IOCReport

loading gif

Files

File Path
Type
Category
Malicious
statistic-1496367785.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: van-van, Last Saved By: Grog, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:17:20 2015, Last Saved Time/Date: Fri May 21 09:07:02 2021, Security: 0
initial sample
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 61020 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0968A1E3A40D2582E7FD463BAEB59CD
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0968A1E3A40D2582E7FD463BAEB59CD
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
modified
 clean
C:\Users\user\AppData\Local\Temp\BACE0000
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\CabD3B5.tmp
Microsoft Cabinet archive data, 61020 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\Local\Temp\TarD3B6.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Sun May 30 23:40:37 2021, atime=Sun May 30 23:40:37 2021, length=16384, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\statistic-1496367785.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:13 2020, mtime=Sun May 30 23:40:37 2021, atime=Sun May 30 23:40:37 2021, length=173056, window=hide
dropped
 clean
C:\Users\user\Desktop\7BCE0000
Applesoft BASIC program data, first line number 16
dropped
 clean
There are 4 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\flamo.vir,DllRegisterServer
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\flamo.vir1,DllRegisterServer
 malicious

URLs

Name
IP
Malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://investor.msn.com/
unknown
 clean

Domains

Name
IP
Malicious
academy.haleemcampus.com
108.179.232.80
 clean
psq.com.mx
162.241.2.112
 clean

IPs

IP
Domain
Country
Malicious
108.179.232.80
academy.haleemcampus.com
United States
clean
162.241.2.112
psq.com.mx
United States
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
?c7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EC68A
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EC948
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ECA03
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ECA90
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ECB4B
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ECC06
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1l7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\system32\qagentrt.dll,-10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-843
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-844
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\wuaueng.dll,-400
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
There are 90 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2982000
unkown
page readonly
 clean
2E50000
unkown
page readonly
 clean
2995000
unkown
page readonly
 clean
2946000
unkown
page readonly
 clean
2652000
unkown
page readonly
 clean
190000
heap private
page read and write
 clean
2950000
unkown
page readonly
 clean
26A6000
unkown
page readonly
 clean
160000
unkown
page read and write
 clean
240000
heap default
page read and write
 clean
1AD000
unkown
page read and write
 clean
26B2000
unkown
page readonly
 clean
46F000
unkown
page read and write
 clean
2FD000
heap default
page read and write
 clean
2706000
unkown
page readonly
 clean
2970000
unkown
page readonly
 clean
1A7000
heap default
page read and write
 clean
440000
unkown
page write copy
 clean
2A45000
unkown
page readonly
 clean
2709000
unkown
page readonly
 clean
2BF0000
unkown
page readonly
 clean
2120000
heap private
page read and write
 clean
2665000
unkown
page readonly
 clean
29C9000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
2A15000
unkown
page readonly
 clean
2C30000
unkown
page readonly
 clean
2422000
unkown
page readonly
 clean
20A0000
unkown
page readonly
 clean
29E5000
unkown
page readonly
 clean
376000
unkown
page read and write
 clean
2DD0000
heap private
page read and write
 clean
520000
unkown
page readonly
 clean
2905000
unkown
page readonly
 clean
29A6000
unkown
page readonly
 clean
30B000
heap default
page read and write
 clean
60000
unkown
page read and write
 clean
2676000
unkown
page readonly
 clean
2682000
unkown
page readonly
 clean
5AF000
unkown
page read and write
 clean
2882000
unkown
page readonly
 clean
340000
unkown
page read and write
 clean
2965000
unkown
page readonly
 clean
2A22000
unkown
page readonly
 clean
29B0000
unkown
page readonly
 clean
2A0000
unkown
page read and write
 clean
28C4000
unkown
page readonly
 clean
2622000
unkown
page readonly
 clean
1EC0000
heap private
page read and write
 clean
28C2000
unkown
page readonly
 clean
1AC0000
unkown
page readonly
 clean
26C8000
unkown
page readonly
 clean
150000
unkown
page read and write
 clean
29F2000
unkown
page readonly
 clean
2340000
unkown
page readonly
 clean
29C2000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
2C7000
heap default
page read and write
 clean
26C2000
unkown
page readonly
 clean
2952000
unkown
page readonly
 clean
A0E000
unkown
page read and write
 clean
270D000
unkown
page readonly
 clean
22A9000
heap private
page read and write
 clean
520000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
29F9000
unkown
page readonly
 clean
2AF5000
heap private
page read and write
 clean
2E0B000
heap private
page read and write
 clean
1B0000
unkown
page read and write
 clean
22A5000
heap private
page read and write
 clean
20000
unkown
page readonly
 clean
2080000
unkown
page readonly
 clean
124000
heap private
page read and write
 clean
1A0000
heap default
page read and write
 clean
2935000
unkown
page readonly
 clean
2884000
unkown
page readonly
 clean
14C000
unkown
page read and write
 clean
2722000
unkown
page readonly
 clean
2922000
unkown
page readonly
 clean
2695000
unkown
page readonly
 clean
ACF000
unkown
page read and write
 clean
1C40000
unkown
page readonly
 clean
2BB2000
unkown
page readonly
 clean
1DE000
heap default
page read and write
 clean
247000
heap default
page read and write
 clean
6A0000
unkown
page readonly
 clean
6B0000
unkown
page readonly
 clean
2916000
unkown
page readonly
 clean
1CA7000
unkown
page readonly
 clean
2789000
unkown
page readonly
 clean
2B2B000
heap private
page read and write
 clean
29A9000
unkown
page readonly
 clean
2976000
unkown
page readonly
 clean
29AD000
unkown
page readonly
 clean
26C5000
unkown
page readonly
 clean
26E2000
unkown
page readonly
 clean
2729000
unkown
page readonly
 clean
1EC5000
heap private
page read and write
 clean
1EC9000
heap private
page read and write
 clean
2912000
unkown
page readonly
 clean
1E27000
unkown
page readonly
 clean
28A2000
unkown
page readonly
 clean
2A29000
unkown
page readonly
 clean
140000
unkown
page readonly
 clean
2522000
unkown
page readonly
 clean
2624000
unkown
page readonly
 clean
2775000
unkown
page readonly
 clean
26D6000
unkown
page readonly
 clean
306000
heap default
page read and write
 clean
2745000
unkown
page readonly
 clean
2428000
unkown
page readonly
 clean
21A0000
unkown
page read and write
 clean
194000
heap private
page read and write
 clean
2604000
unkown
page readonly
 clean
2E40000
unkown
page read and write
 clean
2C10000
unkown
page readonly
 clean
25E4000
unkown
page readonly
 clean
26F5000
unkown
page readonly
 clean
1F40000
heap private
page read and write
 clean
514000
heap private
page read and write
 clean
27C2000
unkown
page readonly
 clean
27E000
heap default
page read and write
 clean
510000
heap private
page read and write
 clean
2320000
unkown
page readonly
 clean
13C000
unkown
page read and write
 clean
2020000
unkown
page readonly
 clean
2752000
unkown
page readonly
 clean
2B70000
unkown
page readonly
 clean
70000
unkown
page read and write
 clean
2602000
unkown
page readonly
 clean
28A4000
unkown
page readonly
 clean
2DD5000
heap private
page read and write
 clean
22A0000
heap private
page read and write
 clean
2782000
unkown
page readonly
 clean
1E6000
unkown
page read and write
 clean
2C0000
heap default
page read and write
 clean
2AF0000
heap private
page read and write
 clean
120000
heap private
page read and write
 clean
2990000
unkown
page readonly
 clean
25E2000
unkown
page readonly
 clean
2759000
unkown
page readonly
 clean
27A5000
unkown
page readonly
 clean
1FC0000
unkown
page write copy
 clean
2D6000
unkown
page read and write
 clean
3A0000
unkown
page readonly
 clean
28F2000
unkown
page readonly
 clean
There are 136 hidden memdumps, click here to show them.