IOCReport

loading gif

Files

File Path
Type
Category
Malicious
afdab907_by_Libranalysis.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Author: van-van, Last Saved By: vi-vi, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed May 12 08:24:11 2021, Security: 0
initial sample
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 59863 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\C9EE0000
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\CabF3F1.tmp
Microsoft Cabinet archive data, 59863 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\Local\Temp\TarF3F2.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed May 12 21:39:45 2021, atime=Wed May 12 21:39:45 2021, length=8192, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\afdab907_by_Libranalysis.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed May 12 21:39:31 2021, mtime=Wed May 12 21:39:45 2021, atime=Wed May 12 21:39:45 2021, length=174080, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\Desktop\8AEE0000
Applesoft BASIC program data, first line number 16
dropped
 clean
There are 2 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\ritofm.cvm,DllRegisterServer
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\ritofm.cvm1,DllRegisterServer
 malicious

URLs

Name
IP
Malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://investor.msn.com/
unknown
 clean

Domains

Name
IP
Malicious
signifysystem.com
192.185.39.58
 clean
fcventasyservicios.cl
192.185.32.232
 clean

IPs

IP
Domain
Country
Malicious
192.185.39.58
signifysystem.com
United States
clean
192.185.32.232
fcventasyservicios.cl
United States
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{ 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE4E3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE7D0
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE89A
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE965
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EEA5F
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EEB1A
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
5+8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\system32\qagentrt.dll,-10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-843
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-844
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\wuaueng.dll,-400
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
111065
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
111CE3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
There are 111 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
27D2000
unkown
page readonly
 clean
2950000
unkown
page readonly
 clean
38D000
heap default
page read and write
 clean
350000
heap default
page read and write
 clean
100000
unkown
page readonly
 clean
2642000
unkown
page readonly
 clean
2C25000
heap private
page read and write
 clean
356000
unkown
page read and write
 clean
2709000
unkown
page readonly
 clean
27F6000
unkown
page readonly
 clean
2428000
unkown
page readonly
 clean
2775000
unkown
page readonly
 clean
15C000
unkown
page read and write
 clean
2B25000
heap private
page read and write
 clean
1BE000
heap default
page read and write
 clean
2895000
unkown
page readonly
 clean
2782000
unkown
page readonly
 clean
FC000
unkown
page read and write
 clean
2879000
unkown
page readonly
 clean
2752000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
396000
heap default
page read and write
 clean
29B0000
unkown
page readonly
 clean
2B6000
unkown
page read and write
 clean
2676000
unkown
page readonly
 clean
5C0000
unkown
page readonly
 clean
280000
unkown
page read and write
 clean
1A0000
heap private
page read and write
 clean
227000
heap default
page read and write
 clean
2865000
unkown
page readonly
 clean
5A0000
unkown
page readonly
 clean
282D000
unkown
page readonly
 clean
2A32000
unkown
page readonly
 clean
2802000
unkown
page readonly
 clean
60000
unkown
page read and write
 clean
2089000
heap private
page read and write
 clean
2622000
unkown
page readonly
 clean
2080000
unkown
page readonly
 clean
2AB0000
unkown
page readonly
 clean
2729000
unkown
page readonly
 clean
2759000
unkown
page readonly
 clean
2120000
heap private
page read and write
 clean
2872000
unkown
page readonly
 clean
5B0000
heap private
page read and write
 clean
2604000
unkown
page readonly
 clean
2522000
unkown
page readonly
 clean
28C5000
unkown
page readonly
 clean
26D6000
unkown
page readonly
 clean
D0000
unkown
page readonly
 clean
39B000
heap default
page read and write
 clean
28A9000
unkown
page readonly
 clean
26E2000
unkown
page readonly
 clean
25E4000
unkown
page readonly
 clean
2990000
unkown
page readonly
 clean
2A70000
unkown
page readonly
 clean
1A9000
heap private
page read and write
 clean
28A2000
unkown
page readonly
 clean
2849000
unkown
page readonly
 clean
21A0000
unkown
page readonly
 clean
2C20000
heap private
page read and write
 clean
160000
unkown
page read and write
 clean
170000
unkown
page read and write
 clean
440000
unkown
page readonly
 clean
2912000
unkown
page readonly
 clean
2652000
unkown
page readonly
 clean
2744000
unkown
page readonly
 clean
2000000
heap private
page read and write
 clean
2AD0000
unkown
page readonly
 clean
430000
heap private
page read and write
 clean
24000
heap private
page read and write
 clean
2706000
unkown
page readonly
 clean
2970000
unkown
page readonly
 clean
2682000
unkown
page readonly
 clean
26A6000
unkown
page readonly
 clean
26C5000
unkown
page readonly
 clean
27A5000
unkown
page readonly
 clean
357000
heap default
page read and write
 clean
2BA0000
unkown
page readonly
 clean
2F70000
unkown
page read and write
 clean
2702000
unkown
page readonly
 clean
2745000
unkown
page readonly
 clean
2815000
unkown
page readonly
 clean
2602000
unkown
page readonly
 clean
27A2000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
25E000
heap default
page read and write
 clean
270D000
unkown
page readonly
 clean
680000
unkown
page readonly
 clean
2826000
unkown
page readonly
 clean
70000
unkown
page read and write
 clean
4CF000
unkown
page read and write
 clean
1B40000
unkown
page readonly
 clean
106000
unkown
page read and write
 clean
1F40000
unkown
page write copy
 clean
2842000
unkown
page readonly
 clean
180000
heap default
page read and write
 clean
2624000
unkown
page readonly
 clean
2704000
unkown
page readonly
 clean
2796000
unkown
page readonly
 clean
2B5B000
heap private
page read and write
 clean
1D47000
unkown
page readonly
 clean
2085000
heap private
page read and write
 clean
2422000
unkown
page readonly
 clean
220000
heap default
page read and write
 clean
187000
heap default
page read and write
 clean
D0000
unkown
page read and write
 clean
320000
unkown
page read and write
 clean
2548000
unkown
page readonly
 clean
B2F000
unkown
page read and write
 clean
2829000
unkown
page readonly
 clean
27E5000
unkown
page readonly
 clean
27B5000
unkown
page readonly
 clean
1D27000
unkown
page readonly
 clean
2080000
heap private
page read and write
 clean
2CA0000
unkown
page readonly
 clean
21C0000
unkown
page readonly
 clean
2785000
unkown
page readonly
 clean
2665000
unkown
page readonly
 clean
5B4000
heap private
page read and write
 clean
26F5000
unkown
page readonly
 clean
2772000
unkown
page readonly
 clean
420000
unkown
page readonly
 clean
2724000
unkown
page readonly
 clean
57E000
unkown
page read and write
 clean
2542000
unkown
page readonly
 clean
26D000
unkown
page read and write
 clean
60000
unkown
page readonly
 clean
2722000
unkown
page readonly
 clean
1F20000
unkown
page write copy
 clean
27C6000
unkown
page readonly
 clean
20A0000
unkown
page readonly
 clean
2742000
unkown
page readonly
 clean
20000
heap private
page read and write
 clean
434000
heap private
page read and write
 clean
2695000
unkown
page readonly
 clean
26B2000
unkown
page readonly
 clean
2E70000
unkown
page read and write
 clean
2789000
unkown
page readonly
 clean
25E2000
unkown
page readonly
 clean
1A5000
heap private
page read and write
 clean
2B20000
heap private
page read and write
 clean
1B60000
unkown
page readonly
 clean
2C5B000
heap private
page read and write
 clean
2722000
unkown
page readonly
 clean
2A90000
unkown
page readonly
 clean
There are 135 hidden memdumps, click here to show them.