IOCReport

loading gif

Files

File Path
Type
Category
Malicious
0b31c0f0_by_Libranalysis.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Author: van-van, Last Saved By: vi-vi, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed May 12 08:24:11 2021, Security: 0
initial sample
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 59863 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\C6DE0000
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\CabE15B.tmp
Microsoft Cabinet archive data, 59863 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\Local\Temp\TarE15C.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\0b31c0f0_by_Libranalysis.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu May 13 02:52:28 2021, mtime=Thu May 13 02:52:40 2021, atime=Thu May 13 02:52:40 2021, length=174080, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Thu May 13 02:52:40 2021, atime=Thu May 13 02:52:40 2021, length=16384, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\Desktop\97DE0000
Applesoft BASIC program data, first line number 16
dropped
 clean
There are 2 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\ritofm.cvm,DllRegisterServer
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\ritofm.cvm1,DllRegisterServer
 malicious

URLs

Name
IP
Malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://investor.msn.com/
unknown
 clean

Domains

Name
IP
Malicious
signifysystem.com
192.185.39.58
 clean
fcventasyservicios.cl
192.185.32.232
 clean

IPs

IP
Domain
Country
Malicious
192.185.39.58
signifysystem.com
United States
clean
192.185.32.232
fcventasyservicios.cl
United States
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
*-8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED1C0
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED4DC
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED5D6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED672
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED76B
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED865
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
98
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\system32\qagentrt.dll,-10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-843
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-844
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\wuaueng.dll,-400
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1115B2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1121C3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
There are 111 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
140000
unkown
page readonly
 clean
2D75000
heap private
page read and write
 clean
320000
unkown
page read and write
 clean
2895000
unkown
page readonly
 clean
2975000
unkown
page readonly
 clean
640000
unkown
page readonly
 clean
BBF000
unkown
page read and write
 clean
28C5000
unkown
page readonly
 clean
27C6000
unkown
page readonly
 clean
2864000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
2989000
unkown
page readonly
 clean
2D70000
heap private
page read and write
 clean
70000
unkown
page read and write
 clean
2D10000
unkown
page readonly
 clean
69E000
unkown
page read and write
 clean
100000
heap private
page read and write
 clean
2BB0000
heap private
page read and write
 clean
2A25000
unkown
page readonly
 clean
21F0000
unkown
page readonly
 clean
2AE0000
unkown
page readonly
 clean
1BE0000
unkown
page readonly
 clean
29C5000
unkown
page readonly
 clean
4E0000
unkown
page readonly
 clean
4C0000
unkown
page readonly
 clean
320000
heap private
page read and write
 clean
28F6000
unkown
page readonly
 clean
364000
heap private
page read and write
 clean
3C7000
heap default
page read and write
 clean
2859000
unkown
page readonly
 clean
27E5000
unkown
page readonly
 clean
366000
unkown
page read and write
 clean
2752000
unkown
page readonly
 clean
2986000
unkown
page readonly
 clean
3FE000
heap default
page read and write
 clean
2A02000
unkown
page readonly
 clean
2280000
heap private
page read and write
 clean
2155000
heap private
page read and write
 clean
1FC000
unkown
page read and write
 clean
2815000
unkown
page readonly
 clean
28A4000
unkown
page readonly
 clean
2882000
unkown
page readonly
 clean
2774000
unkown
page readonly
 clean
29A9000
unkown
page readonly
 clean
28D2000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
25E000
heap default
page read and write
 clean
2C30000
unkown
page read and write
 clean
2150000
heap private
page read and write
 clean
29D2000
unkown
page readonly
 clean
2956000
unkown
page readonly
 clean
2845000
unkown
page readonly
 clean
BD000
unkown
page read and write
 clean
28D9000
unkown
page readonly
 clean
2FE0000
unkown
page read and write
 clean
27D2000
unkown
page readonly
 clean
2320000
unkown
page readonly
 clean
29A2000
unkown
page readonly
 clean
660000
unkown
page readonly
 clean
27B5000
unkown
page readonly
 clean
26A8000
unkown
page readonly
 clean
1D6000
heap default
page read and write
 clean
220000
heap default
page read and write
 clean
2A62000
unkown
page readonly
 clean
190000
heap default
page read and write
 clean
2862000
unkown
page readonly
 clean
2C10000
unkown
page readonly
 clean
2BEB000
heap private
page read and write
 clean
6A0000
unkown
page readonly
 clean
27A2000
unkown
page readonly
 clean
1CD000
heap default
page read and write
 clean
197000
heap default
page read and write
 clean
285D000
unkown
page readonly
 clean
2802000
unkown
page readonly
 clean
236000
unkown
page read and write
 clean
13B000
unkown
page read and write
 clean
1FC0000
unkown
page write copy
 clean
28E5000
unkown
page readonly
 clean
2732000
unkown
page readonly
 clean
28A9000
unkown
page readonly
 clean
324000
heap private
page read and write
 clean
2879000
unkown
page readonly
 clean
26A2000
unkown
page readonly
 clean
2902000
unkown
page readonly
 clean
1C00000
unkown
page readonly
 clean
2754000
unkown
page readonly
 clean
1FE0000
unkown
page write copy
 clean
2672000
unkown
page readonly
 clean
2BB5000
heap private
page read and write
 clean
2285000
heap private
page read and write
 clean
2962000
unkown
page readonly
 clean
356000
unkown
page read and write
 clean
2BD0000
unkown
page readonly
 clean
2915000
unkown
page readonly
 clean
21D0000
unkown
page readonly
 clean
2AC0000
unkown
page readonly
 clean
2159000
heap private
page read and write
 clean
60000
unkown
page read and write
 clean
2872000
unkown
page readonly
 clean
2856000
unkown
page readonly
 clean
2DF0000
unkown
page readonly
 clean
4D0000
heap private
page read and write
 clean
2572000
unkown
page readonly
 clean
2289000
heap private
page read and write
 clean
360000
heap private
page read and write
 clean
2826000
unkown
page readonly
 clean
2945000
unkown
page readonly
 clean
2300000
unkown
page readonly
 clean
28A2000
unkown
page readonly
 clean
330000
unkown
page read and write
 clean
29F5000
unkown
page readonly
 clean
D0000
unkown
page read and write
 clean
2772000
unkown
page readonly
 clean
28A2000
unkown
page readonly
 clean
28F5000
unkown
page readonly
 clean
2832000
unkown
page readonly
 clean
2734000
unkown
page readonly
 clean
3C0000
heap default
page read and write
 clean
2AA0000
unkown
page readonly
 clean
2BF0000
unkown
page readonly
 clean
298D000
unkown
page readonly
 clean
2932000
unkown
page readonly
 clean
227000
heap default
page read and write
 clean
53F000
unkown
page read and write
 clean
29D9000
unkown
page readonly
 clean
E0000
unkown
page readonly
 clean
200000
unkown
page read and write
 clean
27A2000
unkown
page readonly
 clean
2B92000
unkown
page readonly
 clean
4D4000
heap private
page read and write
 clean
2926000
unkown
page readonly
 clean
2C30000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
E0000
unkown
page read and write
 clean
1DB000
heap default
page read and write
 clean
1DC7000
unkown
page readonly
 clean
1DE7000
unkown
page readonly
 clean
2140000
unkown
page readonly
 clean
2884000
unkown
page readonly
 clean
2DAB000
heap private
page read and write
 clean
20C0000
heap private
page read and write
 clean
27F6000
unkown
page readonly
 clean
2A09000
unkown
page readonly
 clean
28D2000
unkown
page readonly
 clean
2578000
unkown
page readonly
 clean
There are 135 hidden memdumps, click here to show them.