Windows Analysis Report
Insight_Medical_Publishing_1.one

Overview

General Information

Sample Name: Insight_Medical_Publishing_1.one
Analysis ID: 828501
MD5: f44cb44a2dec6fce42d41a947ca5c120
SHA1: 44672a849c91752c91fbbfeb91e300a3656352ea
SHA256: d894d541d5d911265a4e60a04c413939a14105072a67f5a3d50de2d0002d0003
Tags: one
Infos:

Detection

Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Malicious OneNote
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Sigma detected: Run temp file via regsvr32
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Document exploit detected (process start blacklist hit)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Stores files to the Windows start menu directory
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to call native functions
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Drops PE files
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Detected TCP or UDP traffic on non-standard ports
Connects to several IPs in different countries
Creates a start menu entry (Start Menu\Programs\Startup)
Registers a DLL
Dropped file seen in connection with other malware
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Insight_Medical_Publishing_1.one ReversingLabs: Detection: 33%
Source: Insight_Medical_Publishing_1.one Virustotal: Detection: 42% Perma Link
Antivirus detection for URL or domain
Source: https://66.228.32.31:7080/ Avira URL Cloud: Label: malware
Source: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/0 Avira URL Cloud: Label: malware
Source: http://ozmeydan.com/cekici/9/ Avira URL Cloud: Label: malware
Source: https://penshorn.org/admin/Ses8712iGR8du/tM Avira URL Cloud: Label: malware
Source: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/ Avira URL Cloud: Label: malware
Source: https://104.168.155.143:8080/l Avira URL Cloud: Label: malware
Source: https://163.44.196.120:8080/acfnurik/pjkp/ Avira URL Cloud: Label: malware
Source: https://159.89.202.34/acfnurik/pjkp/G Avira URL Cloud: Label: malware
Source: https://164.90.222.65/acfnurik/pjkp/- Avira URL Cloud: Label: malware
Source: https://91.121.146.47:8080/acfnurik/pjkp/ Avira URL Cloud: Label: malware
Source: https://187.63.160.88:80/acfnurik/pjkp/q Avira URL Cloud: Label: malware
Source: https://104.168.155.143:8080/acfnurik/pjkp/ Avira URL Cloud: Label: malware
Source: https://159.89.202.34/acfnurik/pjkp/ Avira URL Cloud: Label: malware
Source: https://www.gomespontes.com.br/logs/pd/ Avira URL Cloud: Label: malware
Source: https://159.65.88.10:8080/ Avira URL Cloud: Label: malware
Source: https://163.44.196.120:8080/L Avira URL Cloud: Label: malware
Source: https://penshorn.org/admin/Ses8712iGR8du/otn Avira URL Cloud: Label: malware
Source: https://159.65.88.10:8080/acfnurik/pjkp/ Avira URL Cloud: Label: malware
Source: http://ozmeydan.com/cekici/9/xM Avira URL Cloud: Label: malware
Source: http://softwareulike.com/cWIYxWMPkK/ Avira URL Cloud: Label: malware
Source: https://penshorn.org:443/admin/Ses8712iGR8du/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: penshorn.org Virustotal: Detection: 10% Perma Link
Source: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/ Virustotal: Detection: 20% Perma Link
Source: https://66.228.32.31:7080/ Virustotal: Detection: 11% Perma Link
Source: http://ozmeydan.com/cekici/9/ Virustotal: Detection: 15% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\rad617F4.tmp.dll ReversingLabs: Detection: 58%
Source: C:\Windows\System32\FtYcgioKSiXTtw\clpHRoMLOOCr.dll (copy) ReversingLabs: Detection: 58%
Source: 0000000D.00000002.560675790.00000000009C8000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: Emotet {"C2 list": ["91.121.146.47:8080", "66.228.32.31:7080", "182.162.143.56:443", "187.63.160.88:80", "167.172.199.165:8080", "164.90.222.65:443", "104.168.155.143:8080", "163.44.196.120:8080", "160.16.142.56:8080", "159.89.202.34:443", "159.65.88.10:8080", "186.194.240.217:443", "149.56.131.28:8080", "72.15.201.15:8080", "1.234.2.232:8080", "82.223.21.224:8080", "206.189.28.199:8080", "169.57.156.166:8080", "107.170.39.149:8080", "103.43.75.120:443", "91.207.28.33:8080", "213.239.212.5:443", "45.235.8.30:8080", "119.59.103.152:8080", "164.68.99.3:8080", "95.217.221.146:8080", "153.126.146.25:7080", "197.242.150.244:8080", "202.129.205.3:8080", "103.132.242.26:8080", "139.59.126.41:443", "110.232.117.186:8080", "183.111.227.137:8080", "5.135.159.50:443", "201.94.166.162:443", "103.75.201.2:443", "79.137.35.198:8080", "172.105.226.75:8080", "94.23.45.86:4143", "115.68.227.76:8080", "153.92.5.27:8080", "167.172.253.162:8080", "188.44.20.25:443", "147.139.166.154:8080", "129.232.188.93:443", "173.212.193.249:8080", "185.4.135.165:8080", "45.176.232.124:443"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5ek/BaQApAJA=", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2xU9saQAYAJA="]}
Source: unknown HTTPS traffic detected: 203.26.41.131:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.7:49707 version: TLS 1.2
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180008D28 FindFirstFileExW, 12_2_0000000180008D28

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process created: C:\Windows\SysWOW64\wscript.exe

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 159.65.88.10 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 164.90.222.65 443 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Network Connect: 203.26.41.131 443 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Domain query: penshorn.org
Source: C:\Windows\System32\regsvr32.exe Network Connect: 66.228.32.31 7080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 187.63.160.88 80 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 104.168.155.143 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 159.89.202.34 443 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 91.121.146.47 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 160.16.142.56 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 182.162.143.56 443 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 167.172.199.165 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 163.44.196.120 8080 Jump to behavior
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2404312 ET CNC Feodo Tracker Reported CnC Server TCP group 7 192.168.2.7:49707 -> 182.162.143.56:443
Source: Traffic Snort IDS: 2404344 ET CNC Feodo Tracker Reported CnC Server TCP group 23 192.168.2.7:49704 -> 91.121.146.47:8080
Source: Traffic Snort IDS: 2404330 ET CNC Feodo Tracker Reported CnC Server TCP group 16 192.168.2.7:49706 -> 66.228.32.31:7080
Source: Traffic Snort IDS: 2404308 ET CNC Feodo Tracker Reported CnC Server TCP group 5 192.168.2.7:49709 -> 167.172.199.165:8080
Source: Traffic Snort IDS: 2404302 ET CNC Feodo Tracker Reported CnC Server TCP group 2 192.168.2.7:49714 -> 104.168.155.143:8080
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 91.121.146.47:8080
Source: Malware configuration extractor IPs: 66.228.32.31:7080
Source: Malware configuration extractor IPs: 182.162.143.56:443
Source: Malware configuration extractor IPs: 187.63.160.88:80
Source: Malware configuration extractor IPs: 167.172.199.165:8080
Source: Malware configuration extractor IPs: 164.90.222.65:443
Source: Malware configuration extractor IPs: 104.168.155.143:8080
Source: Malware configuration extractor IPs: 163.44.196.120:8080
Source: Malware configuration extractor IPs: 160.16.142.56:8080
Source: Malware configuration extractor IPs: 159.89.202.34:443
Source: Malware configuration extractor IPs: 159.65.88.10:8080
Source: Malware configuration extractor IPs: 186.194.240.217:443
Source: Malware configuration extractor IPs: 149.56.131.28:8080
Source: Malware configuration extractor IPs: 72.15.201.15:8080
Source: Malware configuration extractor IPs: 1.234.2.232:8080
Source: Malware configuration extractor IPs: 82.223.21.224:8080
Source: Malware configuration extractor IPs: 206.189.28.199:8080
Source: Malware configuration extractor IPs: 169.57.156.166:8080
Source: Malware configuration extractor IPs: 107.170.39.149:8080
Source: Malware configuration extractor IPs: 103.43.75.120:443
Source: Malware configuration extractor IPs: 91.207.28.33:8080
Source: Malware configuration extractor IPs: 213.239.212.5:443
Source: Malware configuration extractor IPs: 45.235.8.30:8080
Source: Malware configuration extractor IPs: 119.59.103.152:8080
Source: Malware configuration extractor IPs: 164.68.99.3:8080
Source: Malware configuration extractor IPs: 95.217.221.146:8080
Source: Malware configuration extractor IPs: 153.126.146.25:7080
Source: Malware configuration extractor IPs: 197.242.150.244:8080
Source: Malware configuration extractor IPs: 202.129.205.3:8080
Source: Malware configuration extractor IPs: 103.132.242.26:8080
Source: Malware configuration extractor IPs: 139.59.126.41:443
Source: Malware configuration extractor IPs: 110.232.117.186:8080
Source: Malware configuration extractor IPs: 183.111.227.137:8080
Source: Malware configuration extractor IPs: 5.135.159.50:443
Source: Malware configuration extractor IPs: 201.94.166.162:443
Source: Malware configuration extractor IPs: 103.75.201.2:443
Source: Malware configuration extractor IPs: 79.137.35.198:8080
Source: Malware configuration extractor IPs: 172.105.226.75:8080
Source: Malware configuration extractor IPs: 94.23.45.86:4143
Source: Malware configuration extractor IPs: 115.68.227.76:8080
Source: Malware configuration extractor IPs: 153.92.5.27:8080
Source: Malware configuration extractor IPs: 167.172.253.162:8080
Source: Malware configuration extractor IPs: 188.44.20.25:443
Source: Malware configuration extractor IPs: 147.139.166.154:8080
Source: Malware configuration extractor IPs: 129.232.188.93:443
Source: Malware configuration extractor IPs: 173.212.193.249:8080
Source: Malware configuration extractor IPs: 185.4.135.165:8080
Source: Malware configuration extractor IPs: 45.176.232.124:443
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: RACKCORP-APRackCorpAU RACKCORP-APRackCorpAU
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: ce5f3254611a8c095a3d821d44539877
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /acfnurik/pjkp/ HTTP/1.1Connection: Keep-AliveContent-Length: 0Host: 182.162.143.56
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 110.232.117.186 110.232.117.186
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /admin/Ses8712iGR8du/ HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: penshorn.org
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.7:49704 -> 91.121.146.47:8080
Source: global traffic TCP traffic: 192.168.2.7:49706 -> 66.228.32.31:7080
Source: global traffic TCP traffic: 192.168.2.7:49709 -> 167.172.199.165:8080
Source: global traffic TCP traffic: 192.168.2.7:49714 -> 104.168.155.143:8080
Source: global traffic TCP traffic: 192.168.2.7:49715 -> 163.44.196.120:8080
Source: global traffic TCP traffic: 192.168.2.7:49716 -> 160.16.142.56:8080
Source: global traffic TCP traffic: 192.168.2.7:49721 -> 159.65.88.10:8080
Connects to several IPs in different countries
Source: unknown Network traffic detected: IP country count 18
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: wscript.exe, 0000000A.00000003.345217524.0000000005A86000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.343202791.0000000005A86000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.349225130.0000000005A86000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.532477535.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.533737252.0000000000A5F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.400278720.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.561463201.0000000000A60000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 0000000D.00000003.533737252.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.400278720.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.561463201.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.400278720.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.532477535.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.13.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 0000000D.00000003.396746413.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?0e63ba9029ba0
Source: regsvr32.exe, 0000000D.00000003.400051235.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.400361549.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.561180722.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.533810298.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enEM32
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: wscript.exe, wscript.exe, 0000000A.00000003.330847371.00000000056DF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.322100825.0000000003144000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.322645365.0000000003155000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.344745583.00000000058AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337313422.0000000005744000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342708876.00000000059CA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.322847815.00000000054CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.326801237.0000000005634000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338014763.0000000005799000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.349049882.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340897230.00000000058AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.341340667.00000000058D5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337313422.0000000005784000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342086843.0000000005957000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.321369309.000000000311D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.325136624.0000000005507000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330151704.0000000005654000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342624531.00000000059C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.324592475.000000000556E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330572608.00000000056E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ozmeydan.com/cekici/9/
Source: wscript.exe, 0000000A.00000003.342822550.0000000005200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ozmeydan.com/cekici/9/xM
Source: wscript.exe, 0000000A.00000003.341234990.00000000058C4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.326264766.00000000055E8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.327332370.0000000005691000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.324690932.000000000554B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342738021.00000000059E7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.324138518.000000000552F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.348155400.00000000055CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.323566431.0000000005568000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342349723.0000000005957000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330151704.000000000561B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.344745583.0000000005894000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.341386251.00000000058EC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.331489466.000000000571C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330745932.000000000574C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.325159441.0000000003100000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329876952.000000000564C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.331489466.0000000005730000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337214999.0000000005730000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.326999840.00000000055E1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.323811413.0000000003150000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329739931.00000000055CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://softwareulike.com/cWIYxWMPkK/
Source: wscript.exe, 0000000A.00000003.342822550.0000000005200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://softwareulike.com/cWIYxWMPkK/yM
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: wscript.exe, 0000000A.00000003.343758440.0000000005640000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wrappixels.com/wp-admin/GdIA2oOQEi
Source: wscript.exe, 0000000A.00000003.342624531.00000000059C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.324592475.000000000556E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330572608.00000000056E6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.325349096.00000000055B0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.322597416.00000000054F3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330847371.00000000056CB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329589851.0000000005669000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.325953256.00000000055C6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.324690932.0000000005518000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.341234990.00000000058C4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.326264766.00000000055E8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.327332370.0000000005691000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.324690932.000000000554B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342738021.00000000059E7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.324138518.000000000552F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.348155400.00000000055CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.323566431.0000000005568000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342349723.0000000005957000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330151704.000000000561B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.344745583.0000000005894000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.331489466.000000000571C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/
Source: wscript.exe, 0000000A.00000003.342822550.00000000051FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/0
Source: wscript.exe, 0000000A.00000003.342822550.0000000005200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/zM
Source: regsvr32.exe, 0000000D.00000003.532477535.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.533737252.0000000000A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://104.168.155.143:8080/
Source: regsvr32.exe, 0000000D.00000003.533810298.0000000000A16000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.561180722.0000000000A17000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://104.168.155.143:8080/acfnurik/pjkp/
Source: regsvr32.exe, 0000000D.00000003.533737252.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.532477535.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://104.168.155.143:8080/l
Source: regsvr32.exe, 0000000D.00000002.561463201.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.65.88.10:8080/
Source: regsvr32.exe, 0000000D.00000002.561463201.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.65.88.10:8080/.
Source: regsvr32.exe, 0000000D.00000002.561463201.0000000000AB3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.561463201.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.65.88.10:8080/acfnurik/pjkp/
Source: regsvr32.exe, 0000000D.00000002.561463201.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.65.88.10:8080/acfnurik/pjkp//
Source: regsvr32.exe, 0000000D.00000002.561463201.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.65.88.10:8080/v
Source: regsvr32.exe, 0000000D.00000002.561840669.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.561463201.0000000000A60000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.89.202.34/acfnurik/pjkp/
Source: regsvr32.exe, 0000000D.00000002.561180722.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.89.202.34/acfnurik/pjkp/G
Source: regsvr32.exe, 0000000D.00000002.561463201.0000000000A60000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.89.202.34/acfnurik/pjkp/o6Hhr
Source: regsvr32.exe, 0000000D.00000003.533737252.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.561180722.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.533810298.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.532477535.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://160.16.142.56:8080/
Source: regsvr32.exe, 0000000D.00000003.533737252.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.532477535.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://160.16.142.56:8080/.
Source: regsvr32.exe, 0000000D.00000003.533737252.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.561463201.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.532477535.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://160.16.142.56:8080/F
Source: regsvr32.exe, 0000000D.00000003.532477535.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.533737252.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.533737252.0000000000A5F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.532477535.0000000000AB3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.532477535.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://160.16.142.56:8080/acfnurik/pjkp/
Source: regsvr32.exe, 0000000D.00000003.533737252.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.532477535.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://160.16.142.56:8080/r
Source: regsvr32.exe, 0000000D.00000003.533737252.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.532477535.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://163.44.196.120:8080/L
Source: regsvr32.exe, 0000000D.00000003.533737252.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.532477535.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://163.44.196.120:8080/acfnurik/pjkp/
Source: regsvr32.exe, 0000000D.00000003.533737252.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.532477535.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://163.44.196.120:8080/acfnurik/pjkp/2
Source: regsvr32.exe, 0000000D.00000003.533737252.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.532477535.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://163.44.196.120:8080/l
Source: regsvr32.exe, 0000000D.00000003.533737252.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.561463201.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.532477535.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://164.90.222.65/V
Source: regsvr32.exe, 0000000D.00000002.561840669.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://164.90.222.65/acfnurik/pjkp/-
Source: regsvr32.exe, 0000000D.00000002.561896576.0000000002BD0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://169.65.88.10:8080/
Source: regsvr32.exe, 0000000D.00000002.561180722.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.532477535.0000000000A52000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://187.63.160.88:80/acfnurik/pjkp/q
Source: regsvr32.exe, 0000000D.00000003.533737252.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.532477535.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://66.228.32.31:7080/
Source: regsvr32.exe, 0000000D.00000002.560675790.00000000009C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://91.121.146.47:8080/
Source: regsvr32.exe, 0000000D.00000003.532477535.0000000000A3D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.561180722.0000000000A3F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://91.121.146.47:8080/acfnubbnr
Source: regsvr32.exe, 0000000D.00000002.560675790.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.400278720.0000000000A3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://91.121.146.47:8080/acfnurik/pjkp/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://api.aadrm.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://api.aadrm.com/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://api.addins.store.office.com/app/query
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://api.cortana.ai
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://api.diagnostics.office.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://api.diagnosticssdf.office.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://api.microsoftstream.com/api/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://api.office.net
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://api.onedrive.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://api.scheduler.
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://apis.live.net/v5.0/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://augloop.office.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://augloop.office.com/v2
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://autodiscover-s.outlook.com/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: wscript.exe, wscript.exe, 0000000A.00000003.330847371.00000000056DF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.322100825.0000000003144000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.322645365.0000000003155000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.344745583.00000000058AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337313422.0000000005744000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342708876.00000000059CA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.322847815.00000000054CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.326801237.0000000005634000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338014763.0000000005799000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.349049882.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340897230.00000000058AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.341340667.00000000058D5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337313422.0000000005784000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342086843.0000000005957000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.321369309.000000000311D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.325136624.0000000005507000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330151704.0000000005654000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342624531.00000000059C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.324592475.000000000556E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330572608.00000000056E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/
Source: wscript.exe, 0000000A.00000003.342822550.0000000005200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/uM
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://cdn.entity.
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://clients.config.office.net/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://config.edge.skype.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://cortana.ai
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://cortana.ai/api
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://cr.office.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://d.docs.live.net
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://dataservice.o365filtering.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://dataservice.o365filtering.com/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://designerapp.officeapps.live.com/designerapp
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://dev.cortana.ai
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://devnull.onenote.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://directory.services.
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://enrichment.osi.office.net/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://entitlement.diagnostics.office.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://graph.ppe.windows.net
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://graph.ppe.windows.net/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://graph.windows.net
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://graph.windows.net/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://incidents.diagnostics.office.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://invites.office.com/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://lifecycle.office.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://login.microsoftonline.com/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://login.windows.local
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://make.powerautomate.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://management.azure.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://management.azure.com/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://messaging.action.office.com/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://messaging.engagement.office.com/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://messaging.lifecycle.office.com/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://messaging.office.com/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://microsoftapc-my.sharepoint.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://ncus.contentsync.
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://ncus.pagecontentsync.
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://officeapps.live.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://onedrive.live.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://onedrive.live.com/embed?
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://otelrules.azureedge.net
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://outlook.office.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://outlook.office.com/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://outlook.office365.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://outlook.office365.com/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://pages.store.office.com/review/query
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: wscript.exe, 0000000A.00000002.349066831.0000000005A24000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.343720748.0000000005A23000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/
Source: wscript.exe, 0000000A.00000002.349109014.0000000005A3A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.345850174.0000000005A34000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.343482414.0000000005A34000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/8.
Source: wscript.exe, wscript.exe, 0000000A.00000003.330847371.00000000056DF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.322100825.0000000003144000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.322645365.0000000003155000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.344745583.00000000058AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337313422.0000000005744000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342708876.00000000059CA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.322847815.00000000054CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.326801237.0000000005634000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338014763.0000000005799000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.349049882.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340897230.00000000058AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.341340667.00000000058D5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337313422.0000000005784000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342086843.0000000005957000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.321369309.000000000311D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342977618.00000000034A4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.325136624.0000000005507000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330151704.0000000005654000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342624531.00000000059C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.324592475.000000000556E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/admin/Ses8712iGR8du/
Source: wscript.exe, 0000000A.00000003.325953256.00000000055C6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.348155400.00000000055CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329739931.00000000055CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/admin/Ses8712iGR8du/;1
Source: wscript.exe, 0000000A.00000002.349049882.0000000005A20000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/admin/Ses8712iGR8du/ocal
Source: wscript.exe, 0000000A.00000002.347557643.00000000030C5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.321190525.00000000030BD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.344931402.00000000030C5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.318167468.00000000030A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/admin/Ses8712iGR8du/otn
Source: wscript.exe, 0000000A.00000003.342822550.0000000005200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/admin/Ses8712iGR8du/tM
Source: wscript.exe, 0000000A.00000002.349049882.0000000005A20000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org:443/admin/Ses8712iGR8du/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: wscript.exe, wscript.exe, 0000000A.00000003.330847371.00000000056DF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.322100825.0000000003144000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.322645365.0000000003155000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.344745583.00000000058AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337313422.0000000005744000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342708876.00000000059CA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.322847815.00000000054CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.326801237.0000000005634000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338014763.0000000005799000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.349049882.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340897230.00000000058AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.341340667.00000000058D5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337313422.0000000005784000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342086843.0000000005957000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.321369309.000000000311D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.325136624.0000000005507000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330151704.0000000005654000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342624531.00000000059C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.324592475.000000000556E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330572608.00000000056E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/
Source: wscript.exe, 0000000A.00000003.342822550.0000000005200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/wM
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://powerlift-user.acompli.net
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://powerlift.acompli.net
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://pushchannel.1drv.ms
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://settings.outlook.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://shell.suite.office.com:1443
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://skyapi.live.net/Activity/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://staging.cortana.ai
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://store.office.cn/addinstemplate
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://store.office.de/addinstemplate
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://tasks.office.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://web.microsoftstream.com/video/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://webshell.suite.office.com
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://wus2.contentsync.
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://wus2.pagecontentsync.
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: wscript.exe, wscript.exe, 0000000A.00000003.330847371.00000000056DF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.322100825.0000000003144000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.322645365.0000000003155000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.344745583.00000000058AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337313422.0000000005744000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342708876.00000000059CA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.322847815.00000000054CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.326801237.0000000005634000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338014763.0000000005799000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.349049882.0000000005A20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340897230.00000000058AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.341340667.00000000058D5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337313422.0000000005784000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342086843.0000000005957000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.321369309.000000000311D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.325136624.0000000005507000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330151704.0000000005654000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342624531.00000000059C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.324592475.000000000556E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330572608.00000000056E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gomespontes.com.br/logs/pd/
Source: wscript.exe, 0000000A.00000003.342822550.0000000005200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gomespontes.com.br/logs/pd/vM
Source: D0161517-DEC8-4879-886E-56C64A97E450.0.dr String found in binary or memory: https://www.odwebp.svc.ms
Source: unknown HTTP traffic detected: POST /acfnurik/pjkp/ HTTP/1.1Connection: Keep-AliveContent-Length: 0Host: 182.162.143.56
Source: unknown DNS traffic detected: queries for: penshorn.org
Source: global traffic HTTP traffic detected: GET /admin/Ses8712iGR8du/ HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: penshorn.org
Source: unknown HTTPS traffic detected: 203.26.41.131:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.7:49707 version: TLS 1.2

E-Banking Fraud
barindex
Yara detected Emotet
Source: Yara match File source: 0000000D.00000002.560675790.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 13.2.regsvr32.exe.8f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.regsvr32.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.2550000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.2550000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.559981390.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.560329835.0000000000921000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.315209574.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.315246510.0000000002581000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Yara signature match
Source: 0000000A.00000003.343720748.0000000005A23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: WEBSHELL_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Creates files inside the system directory
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\system32\FtYcgioKSiXTtw\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180006818 12_2_0000000180006818
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_000000018000B878 12_2_000000018000B878
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180007110 12_2_0000000180007110
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180008D28 12_2_0000000180008D28
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180014555 12_2_0000000180014555
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_00C70000 12_2_00C70000
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258263C 12_2_0258263C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02588BC8 12_2_02588BC8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02598FC8 12_2_02598FC8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258CC14 12_2_0258CC14
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259A000 12_2_0259A000
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259709C 12_2_0259709C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02587D6C 12_2_02587D6C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258B258 12_2_0258B258
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258F65C 12_2_0258F65C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259A244 12_2_0259A244
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02590A70 12_2_02590A70
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02583274 12_2_02583274
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258A660 12_2_0258A660
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258461C 12_2_0258461C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02584214 12_2_02584214
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02598E08 12_2_02598E08
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02583E0C 12_2_02583E0C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259020C 12_2_0259020C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02595A00 12_2_02595A00
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025A8A00 12_2_025A8A00
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258BA2C 12_2_0258BA2C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02598A2C 12_2_02598A2C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02590E2C 12_2_02590E2C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259662C 12_2_0259662C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025996D4 12_2_025996D4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258D6CC 12_2_0258D6CC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259EAC0 12_2_0259EAC0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025892F0 12_2_025892F0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258BE90 12_2_0258BE90
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02594A90 12_2_02594A90
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02588A8C 12_2_02588A8C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025A4E8C 12_2_025A4E8C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258AAB8 12_2_0258AAB8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02584EB8 12_2_02584EB8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02583ABC 12_2_02583ABC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259A6BC 12_2_0259A6BC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02584758 12_2_02584758
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258975C 12_2_0258975C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259E750 12_2_0259E750
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02588378 12_2_02588378
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258F77C 12_2_0258F77C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259D770 12_2_0259D770
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259CF70 12_2_0259CF70
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02594F18 12_2_02594F18
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259E310 12_2_0259E310
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258EF14 12_2_0258EF14
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02593B14 12_2_02593B14
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258D33C 12_2_0258D33C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02593FD0 12_2_02593FD0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02582FD4 12_2_02582FD4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025833D4 12_2_025833D4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025997CC 12_2_025997CC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258A7F0 12_2_0258A7F0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025A27EC 12_2_025A27EC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02581B94 12_2_02581B94
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02595384 12_2_02595384
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258FFB8 12_2_0258FFB8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02598BB8 12_2_02598BB8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02588FB0 12_2_02588FB0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258DBA0 12_2_0258DBA0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259C058 12_2_0259C058
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025A5450 12_2_025A5450
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259C44C 12_2_0259C44C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02587840 12_2_02587840
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02582C78 12_2_02582C78
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258C078 12_2_0258C078
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258B07C 12_2_0258B07C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02596C70 12_2_02596C70
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258D474 12_2_0258D474
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259B460 12_2_0259B460
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025A181C 12_2_025A181C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02589408 12_2_02589408
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02587C08 12_2_02587C08
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02581000 12_2_02581000
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258B83C 12_2_0258B83C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02591030 12_2_02591030
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259EC30 12_2_0259EC30
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025818DC 12_2_025818DC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025814D4 12_2_025814D4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02593CD4 12_2_02593CD4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025880CC 12_2_025880CC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025908CC 12_2_025908CC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258F8C4 12_2_0258F8C4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02595CC4 12_2_02595CC4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025890F8 12_2_025890F8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025848FC 12_2_025848FC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02583CF4 12_2_02583CF4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025920E0 12_2_025920E0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258AC94 12_2_0258AC94
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02595880 12_2_02595880
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02584C84 12_2_02584C84
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259CC84 12_2_0259CC84
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258DCB8 12_2_0258DCB8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025A94BC 12_2_025A94BC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259A8B0 12_2_0259A8B0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025898AC 12_2_025898AC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02597518 12_2_02597518
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025A9910 12_2_025A9910
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259610C 12_2_0259610C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025A8500 12_2_025A8500
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02586138 12_2_02586138
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02587530 12_2_02587530
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259B130 12_2_0259B130
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259AD28 12_2_0259AD28
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02594D20 12_2_02594D20
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02591924 12_2_02591924
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025915C8 12_2_025915C8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259D5F0 12_2_0259D5F0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025895BC 12_2_025895BC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259BDA0 12_2_0259BDA0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_008E0000 13_2_008E0000
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009308CC 13_2_009308CC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092CC14 13_2_0092CC14
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00927D6C 13_2_00927D6C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00940618 13_2_00940618
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009473A4 13_2_009473A4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009263A4 13_2_009263A4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00933FD0 13_2_00933FD0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00928BC8 13_2_00928BC8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00938FC8 13_2_00938FC8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00929B79 13_2_00929B79
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00941494 13_2_00941494
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092AC94 13_2_0092AC94
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093709C 13_2_0093709C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00935880 13_2_00935880
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00924C84 13_2_00924C84
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093CC84 13_2_0093CC84
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0094488C 13_2_0094488C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093A8B0 13_2_0093A8B0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009494BC 13_2_009494BC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092DCB8 13_2_0092DCB8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009444A8 13_2_009444A8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009298AC 13_2_009298AC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00941CD4 13_2_00941CD4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009214D4 13_2_009214D4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00933CD4 13_2_00933CD4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009218DC 13_2_009218DC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092F8C4 13_2_0092F8C4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00935CC4 13_2_00935CC4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009280CC 13_2_009280CC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00923CF4 13_2_00923CF4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009290F8 13_2_009290F8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009248FC 13_2_009248FC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009320E0 13_2_009320E0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00927410 13_2_00927410
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0094181C 13_2_0094181C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00921000 13_2_00921000
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093A000 13_2_0093A000
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00929408 13_2_00929408
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00927C08 13_2_00927C08
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00931030 13_2_00931030
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093EC30 13_2_0093EC30
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092B83C 13_2_0092B83C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00945450 13_2_00945450
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093C058 13_2_0093C058
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00927840 13_2_00927840
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093C44C 13_2_0093C44C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00936C70 13_2_00936C70
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092D474 13_2_0092D474
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00922C78 13_2_00922C78
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092C078 13_2_0092C078
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092B07C 13_2_0092B07C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093B460 13_2_0093B460
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00945868 13_2_00945868
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009295BC 13_2_009295BC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093BDA0 13_2_0093BDA0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009315C8 13_2_009315C8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093D5F0 13_2_0093D5F0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00949910 13_2_00949910
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00937518 13_2_00937518
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00948500 13_2_00948500
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00942100 13_2_00942100
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093610C 13_2_0093610C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093B130 13_2_0093B130
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00926138 13_2_00926138
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00934D20 13_2_00934D20
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00931924 13_2_00931924
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093AD28 13_2_0093AD28
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00944D64 13_2_00944D64
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092BE90 13_2_0092BE90
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00934A90 13_2_00934A90
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00942E84 13_2_00942E84
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00944E8C 13_2_00944E8C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00928A8C 13_2_00928A8C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00942AB0 13_2_00942AB0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092AAB8 13_2_0092AAB8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00924EB8 13_2_00924EB8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00937EBE 13_2_00937EBE
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00923ABC 13_2_00923ABC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093A6BC 13_2_0093A6BC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009396D4 13_2_009396D4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093EAC0 13_2_0093EAC0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092D6CC 13_2_0092D6CC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009292F0 13_2_009292F0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009436FC 13_2_009436FC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00924214 13_2_00924214
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092461C 13_2_0092461C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00935A00 13_2_00935A00
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00948A00 13_2_00948A00
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00938E08 13_2_00938E08
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00923E0C 13_2_00923E0C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093020C 13_2_0093020C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092263C 13_2_0092263C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092BA2C 13_2_0092BA2C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00938A2C 13_2_00938A2C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00930E2C 13_2_00930E2C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093662C 13_2_0093662C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092B258 13_2_0092B258
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092F65C 13_2_0092F65C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093A244 13_2_0093A244
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00946E48 13_2_00946E48
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00930A70 13_2_00930A70
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00923274 13_2_00923274
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092A660 13_2_0092A660
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00921B94 13_2_00921B94
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093779A 13_2_0093779A
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00935384 13_2_00935384
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00928FB0 13_2_00928FB0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092FFB8 13_2_0092FFB8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00938BB8 13_2_00938BB8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092DBA0 13_2_0092DBA0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009447A8 13_2_009447A8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00922FD4 13_2_00922FD4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009233D4 13_2_009233D4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009397CC 13_2_009397CC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092A7F0 13_2_0092A7F0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093FFFC 13_2_0093FFFC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009427EC 13_2_009427EC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093E310 13_2_0093E310
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00948310 13_2_00948310
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092EF14 13_2_0092EF14
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00933B14 13_2_00933B14
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00945B1C 13_2_00945B1C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00934F18 13_2_00934F18
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092D33C 13_2_0092D33C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093E750 13_2_0093E750
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00924758 13_2_00924758
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092975C 13_2_0092975C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093D770 13_2_0093D770
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093CF70 13_2_0093CF70
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00928378 13_2_00928378
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0092F77C 13_2_0092F77C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00948B68 13_2_00948B68
Contains functionality to call native functions
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180010C10 LdrFindResource_U,LdrAccessResource,NtAllocateVirtualMemory, 12_2_0000000180010C10
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180010AC0 ExitProcess,RtlQueueApcWow64Thread,NtTestAlert, 12_2_0000000180010AC0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180010DB0 ZwOpenSymbolicLinkObject,ZwOpenSymbolicLinkObject, 12_2_0000000180010DB0
Tries to load missing DLLs
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\rad617F4.tmp.dll 2F39C2879989DDD7F9ECF52B6232598E5595F8BF367846FF188C9DFBF1251253
Source: Insight_Medical_Publishing_1.one ReversingLabs: Detection: 33%
Source: Insight_Medical_Publishing_1.one Virustotal: Detection: 42%
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE" "C:\Users\user\Desktop\Insight_Medical_Publishing_1.one
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process created: C:\Windows\SysWOW64\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Local\Temp\click.wsf"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\rad617F4.tmp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe "C:\Users\user\AppData\Local\Temp\rad617F4.tmp.dll"
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FtYcgioKSiXTtw\clpHRoMLOOCr.dll"
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process created: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE /tsr
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE "C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE" /tsr
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process created: C:\Windows\SysWOW64\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Local\Temp\click.wsf" Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process created: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE /tsr Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\rad617F4.tmp.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe "C:\Users\user\AppData\Local\Temp\rad617F4.tmp.dll" Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FtYcgioKSiXTtw\clpHRoMLOOCr.dll" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06290BD0-48AA-11D2-8432-006008C3FBFC}\InprocServer32 Jump to behavior
Source: Send to OneNote.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE File created: C:\Users\user\Documents\{0236116B-B959-44EF-9D39-2E715CD22D7B} Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE File created: C:\Users\user~1\AppData\Local\Temp\{E358F697-0D01-4E39-B580-A57605B896E6} - OProcSessId.dat Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winONE@12/693@1/50
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE File read: C:\Program Files (x86)\desktop.ini Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02588BC8 Process32FirstW,CreateToolhelp32Snapshot,FindCloseChangeNotification, 12_2_02588BC8
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE Mutant created: \Sessions\1\BaseNamedObjects\OneNoteM:AppShared
Source: C:\Windows\SysWOW64\wscript.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180005C69 push rdi; ret 12_2_0000000180005C72
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_00000001800056DD push rdi; ret 12_2_00000001800056E4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258A26E push ebp; ret 12_2_0258A26F
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02589E8B push eax; retf 12_2_02589E8E
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02597EAF push 458BCC5Ah; retf 12_2_02597EBC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0259C731 push esi; iretd 12_2_0259C732
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02586CDE push esi; iretd 12_2_02586CDF
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_025980D7 push ebp; retf 12_2_025980D8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258A0FC push ebp; iretd 12_2_0258A0FD
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02586C9F pushad ; ret 12_2_02586CAA
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02589D51 push ebp; retf 12_2_02589D5A
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02598157 push ebp; retf 12_2_02598158
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02597D4E push ebp; iretd 12_2_02597D4F
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02597D3C push ebp; retf 12_2_02597D3D
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02597D25 push 4D8BFFFFh; retf 12_2_02597D2A
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0258A1D2 push ebp; iretd 12_2_0258A1D3
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_02597987 push ebp; iretd 12_2_0259798F
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00946D34 push edi; ret 13_2_00946D36
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00937D3C push ebp; retf 13_2_00937D3D
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00937D25 push 4D8BFFFFh; retf 13_2_00937D2A
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00937D4E push ebp; iretd 13_2_00937D4F
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00937EAF push 458BCC5Ah; retf 13_2_00937EBC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0093C731 push esi; iretd 13_2_0093C732
PE file contains sections with non-standard names
Source: rad617F4.tmp.dll.10.dr Static PE information: section name: _RDATA
Registers a DLL
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\rad617F4.tmp.dll
Drops PE files
Source: C:\Windows\SysWOW64\wscript.exe File created: C:\Users\user\AppData\Local\Temp\rad617F4.tmp.dll Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\FtYcgioKSiXTtw\clpHRoMLOOCr.dll (copy) Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\FtYcgioKSiXTtw\clpHRoMLOOCr.dll (copy) Jump to dropped file
Stores files to the Windows start menu directory
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk Jump to behavior
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\System32\regsvr32.exe File opened: C:\Windows\system32\FtYcgioKSiXTtw\clpHRoMLOOCr.dll:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\wscript.exe TID: 6052 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 960 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 4724 Thread sleep time: -270000s >= -30000s Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\System32\regsvr32.exe API coverage: 9.3 %
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180008D28 FindFirstFileExW, 12_2_0000000180008D28
Source: C:\Windows\System32\regsvr32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: regsvr32.exe, 0000000D.00000002.561180722.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.532477535.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.400278720.0000000000A52000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW6
Source: regsvr32.exe, 0000000D.00000002.561122333.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.400051235.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW`v
Source: wscript.exe, 0000000A.00000003.342708876.00000000059CA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342624531.00000000059C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.343202791.0000000005A60000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.345217524.0000000005A60000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.342805819.00000000059D3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.348973973.00000000059DA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.349159555.0000000005A60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.561180722.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.532477535.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.400278720.0000000000A52000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180001C48 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_0000000180001C48
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_000000018000A878 GetProcessHeap, 12_2_000000018000A878
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180010C10 LdrFindResource_U,LdrAccessResource,NtAllocateVirtualMemory, 12_2_0000000180010C10
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180001C48 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_0000000180001C48
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_00000001800082EC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_00000001800082EC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_00000001800017DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 12_2_00000001800017DC

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 159.65.88.10 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 164.90.222.65 443 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Network Connect: 203.26.41.131 443 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Domain query: penshorn.org
Source: C:\Windows\System32\regsvr32.exe Network Connect: 66.228.32.31 7080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 187.63.160.88 80 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 104.168.155.143 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 159.89.202.34 443 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 91.121.146.47 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 160.16.142.56 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 182.162.143.56 443 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 167.172.199.165 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 163.44.196.120 8080 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\rad617F4.tmp.dll Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_00000001800070A0 cpuid 12_2_00000001800070A0
Source: C:\Windows\SysWOW64\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180001D98 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 12_2_0000000180001D98

Stealing of Sensitive Information
barindex
Yara detected Malicious OneNote
Source: Yara match File source: Insight_Medical_Publishing_1.one, type: SAMPLE
Source: Yara match File source: C:\Users\user\Desktop\Insight_Medical_Publishing_1.one, type: DROPPED
Yara detected Emotet
Source: Yara match File source: 0000000D.00000002.560675790.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 13.2.regsvr32.exe.8f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.regsvr32.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.2550000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.2550000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.559981390.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.560329835.0000000000921000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.315209574.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.315246510.0000000002581000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Malicious OneNote
Source: Yara match File source: Insight_Medical_Publishing_1.one, type: SAMPLE
Source: Yara match File source: C:\Users\user\Desktop\Insight_Medical_Publishing_1.one, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 828501 Sample: Insight_Medical_Publishing_1.one Startdate: 17/03/2023 Architecture: WINDOWS Score: 100 43 129.232.188.93 xneeloZA South Africa 2->43 45 45.235.8.30 WIKINETTELECOMUNICACOESBR Brazil 2->45 47 35 other IPs or domains 2->47 59 Snort IDS alert for network traffic 2->59 61 Multi AV Scanner detection for domain / URL 2->61 63 Antivirus detection for URL or domain 2->63 65 7 other signatures 2->65 10 ONENOTE.EXE 50 501 2->10         started        14 ONENOTEM.EXE 2->14         started        signatures3 process4 dnsIp5 49 192.168.2.1 unknown unknown 10->49 39 C:\Users\...\Insight_Medical_Publishing_1.one, data 10->39 dropped 16 wscript.exe 2 10->16         started        21 ONENOTEM.EXE 1 10->21         started        file6 process7 dnsIp8 41 penshorn.org 203.26.41.131, 443, 49701 DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU Australia 16->41 33 C:\Users\user\AppData\...\rad617F4.tmp.dll, PE32+ 16->33 dropped 35 C:\Users\user\AppData\Local\Temp\click.wsf, ASCII 16->35 dropped 57 System process connects to network (likely due to code injection or exploit) 16->57 23 regsvr32.exe 16->23         started        file9 signatures10 process11 process12 25 regsvr32.exe 2 23->25         started        file13 37 C:\Windows\...\clpHRoMLOOCr.dll (copy), PE32+ 25->37 dropped 67 Hides that the sample has been downloaded from the Internet (zone.identifier) 25->67 29 regsvr32.exe 25->29         started        signatures14 process15 dnsIp16 51 160.16.142.56, 8080 SAKURA-BSAKURAInternetIncJP Japan 29->51 53 91.121.146.47, 49704, 8080 OVHFR France 29->53 55 9 other IPs or domains 29->55 69 System process connects to network (likely due to code injection or exploit) 29->69 signatures17
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
110.232.117.186
 unknown Australia
56038 RACKCORP-APRackCorpAU true
103.132.242.26
 unknown India
45117 INPL-IN-APIshansNetworkIN true
104.168.155.143
 unknown United States
54290 HOSTWINDSUS true
79.137.35.198
 unknown France
16276 OVHFR true
115.68.227.76
 unknown Korea Republic of
38700 SMILESERV-AS-KRSMILESERVKR true
163.44.196.120
 unknown Singapore
135161 GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG true
206.189.28.199
 unknown United States
14061 DIGITALOCEAN-ASNUS true
203.26.41.131
 penshorn.org Australia
38719 DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU true
107.170.39.149
 unknown United States
14061 DIGITALOCEAN-ASNUS true
66.228.32.31
 unknown United States
63949 LINODE-APLinodeLLCUS true
197.242.150.244
 unknown South Africa
37611 AfrihostZA true
185.4.135.165
 unknown Greece
199246 TOPHOSTGR true
183.111.227.137
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR true
45.176.232.124
 unknown Colombia
267869 CABLEYTELECOMUNICACIONESDECOLOMBIASASCABLETELCOC true
169.57.156.166
 unknown United States
36351 SOFTLAYERUS true
164.68.99.3
 unknown Germany
51167 CONTABODE true
139.59.126.41
 unknown Singapore
14061 DIGITALOCEAN-ASNUS true
167.172.253.162
 unknown United States
14061 DIGITALOCEAN-ASNUS true
167.172.199.165
 unknown United States
14061 DIGITALOCEAN-ASNUS true
202.129.205.3
 unknown Thailand
45328 NIPA-AS-THNIPATECHNOLOGYCOLTDTH true
147.139.166.154
 unknown United States
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC true
153.92.5.27
 unknown Germany
47583 AS-HOSTINGERLT true
159.65.88.10
 unknown United States
14061 DIGITALOCEAN-ASNUS true
172.105.226.75
 unknown United States
63949 LINODE-APLinodeLLCUS true
164.90.222.65
 unknown United States
14061 DIGITALOCEAN-ASNUS true
213.239.212.5
 unknown Germany
24940 HETZNER-ASDE true
5.135.159.50
 unknown France
16276 OVHFR true
186.194.240.217
 unknown Brazil
262733 NetceteraTelecomunicacoesLtdaBR true
119.59.103.152
 unknown Thailand
56067 METRABYTE-TH453LadplacoutJorakhaebuaTH true
159.89.202.34
 unknown United States
14061 DIGITALOCEAN-ASNUS true
91.121.146.47
 unknown France
16276 OVHFR true
160.16.142.56
 unknown Japan 9370 SAKURA-BSAKURAInternetIncJP true
201.94.166.162
 unknown Brazil
28573 CLAROSABR true
91.207.28.33
 unknown Kyrgyzstan
39819 PROHOSTKG true
103.75.201.2
 unknown Thailand
133496 CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH true
103.43.75.120
 unknown Japan 20473 AS-CHOOPAUS true
188.44.20.25
 unknown Macedonia
57374 GIV-ASMK true
45.235.8.30
 unknown Brazil
267405 WIKINETTELECOMUNICACOESBR true
153.126.146.25
 unknown Japan 7684 SAKURA-ASAKURAInternetIncJP true
72.15.201.15
 unknown United States
13649 ASN-VINSUS true
187.63.160.88
 unknown Brazil
28169 BITCOMPROVEDORDESERVICOSDEINTERNETLTDABR true
82.223.21.224
 unknown Spain
8560 ONEANDONE-ASBrauerstrasse48DE true
173.212.193.249
 unknown Germany
51167 CONTABODE true
95.217.221.146
 unknown Germany
24940 HETZNER-ASDE true
149.56.131.28
 unknown Canada
16276 OVHFR true
182.162.143.56
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR true
1.234.2.232
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR true
129.232.188.93
 unknown South Africa
37153 xneeloZA true
94.23.45.86
 unknown France
16276 OVHFR true

Private

IP
192.168.2.1

Contacted Domains

Name IP Active
penshorn.org 203.26.41.131 true