0000
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\CabF2E8.tmp
Microsoft Cabinet archive data, 59863 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\Local\Temp\TarF2E9.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Thu May 13 11:15:45 2021, atime=Thu May 13 11:15:45 2021, length=12288, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\diagram-419065597.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:18 2020, mtime=Thu May 13 11:15:45 2021, atime=Thu May 13 11:15:45 2021, length=174080, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\Desktop\89EE0000
Applesoft BASIC program data, first line number 16
dropped
 clean
There are 2 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\ritofm.cvm,DllRegisterServer
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\ritofm.cvm1,DllRegisterServer
 malicious

URLs

Name
IP
Malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://investor.msn.com/
unknown
 clean

Domains

Name
IP
Malicious
stateoftheartacademy.com.br
108.167.180.130
 clean
dsafarm.com
208.91.198.131
 clean

IPs

IP
Domain
Country
Malicious
108.167.180.130
stateoftheartacademy.com.br
United States
clean
208.91.198.131
dsafarm.com
United States
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'c2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE30F
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE6A7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE7A1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE83D
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE946
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EEA4F
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{n2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\system32\qagentrt.dll,-10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-843
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-844
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\wuaueng.dll,-400
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
11169C
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
112617
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
There are 111 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1F0000
unkown
page read and write
 clean
2A42000
unkown
page readonly
 clean
2692000
unkown
page readonly
 clean
2A35000
unkown
page readonly
 clean
27C2000
unkown
page readonly
 clean
610000
unkown
page readonly
 clean
2772000
unkown
page readonly
 clean
1D17000
unkown
page readonly
 clean
2AC0000
unkown
page readonly
 clean
2816000
unkown
page readonly
 clean
2C70000
unkown
page read and write
 clean
40D000
heap default
page read and write
 clean
1ED000
unkown
page read and write
 clean
154000
heap private
page read and write
 clean
28B5000
unkown
page readonly
 clean
2A65000
unkown
page readonly
 clean
21F0000
unkown
page readonly
 clean
2805000
unkown
page readonly
 clean
2915000
unkown
page readonly
 clean
28F2000
unkown
page readonly
 clean
B7F000
unkown
page read and write
 clean
2B00000
unkown
page readonly
 clean
27E6000
unkown
page readonly
 clean
2942000
unkown
page readonly
 clean
2C10000
unkown
page readonly
 clean
2774000
unkown
page readonly
 clean
2C30000
heap private
page read and write
 clean
2360000
unkown
page readonly
 clean
1BC000
unkown
page read and write
 clean
290000
heap default
page read and write
 clean
2794000
unkown
page readonly
 clean
2CB0000
unkown
page readonly
 clean
2792000
unkown
page readonly
 clean
150000
heap private
page read and write
 clean
2210000
unkown
page readonly
 clean
3D0000
heap default
page read and write
 clean
24E000
heap default
page read and write
 clean
60000
unkown
page readonly
 clean
2C6B000
heap private
page read and write
 clean
2936000
unkown
page readonly
 clean
2985000
unkown
page readonly
 clean
29E2000
unkown
page readonly
 clean
2955000
unkown
page readonly
 clean
28E2000
unkown
page readonly
 clean
E0000
unkown
page read and write
 clean
2876000
unkown
page readonly
 clean
297000
heap default
page read and write
 clean
E0000
unkown
page read and write
 clean
2BD2000
unkown
page readonly
 clean
28E5000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
28C2000
unkown
page readonly
 clean
2754000
unkown
page readonly
 clean
2846000
unkown
page readonly
 clean
22C9000
heap private
page read and write
 clean
3C6000
unkown
page read and write
 clean
346000
unkown
page read and write
 clean
1FF0000
heap private
page read and write
 clean
28A4000
unkown
page readonly
 clean
2925000
unkown
page readonly
 clean
2B20000
unkown
page readonly
 clean
2170000
heap private
page read and write
 clean
2A19000
unkown
page readonly
 clean
2966000
unkown
page readonly
 clean
27E2000
unkown
page readonly
 clean
2C30000
unkown
page readonly
 clean
134000
heap private
page read and write
 clean
6B4000
heap private
page read and write
 clean
6C0000
unkown
page readonly
 clean
210000
heap default
page read and write
 clean
1B30000
unkown
page readonly
 clean
1F10000
unkown
page write copy
 clean
22C5000
heap private
page read and write
 clean
2AE0000
unkown
page readonly
 clean
2835000
unkown
page readonly
 clean
26E2000
unkown
page readonly
 clean
2996000
unkown
page readonly
 clean
2E4B000
heap private
page read and write
 clean
2A49000
unkown
page readonly
 clean
2598000
unkown
page readonly
 clean
2130000
unkown
page readonly
 clean
490000
unkown
page readonly
 clean
410000
unkown
page readonly
 clean
27D5000
unkown
page readonly
 clean
D0000
unkown
page read and write
 clean
60000
unkown
page readonly
 clean
390000
unkown
page read and write
 clean
2E90000
unkown
page readonly
 clean
2E10000
heap private
page read and write
 clean
60000
unkown
page readonly
 clean
22C0000
heap private
page read and write
 clean
6B0000
heap private
page read and write
 clean
2175000
heap private
page read and write
 clean
2899000
unkown
page readonly
 clean
2040000
heap private
page read and write
 clean
590000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
2865000
unkown
page readonly
 clean
29C6000
unkown
page readonly
 clean
28C2000
unkown
page readonly
 clean
22B000
unkown
page read and write
 clean
130000
heap private
page read and write
 clean
27F2000
unkown
page readonly
 clean
D0000
unkown
page read and write
 clean
28A2000
unkown
page readonly
 clean
29A2000
unkown
page readonly
 clean
2F80000
unkown
page read and write
 clean
420000
heap default
page read and write
 clean
2070000
unkown
page write copy
 clean
2912000
unkown
page readonly
 clean
2892000
unkown
page readonly
 clean
217000
heap default
page read and write
 clean
310000
unkown
page read and write
 clean
29B5000
unkown
page readonly
 clean
3D7000
heap default
page read and write
 clean
29CD000
unkown
page readonly
 clean
2822000
unkown
page readonly
 clean
2879000
unkown
page readonly
 clean
2972000
unkown
page readonly
 clean
2C35000
heap private
page read and write
 clean
29C9000
unkown
page readonly
 clean
28F9000
unkown
page readonly
 clean
28C9000
unkown
page readonly
 clean
226000
unkown
page read and write
 clean
1D97000
unkown
page readonly
 clean
69E000
unkown
page read and write
 clean
2A12000
unkown
page readonly
 clean
2A82000
unkown
page readonly
 clean
28E4000
unkown
page readonly
 clean
2CE000
heap default
page read and write
 clean
2340000
unkown
page readonly
 clean
28C4000
unkown
page readonly
 clean
5FF000
unkown
page read and write
 clean
2752000
unkown
page readonly
 clean
2592000
unkown
page readonly
 clean
418000
heap default
page read and write
 clean
2E15000
heap private
page read and write
 clean
2C50000
unkown
page readonly
 clean
1BB0000
unkown
page readonly
 clean
2A05000
unkown
page readonly
 clean
29E9000
unkown
page readonly
 clean
2852000
unkown
page readonly
 clean
26E8000
unkown
page readonly
 clean
287D000
unkown
page readonly
 clean
2179000
heap private
page read and write
 clean
416000
heap default
page read and write
 clean
There are 136 hidden memdumps, click here to show them.