IOC Report
Essay on Resolution of Korean Forced Labor Claims.vbs

loading gif

Files

File Path
Type
Category
Malicious
Essay on Resolution of Korean Forced Labor Claims.vbs
ASCII text, with very long lines (1455), with CRLF line terminators
initial sample
malicious
Chrome Cache Entry: 56
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 57
ASCII text, with very long lines (554)
downloaded
Chrome Cache Entry: 58
ASCII text, with very long lines (5955)
downloaded
Chrome Cache Entry: 59
ASCII text, with very long lines (56398), with no line terminators
downloaded
Chrome Cache Entry: 60
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 61
ASCII text, with very long lines (2343)
downloaded
Chrome Cache Entry: 62
ASCII text, with very long lines (554)
downloaded
Chrome Cache Entry: 63
PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 64
ASCII text, with very long lines (17696)
downloaded
Chrome Cache Entry: 65
Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
downloaded
Chrome Cache Entry: 66
ASCII text, with very long lines (4179)
downloaded
Chrome Cache Entry: 67
ASCII text, with very long lines (1532), with no line terminators
downloaded
Chrome Cache Entry: 68
PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
downloaded
There are 4 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Windows\System32\wscript.exe
C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Essay on Resolution of Korean Forced Labor Claims.vbs"
malicious
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c explorer "https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\explorer.exe
explorer "https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx"
C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2036,i,652845326045474574,16795533122018123490,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

URLs

Name
IP
Malicious
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/r.php
5.9.123.217
malicious
https://makeoversalon.net.in/
unknown
malicious
https://makeoversalon.net.in/favicon.ico
5.9.123.217
malicious
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/re.php
5.9.123.217
malicious
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-im
unknown
malicious
https://stats.g.doubleclick.net/g/collect
unknown
https://developers.google.com/recaptcha/docs/faq#localhost_support
unknown
https://recaptcha.net/recaptcha/api.js
unknown
https://recaptcha.net/recaptcha/api2/
unknown
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docxV
unknown
https://support.google.com/recaptcha#6262736
unknown
https://makeoversalon.net.in/uage:
unknown
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/re.phpe?
unknown
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx(eK3
unknown
https://ampcid.google.com/v1/publisher:getClientId
unknown
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/re.phpY8
unknown
about:blank
https://www.gstatic.c..?/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__.
unknown
https://recaptcha.net/recaptcha/api2/anchor?ar=1&k=6LdvpRAUAAAAAJkr4psZnXC4TeOEVPwP_bEQrP24&co=aHR0cHM6Ly9tYWtlb3ZlcnNhbG9uLm5ldC5pbjo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&cb=edwdsq8773jn
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docxH
unknown
https://support.google.com/recaptcha/?hl=en#6223828
unknown
https://cloud.google.com/contact
unknown
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docxD
unknown
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docxll
unknown
https://www.google.com
unknown
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx
https://support.google.com/recaptcha/#6175971
unknown
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/re.php1y
unknown
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/re.phpq8
unknown
https://stats.g.doubleclick.net/j/collect
unknown
https://makeoversalon.net.in/RL-
unknown
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-1975075-20&cid=1276044083.1713594250&jid=1814692829&_u=YEBAAUAAAAAAACAAI~&z=711350274
142.250.105.104
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/re.php33
unknown
https://www.google.com/recaptcha/api2/
unknown
https://admin.bitninja.io/cookieimg.php
104.26.14.182
https://support.google.com/recaptcha
unknown
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docxd
unknown
https://a.nel.cloudflare.com/report/v4?s=YI1gzvi8TrNbcxLsvVAUhO1Innrxl9xm34Ag%2B5wEUF8HpZVSgNuefVkS1FOqMCFGL7F%2FE2RAlcrT3Sc3WIKNz3HgepR5cLMQAQnnWVjUIlx%2BpV4q%2BSJn7NcmTCP6DFxa6LX1
35.190.80.1
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/r.phpw
unknown
https://www.google.com/js/bg/rIjZlM8ZNfOeVQTojtt5OPuY9YnE0CAT82tG0V-YUX0.js
172.253.124.106
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/re.php4aZF$
unknown
https://bitninja.io
unknown
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-M2RCV3G3BZ&cid=1276044083.1713594250&gtm=45je44h0v9139052269za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0
74.125.136.154
https://cloud.google.com/recaptcha-enterprise/billing-information
unknown
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-1975075-20&cid=1276044083.1713594250&jid=1814692829&gjid=287345157&_gid=1937593962.1713594250&_u=YEBAAUAAAAAAACAAI~&z=981243278
74.125.136.154
https://recaptcha.net
unknown
https://tagassistant.google.com/
unknown
https://adservice.google.com/pagead/regclk
unknown
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/r.phpj6
unknown
https://cct.google/taggy/agent.js
unknown
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
unknown
https://play.google.com/log?format=json&hasfast=true
unknown
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
unknown
https://recaptcha.net/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LdvpRAUAAAAAJkr4psZnXC4TeOEVPwP_bEQrP24
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/r.phpT
unknown
https://www.google.com/ads/ga-audiences
unknown
https://www.google.%/ads/ga-audiences
unknown
https://analytics.google.com/g/collect?v=2&tid=G-M2RCV3G3BZ&gtm=45je44h0v9139052269za200&_p=1713594248481&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=1276044083.1713594250&ul=en-us&sr=1280x1024&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&pscdl=noapi&_eu=AAAI&_s=1&sid=1713594250&sct=1&seg=0&dl=https%3A%2F%2Fmakeoversalon.net.in%2Fwp-content%2Fplugins%2Fwp-custom-taxonomy-image%2Fiiri%2Fshare.docx&dr=https%3A%2F%2Fmakeoversalon.net.in%2Fwp-content%2Fplugins%2Fwp-custom-taxonomy-image%2Fiiri%2Fshare.docx&dt=Visitor%20anti-robot%20validation&en=page_view&_fv=1&_ss=1&tfd=3102
216.239.38.181
https://td.doubleclick.net
unknown
https://www.merchant-center-analytics.goog
unknown
https://stats.g.doubleclick.net/g/collect?v=2&
unknown
https://analytics.google.com/g/collect?v=2&tid=G-M2RCV3G3BZ&gtm=45je44h0v9139052269za200&_p=1713594248481&gcd=13l3l3l3l1&npa=0&dma=0&cid=1276044083.1713594250&ul=en-us&sr=1280x1024&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&pscdl=noapi&_eu=AAAI&_s=2&sid=1713594250&sct=1&seg=0&dl=https%3A%2F%2Fmakeoversalon.net.in%2Fwp-content%2Fplugins%2Fwp-custom-taxonomy-image%2Fiiri%2Fshare.docx&dr=https%3A%2F%2Fmakeoversalon.net.in%2Fwp-content%2Fplugins%2Fwp-custom-taxonomy-image%2Fiiri%2Fshare.docx&dt=Visitor%20anti-robot%20validation&en=screen_view&_ee=1&ep.screen_name=Captcha%20Page&tfd=8185
216.239.38.181
There are 52 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
makeoversalon.net.in
5.9.123.217
malicious
admin.bitninja.io
104.26.14.182
a.nel.cloudflare.com
35.190.80.1
analytics-alv.google.com
216.239.38.181
www.google.com
172.253.124.147
recaptcha.net
74.125.136.94
stats.g.doubleclick.net
74.125.136.154
analytics.google.com
unknown

IPs

IP
Domain
Country
Malicious
192.168.2.4
unknown
unknown
malicious
5.9.123.217
makeoversalon.net.in
Germany
malicious
104.26.14.182
admin.bitninja.io
United States
74.125.136.106
unknown
United States
216.239.38.181
analytics-alv.google.com
United States
172.253.124.106
unknown
United States
172.253.124.147
www.google.com
United States
64.233.177.157
unknown
United States
35.190.80.1
a.nel.cloudflare.com
United States
142.250.105.104
unknown
United States
104.26.15.182
unknown
United States
239.255.255.250
unknown
Reserved
74.125.136.154
stats.g.doubleclick.net
United States
64.233.185.147
unknown
United States
There are 4 hidden IPs, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
22AC5A1B000
heap
page read and write
22AC3CC7000
heap
page read and write
22AC3CAB000
heap
page read and write
22AC3B90000
heap
page read and write
A8E000
heap
page read and write
B86000
heap
page read and write
22AC5D1E000
heap
page read and write
22AC5D31000
heap
page read and write
22AC5D35000
heap
page read and write
22AC3AB0000
heap
page read and write
22AC3CC5000
heap
page read and write
E2A25FF000
stack
page read and write
22AC3C5C000
heap
page read and write
D2E000
stack
page read and write
22AC5C8F000
heap
page read and write
22AC5A60000
heap
page read and write
A8E000
heap
page read and write
22AC5D31000
heap
page read and write
22AC3E3A000
heap
page read and write
22AC5C6D000
heap
page read and write
22AC5D1E000
heap
page read and write
E2A28FB000
stack
page read and write
A95000
heap
page read and write
22AC5A2F000
heap
page read and write
22AC5D2B000
heap
page read and write
22AC5A37000
heap
page read and write
22AC66F3000
heap
page read and write
B41000
heap
page read and write
E2A2AFB000
stack
page read and write
22AC5CE7000
heap
page read and write
A98000
stack
page read and write
22AC5D31000
heap
page read and write
22AC66F3000
heap
page read and write
22AC5C50000
heap
page read and write
22AC3CCD000
heap
page read and write
22AC5D29000
heap
page read and write
22AC5D31000
heap
page read and write
22AC5D1E000
heap
page read and write
22AC3C8D000
heap
page read and write
22AC5C97000
heap
page read and write
22AC5D60000
heap
page read and write
22AC3CDD000
heap
page read and write
22AC5D2B000
heap
page read and write
22AC3E3D000
heap
page read and write
22AC5C92000
heap
page read and write
22AC5CC6000
heap
page read and write
22AC3C3C000
heap
page read and write
22AC3C5C000
heap
page read and write
22AC5E00000
remote allocation
page read and write
A9A000
heap
page read and write
22AC5C6D000
heap
page read and write
E2A21FE000
stack
page read and write
22AC5C40000
heap
page read and write
22AC5D0D000
heap
page read and write
22AC5C6B000
heap
page read and write
A82000
heap
page read and write
22AC5A4A000
heap
page read and write
22AC5CA2000
heap
page read and write
256F000
stack
page read and write
AAE000
heap
page read and write
22AC3E3E000
heap
page read and write
22AC5D2B000
heap
page read and write
ED5000
heap
page read and write
22AC3E3E000
heap
page read and write
ECE000
stack
page read and write
22AC5CD1000
heap
page read and write
22AC3C69000
heap
page read and write
22AC5D38000
heap
page read and write
27BE000
stack
page read and write
22AC5C8F000
heap
page read and write
AC1000
heap
page read and write
22AC5A11000
heap
page read and write
22AC3C76000
heap
page read and write
22AC5C4D000
heap
page read and write
22AC5A4A000
heap
page read and write
22AC5A4A000
heap
page read and write
22AC5C6B000
heap
page read and write
22AC5A17000
heap
page read and write
22AC5D35000
heap
page read and write
22AC5D38000
heap
page read and write
22AC5C57000
heap
page read and write
B80000
heap
page read and write
22AC66E0000
heap
page read and write
22AC3E38000
heap
page read and write
22AC5D0D000
heap
page read and write
E2A27FC000
stack
page read and write
25EE000
stack
page read and write
22AC3DA0000
heap
page read and write
22AC5D29000
heap
page read and write
AF0000
heap
page read and write
22AC5D38000
heap
page read and write
22AC5A2B000
heap
page read and write
22AC5D31000
heap
page read and write
22AC5C61000
heap
page read and write
22AC5D29000
heap
page read and write
22AC5D02000
heap
page read and write
22AC3C8D000
heap
page read and write
22AC5C59000
heap
page read and write
22AC5C8F000
heap
page read and write
22AC5A1F000
heap
page read and write
22AC3E39000
heap
page read and write
22AC5F80000
heap
page read and write
22AC5C6D000
heap
page read and write
22AC66A7000
heap
page read and write
22AC5D35000
heap
page read and write
22AC5E40000
heap
page read and write
22AC6680000
heap
page read and write
22AC5D02000
heap
page read and write
22AC5D02000
heap
page read and write
E2A29FE000
stack
page read and write
22AC3BB0000
heap
page read and write
22AC5A4A000
heap
page read and write
22AC5D17000
heap
page read and write
B7C000
heap
page read and write
22AC5D2B000
heap
page read and write
22AC3E38000
heap
page read and write
AE0000
heap
page read and write
AC1000
heap
page read and write
2820000
heap
page read and write
22AC66B9000
heap
page read and write
22AC5A11000
heap
page read and write
22AC3CAF000
heap
page read and write
22AC5C4B000
heap
page read and write
22AC5D38000
heap
page read and write
22AC5D10000
heap
page read and write
22AC5D35000
heap
page read and write
22AC5D31000
heap
page read and write
22AC5A17000
heap
page read and write
22AC5CE4000
heap
page read and write
22AC5D31000
heap
page read and write
22AC5C63000
heap
page read and write
22AC5C97000
heap
page read and write
22AC5D35000
heap
page read and write
22AC5D31000
heap
page read and write
22AC5D35000
heap
page read and write
22AC5D0D000
heap
page read and write
2DDF000
stack
page read and write
22AC5E00000
remote allocation
page read and write
22AC3CBD000
heap
page read and write
22AC3CDD000
heap
page read and write
22AC5A4A000
heap
page read and write
22AC5D38000
heap
page read and write
ED0000
heap
page read and write
B7D000
heap
page read and write
AB5000
heap
page read and write
22AC5A13000
heap
page read and write
22AC5D17000
heap
page read and write
22AC66E0000
heap
page read and write
22AC3E30000
heap
page read and write
22AC5A4A000
heap
page read and write
22AC5D38000
heap
page read and write
22AC5A4A000
heap
page read and write
22AC5A60000
heap
page read and write
22AC5CC6000
heap
page read and write
22AC6280000
trusted library allocation
page read and write
22AC5CC6000
heap
page read and write
2A0F000
stack
page read and write
22AC3C3B000
heap
page read and write
B17000
heap
page read and write
22AC5D02000
heap
page read and write
22AC5C6D000
heap
page read and write
22AC5C9A000
heap
page read and write
22AC5CDF000
heap
page read and write
22AC3CC5000
heap
page read and write
22AC3CCB000
heap
page read and write
7C0000
heap
page read and write
273C000
stack
page read and write
22AC5D28000
heap
page read and write
AAF000
heap
page read and write
22AC5C59000
heap
page read and write
22AC5D2B000
heap
page read and write
22AC3C3F000
heap
page read and write
E2A22FE000
stack
page read and write
22AC5D35000
heap
page read and write
22AC5D38000
heap
page read and write
B85000
heap
page read and write
22AC5C57000
heap
page read and write
22AC3CBC000
heap
page read and write
22AC5E30000
heap
page read and write
E2A20F9000
stack
page read and write
22AC5CE7000
heap
page read and write
22AC3CB5000
heap
page read and write
22AC5CA0000
heap
page read and write
22AC5D10000
heap
page read and write
22AC5C58000
heap
page read and write
22AC3C40000
heap
page read and write
22AC5C6B000
heap
page read and write
22AC5C97000
heap
page read and write
2640000
heap
page read and write
7A0000
heap
page read and write
22AC3C4F000
heap
page read and write
22AC5CDF000
heap
page read and write
22AC3E35000
heap
page read and write
22AC5D0D000
heap
page read and write
22AC6270000
heap
page read and write
E2A2BFE000
stack
page read and write
22AC5D38000
heap
page read and write
22AC5D02000
heap
page read and write
22AC5C5F000
heap
page read and write
AB5000
heap
page read and write
22AC5A4A000
heap
page read and write
22AC5CA6000
heap
page read and write
22AC3CAB000
heap
page read and write
22AC5D0D000
heap
page read and write
22AC5A3F000
heap
page read and write
22AC3E3E000
heap
page read and write
22AC3CBF000
heap
page read and write
22AC3CAB000
heap
page read and write
22AC5A4A000
heap
page read and write
22AC5C90000
heap
page read and write
22AC3CB4000
heap
page read and write
22AC3C8D000
heap
page read and write
22AC5A4A000
heap
page read and write
22AC5E45000
heap
page read and write
22AC5CC6000
heap
page read and write
22AC5E00000
remote allocation
page read and write
22AC5CCF000
heap
page read and write
22AC5C5C000
heap
page read and write
22AC3CB6000
heap
page read and write
22AC5A4A000
heap
page read and write
22AC3CC6000
heap
page read and write
22AC5A27000
heap
page read and write
B10000
heap
page read and write
790000
heap
page read and write
CAE000
stack
page read and write
A83000
heap
page read and write
22AC3C8D000
heap
page read and write
22AC5A23000
heap
page read and write
22AC5D10000
heap
page read and write
22AC5C8F000
heap
page read and write
F10000
heap
page read and write
22AC5D31000
heap
page read and write
F15000
heap
page read and write
22AC5D35000
heap
page read and write
22AC5D35000
heap
page read and write
BAB000
heap
page read and write
22AC5E50000
heap
page read and write
A9B000
heap
page read and write
B60000
heap
page read and write
AB5000
heap
page read and write
E2A26FF000
stack
page read and write
22AC5F70000
heap
page read and write
22AC3CAB000
heap
page read and write
22AC3E39000
heap
page read and write
B81000
heap
page read and write
22AC5C6B000
heap
page read and write
22AC5A10000
heap
page read and write
DE0000
heap
page read and write
22AC5D38000
heap
page read and write
A69000
heap
page read and write
22AC5D10000
heap
page read and write
22AC5D2B000
heap
page read and write
22AC5C59000
heap
page read and write
22AC5D29000
heap
page read and write
22AC60E0000
heap
page read and write
22AC3CAB000
heap
page read and write
22AC3C10000
heap
page read and write
22AC5D38000
heap
page read and write
BAB000
heap
page read and write
22AC66B9000
heap
page read and write
74B000
stack
page read and write
E2A24FF000
stack
page read and write
22AC3CDD000
heap
page read and write
22AC5A14000
heap
page read and write
22AC3CB9000
heap
page read and write
22AC5D10000
heap
page read and write
A60000
heap
page read and write
22AC5D31000
heap
page read and write
22AC3C5C000
heap
page read and write
22AC5D35000
heap
page read and write
AC1000
heap
page read and write
22AC5CCF000
heap
page read and write
There are 262 hidden memdumps, click here to show them.

DOM / HTML

URL
Malicious
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx
https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx
about:blank
https://recaptcha.net/recaptcha/api2/anchor?ar=1&k=6LdvpRAUAAAAAJkr4psZnXC4TeOEVPwP_bEQrP24&co=aHR0cHM6Ly9tYWtlb3ZlcnNhbG9uLm5ldC5pbjo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&cb=edwdsq8773jn
https://recaptcha.net/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LdvpRAUAAAAAJkr4psZnXC4TeOEVPwP_bEQrP24